From 84401847ff50009c120dcbbfdf17868b86c2a01b Mon Sep 17 00:00:00 2001 From: Valentin Obst Date: Wed, 20 Dec 2023 18:38:07 +0100 Subject: [PATCH 0001/1352] add sanity check in Linux find_aslr to skip unrelocated init_task --- volatility3/framework/automagic/linux.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 2eebcc2dc..fda71b766 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -156,6 +156,18 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): and init_task.state.cast("unsigned int") != 0 ): continue + elif init_task.active_mm.cast("long unsigned int") == module.get_symbol( + "init_mm" + ).address and init_task.tasks.next.cast( + "long unsigned int" + ) == init_task.tasks.prev.cast( + "long unsigned int" + ): + # The idle task steals `mm` from previously running task, i.e., + # `init_mm` is only used as long as no CPU has ever been idle. + # This catches cases where we found a fragment of the + # unrelocated ELF file instead of the running kernel. + continue # This we get for free aslr_shift = ( From 82668af60960d6aa8467a58e6e6b4979a8e26a9b Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 9 Jan 2024 16:12:56 -0300 Subject: [PATCH 0002/1352] Linux - Added linux.ifconfig.Ifconfig plugin --- .../framework/constants/linux/__init__.py | 12 + .../framework/plugins/linux/ifconfig.py | 80 +++++++ .../framework/symbols/linux/__init__.py | 5 + .../symbols/linux/extensions/__init__.py | 205 +++++++++++++++++- 4 files changed, 301 insertions(+), 1 deletion(-) create mode 100644 volatility3/framework/plugins/linux/ifconfig.py diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 6e8883f19..aa0692365 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -281,3 +281,15 @@ CAPABILITIES = ( ) ELF_MAX_EXTRACTION_SIZE = 1024 * 1024 * 1024 * 4 - 1 + +# For IFA_* below - Ref: include/net/ipv6.h +IPV6_ADDR_LOOPBACK = 0x0010 +IPV6_ADDR_LINKLOCAL = 0x0020 +IPV6_ADDR_SITELOCAL = 0x0040 +# For inet6_ifaddr - Ref: include/net/if_inet6.h +IFA_HOST = IPV6_ADDR_LOOPBACK +IFA_LINK = IPV6_ADDR_LINKLOCAL +IFA_SITE = IPV6_ADDR_SITELOCAL + +# Promiscous mode +IFF_PROMISC = 0x100 diff --git a/volatility3/framework/plugins/linux/ifconfig.py b/volatility3/framework/plugins/linux/ifconfig.py new file mode 100644 index 000000000..39f4208bf --- /dev/null +++ b/volatility3/framework/plugins/linux/ifconfig.py @@ -0,0 +1,80 @@ +# This file is Copyright 2023 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +from typing import List +from volatility3.framework import interfaces, renderers, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility + + +class Ifconfig(plugins.PluginInterface): + """Lists network interface information for all devices""" + + _required_framework_version = (2, 0, 0) + + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + ] + + def _gather_net_dev_info(self, net_dev): + mac_addr = net_dev.get_mac_address() + promisc = net_dev.promisc + iface_name = utility.array_to_string(net_dev.name) + iface_ifindex = net_dev.ifindex + try: + net_ns_id = net_dev.get_net_namespace_id() + except AttributeError: + net_ns_id = renderers.NotAvailableValue() + + # Interface IPv4 Addresses + in_device = net_dev.ip_ptr.dereference().cast("in_device") + for in_ifaddr in in_device.get_addresses(): + prefix_len = in_ifaddr.get_prefix_len() + scope_type = in_ifaddr.get_scope_type() + ip_addr = in_ifaddr.get_address() + yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type + + # Interface IPv6 Addresses + ip6_ptr = net_dev.ip6_ptr.dereference().cast("inet6_dev") + for inet6_ifaddr in ip6_ptr.get_addresses(): + prefix_len = inet6_ifaddr.get_prefix_len() + scope_type = inet6_ifaddr.get_scope_type() + ip6_addr = inet6_ifaddr.get_address() + yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type + + def _generator(self): + vmlinux = self.context.modules[self.config["kernel"]] + + net_type_symname = vmlinux.symbol_table_name + constants.BANG + "net" + net_device_symname = vmlinux.symbol_table_name + constants.BANG + "net_device" + + # 'net_namespace_list' exists from kernels >= 2.6.24 + net_namespace_list = vmlinux.object_from_symbol("net_namespace_list") + for net_ns in net_namespace_list.to_list(net_type_symname, "list"): + for net_dev in net_ns.dev_base_head.to_list(net_device_symname, "dev_list"): + for fields in self._gather_net_dev_info(net_dev): + yield 0, fields + + def run(self): + headers = [ + ("NetNS", int), + ("Index", int), + ("Interface", str), + ("MAC", str), + ("Promiscuous", bool), + ("IP", str), + ("Prefix", int), + ("Scope Type", str), + ] + + return renderers.TreeGrid(headers, self._generator()) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index c4e2587f4..10cc546b7 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -43,6 +43,11 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): # Network self.set_type_class("net", extensions.net) + self.set_type_class("net_device", extensions.net_device) + self.set_type_class("in_device", extensions.in_device) + self.set_type_class("in_ifaddr", extensions.in_ifaddr) + self.set_type_class("inet6_dev", extensions.inet6_dev) + self.set_type_class("inet6_ifaddr", extensions.inet6_ifaddr) self.set_type_class("socket", extensions.socket) self.set_type_class("sock", extensions.sock) self.set_type_class("inet_sock", extensions.inet_sock) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index d8a2867cc..085d91bff 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -4,6 +4,7 @@ import collections.abc import logging +import struct import socket as socket_module from typing import Generator, Iterable, Iterator, Optional, Tuple, List @@ -13,7 +14,8 @@ from volatility3.framework.constants.linux import IP_PROTOCOLS, IPV6_PROTOCOLS from volatility3.framework.constants.linux import TCP_STATES, NETLINK_PROTOCOLS from volatility3.framework.constants.linux import ETH_PROTOCOLS, BLUETOOTH_STATES from volatility3.framework.constants.linux import BLUETOOTH_PROTOCOLS, SOCKET_STATES -from volatility3.framework.constants.linux import CAPABILITIES +from volatility3.framework.constants.linux import CAPABILITIES, IFF_PROMISC +from volatility3.framework.constants.linux import IFA_HOST, IFA_LINK, IFA_SITE from volatility3.framework import exceptions, objects, interfaces, symbols from volatility3.framework.layers import linear from volatility3.framework.objects import utility @@ -1213,6 +1215,15 @@ class mnt_namespace(objects.StructType): class net(objects.StructType): def get_inode(self): + """Get the namespace id for this network namespace. + + Raises: + AttributeError: If it cannot find the network namespace id for the + current kernel. + + Returns: + int: the namespace id + """ if self.has_member("proc_inum"): # 3.8.13 <= kernel < 3.19.8 return self.proc_inum @@ -1224,6 +1235,198 @@ class net(objects.StructType): raise AttributeError("Unable to find net_namespace inode") +class net_device(objects.StructType): + @staticmethod + def _format_as_mac_address(hwaddr): + return ":".join([f"{x:02x}" for x in hwaddr[:6]]) + + def get_mac_address(self): + """Get the MAC address of this network interface. + + Returns: + str: the MAC address of this network interface. + """ + if self.has_member("perm_addr"): + mac_addr = self._format_as_mac_address(self.perm_addr) + if mac_addr != "00:00:00:00:00:00": + return mac_addr + + parent_layer = self._context.layers[self.vol.layer_name] + try: + hwaddr = parent_layer.read(self.dev_addr, 6) + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to read network inteface mac address from {self.dev_addr:#x}" + ) + return + + return self._format_as_mac_address(hwaddr) + + @property + def promisc(self): + """Return if this network interface is in promiscuous mode. + + Returns: + bool: True if this network interface is in promiscuous mode. Otherwise, False + """ + return self.flags & IFF_PROMISC == IFF_PROMISC + + def get_net_namespace_id(self): + """Return the network namespace id for this network interface. + + Returns: + int: the network namespace id for this network interface + """ + nd_net = self.nd_net + if nd_net.has_member("net"): + # In kernel 4.1.52 the 'nd_net' member type was changed from + # 'struct net*' to 'possible_net_t' which has a 'struct net *net' member. + net_ns_id = nd_net.net.get_inode() + else: + # In kernels < 4.1.52 the 'nd_net'member type was 'struct net*' + net_ns_id = nd_net.get_inode() + + return net_ns_id + + +class in_device(objects.StructType): + def get_addresses(self): + """Yield the IPv4 ifaddr addresses + + Yields: + in_ifaddr: An IPv4 ifaddr address + """ + cur = self.ifa_list + while cur and cur.vol.offset: + yield cur + cur = cur.ifa_next + + +class inet6_dev(objects.StructType): + def get_addresses(self): + """Yield the IPv6 ifaddr addresses + + Yields: + inet6_ifaddr: An IPv6 ifaddr address + """ + if not self.has_member( + "addr_list" + ) or not self.addr_list.vol.type_name.endswith(constants.BANG + "list_head"): + # kernels < 3.0 + # FIXME: struct inet6_ifaddr *addr_list; + vollog.warning( + "IPv6 is unsupported for this kernel. Check if the ISF contains the appropriate 'inet6_dev' type" + ) + return + + symbol_space = self._context.symbol_space + table_name = self.vol.type_name.split(constants.BANG)[0] + inet6_ifaddr_symname = table_name + constants.BANG + "inet6_ifaddr" + if not symbol_space.has_type(inet6_ifaddr_symname) or not symbol_space.get_type( + inet6_ifaddr_symname + ).has_member("if_list"): + vollog.warning( + "IPv6 is unsupported for this kernel. Check if the ISF contains the appropriate 'inet6_ifaddr' type" + ) + return + + # 'if_list' member was added to 'inet6_ifaddr' type in kernels 3.0 + for inet6_ifaddr in self.addr_list.to_list(inet6_ifaddr_symname, "if_list"): + yield inet6_ifaddr + + +class in_ifaddr(objects.StructType): + # Translation to text based on iproute2 package. See 'rtnl_rtscope_tab' in lib/rt_names.c + _rtnl_rtscope_tab = { + "RT_SCOPE_UNIVERSE": "global", + "RT_SCOPE_NOWHERE": "nowhere", + "RT_SCOPE_HOST": "host", + "RT_SCOPE_LINK": "link", + "RT_SCOPE_SITE": "site", + } + + def get_scope_type(self): + """Get the scope type for this IPv4 address + + Returns: + str: the IPv4 scope type. + """ + table_name = self.vol.type_name.split(constants.BANG)[0] + rt_scope_enum = self._context.symbol_space.get_enumeration( + table_name + constants.BANG + "rt_scope_t" + ) + try: + rt_scope = rt_scope_enum.lookup(self.ifa_scope) + except ValueError: + return "unknown" + + return self._rtnl_rtscope_tab.get(rt_scope, "unknown") + + def get_address(self): + """Get an string with the IPv4 address + + Returns: + str: the IPv4 address + """ + ipv4_bytes = struct.pack(" Date: Tue, 9 Jan 2024 16:13:33 -0300 Subject: [PATCH 0003/1352] Fix exception. Although it will be auto-instantiated it's better to explicitily use the exception instance --- volatility3/framework/interfaces/objects.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index ab568b927..b74267197 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -133,7 +133,7 @@ class ObjectInterface(metaclass=abc.ABCMeta): def __getattr__(self, attr: str) -> Any: """Method for ensuring volatility members can be returned.""" - raise AttributeError + raise AttributeError() @property def vol(self) -> ReadOnlyMapping: From 6e0ffc9d624fa9f7845fd5b8510a977b619d52d3 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 27 Jan 2024 17:39:34 -0300 Subject: [PATCH 0004/1352] Plugin renamed. Added net iface status and other improvements from @eve #1029 * IP address conversion via renderers.coversion.* * Use MAC address internal size instead of hardcoded. * Read NET_DEVICE_FLAGS from enumeration --- .../framework/constants/linux/__init__.py | 36 +++++++- .../plugins/linux/{ifconfig.py => ip.py} | 12 +-- .../symbols/linux/extensions/__init__.py | 83 ++++++++++++------- 3 files changed, 94 insertions(+), 37 deletions(-) rename volatility3/framework/plugins/linux/{ifconfig.py => ip.py} (88%) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index aa0692365..21e0b47f7 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -291,5 +291,37 @@ IFA_HOST = IPV6_ADDR_LOOPBACK IFA_LINK = IPV6_ADDR_LINKLOCAL IFA_SITE = IPV6_ADDR_SITELOCAL -# Promiscous mode -IFF_PROMISC = 0x100 +# Only for kernels < 3.15 when the net_device_flags enum didn't exist +# ref include/uapi/linux/if.h +NET_DEVICE_FLAGS = { + "IFF_UP": 0x1, + "IFF_BROADCAST": 0x2, + "IFF_DEBUG": 0x4, + "IFF_LOOPBACK": 0x8, + "IFF_POINTOPOINT": 0x10, + "IFF_NOTRAILERS": 0x20, + "IFF_RUNNING": 0x40, + "IFF_NOARP": 0x80, + "IFF_PROMISC": 0x100, + "IFF_ALLMULTI": 0x200, + "IFF_MASTER": 0x400, + "IFF_SLAVE": 0x800, + "IFF_MULTICAST": 0x1000, + "IFF_PORTSEL": 0x2000, + "IFF_AUTOMEDIA": 0x4000, + "IFF_DYNAMIC": 0x8000, + "IFF_LOWER_UP": 0x10000, + "IFF_DORMANT": 0x20000, + "IFF_ECHO": 0x40000, +} + +# RFC 2863 operational status. Kernels >= 2.6.17. See IF_OPER_* in include/uapi/linux/if.h +IF_OPER_STATES = ( + "UNKNOWN", + "NOTPRESENT", + "DOWN", + "LOWERLAYERDOWN", + "TESTING", + "DORMANT", + "UP", +) diff --git a/volatility3/framework/plugins/linux/ifconfig.py b/volatility3/framework/plugins/linux/ip.py similarity index 88% rename from volatility3/framework/plugins/linux/ifconfig.py rename to volatility3/framework/plugins/linux/ip.py index 39f4208bf..19393a853 100644 --- a/volatility3/framework/plugins/linux/ifconfig.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -9,7 +9,7 @@ from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility -class Ifconfig(plugins.PluginInterface): +class Addr(plugins.PluginInterface): """Lists network interface information for all devices""" _required_framework_version = (2, 0, 0) @@ -29,6 +29,7 @@ class Ifconfig(plugins.PluginInterface): def _gather_net_dev_info(self, net_dev): mac_addr = net_dev.get_mac_address() promisc = net_dev.promisc + operational_state = net_dev.get_operational_state() iface_name = utility.array_to_string(net_dev.name) iface_ifindex = net_dev.ifindex try: @@ -42,15 +43,15 @@ class Ifconfig(plugins.PluginInterface): prefix_len = in_ifaddr.get_prefix_len() scope_type = in_ifaddr.get_scope_type() ip_addr = in_ifaddr.get_address() - yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type + yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type, operational_state # Interface IPv6 Addresses - ip6_ptr = net_dev.ip6_ptr.dereference().cast("inet6_dev") - for inet6_ifaddr in ip6_ptr.get_addresses(): + inet6_dev = net_dev.ip6_ptr.dereference().cast("inet6_dev") + for inet6_ifaddr in inet6_dev.get_addresses(): prefix_len = inet6_ifaddr.get_prefix_len() scope_type = inet6_ifaddr.get_scope_type() ip6_addr = inet6_ifaddr.get_address() - yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type + yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type, operational_state def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] @@ -75,6 +76,7 @@ class Ifconfig(plugins.PluginInterface): ("IP", str), ("Prefix", int), ("Scope Type", str), + ("State", str), ] return renderers.TreeGrid(headers, self._generator()) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 085d91bff..3a088a959 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -4,9 +4,8 @@ import collections.abc import logging -import struct import socket as socket_module -from typing import Generator, Iterable, Iterator, Optional, Tuple, List +from typing import Generator, Iterable, Iterator, Optional, Tuple, List, Dict from volatility3.framework import constants from volatility3.framework.constants.linux import SOCK_TYPES, SOCK_FAMILY @@ -14,8 +13,10 @@ from volatility3.framework.constants.linux import IP_PROTOCOLS, IPV6_PROTOCOLS from volatility3.framework.constants.linux import TCP_STATES, NETLINK_PROTOCOLS from volatility3.framework.constants.linux import ETH_PROTOCOLS, BLUETOOTH_STATES from volatility3.framework.constants.linux import BLUETOOTH_PROTOCOLS, SOCKET_STATES -from volatility3.framework.constants.linux import CAPABILITIES, IFF_PROMISC +from volatility3.framework.constants.linux import CAPABILITIES, NET_DEVICE_FLAGS from volatility3.framework.constants.linux import IFA_HOST, IFA_LINK, IFA_SITE +from volatility3.framework.constants.linux import IF_OPER_STATES +from volatility3.framework.renderers import conversion from volatility3.framework import exceptions, objects, interfaces, symbols from volatility3.framework.layers import linear from volatility3.framework.objects import utility @@ -1236,24 +1237,25 @@ class net(objects.StructType): class net_device(objects.StructType): - @staticmethod - def _format_as_mac_address(hwaddr): - return ":".join([f"{x:02x}" for x in hwaddr[:6]]) + def _format_as_mac_address(self, hwaddr): + return ":".join([f"{x:02x}" for x in hwaddr[: self.addr_len]]) - def get_mac_address(self): + def get_mac_address(self) -> str: """Get the MAC address of this network interface. Returns: str: the MAC address of this network interface. """ if self.has_member("perm_addr"): + null_mac_addr_bytes = b"\x00" * self.addr_len + null_mac_addr = self._format_as_mac_address(null_mac_addr_bytes) mac_addr = self._format_as_mac_address(self.perm_addr) - if mac_addr != "00:00:00:00:00:00": + if mac_addr != null_mac_addr: return mac_addr parent_layer = self._context.layers[self.vol.layer_name] try: - hwaddr = parent_layer.read(self.dev_addr, 6) + hwaddr = parent_layer.read(self.dev_addr, self.addr_len, pad=True) except exceptions.InvalidAddressException: vollog.debug( f"Unable to read network inteface mac address from {self.dev_addr:#x}" @@ -1262,6 +1264,31 @@ class net_device(objects.StructType): return self._format_as_mac_address(hwaddr) + def _get_flag_choices(self) -> Dict: + """Return the net_deivce flags as a list of strings""" + vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + try: + # kernels >= 3.15 + net_device_flags_enum = vmlinux.get_enumeration("net_device_flags") + choices = net_device_flags_enum.choices + except exceptions.SymbolError: + # kernels < 3.15 + choices = NET_DEVICE_FLAGS + + return choices + + def _get_net_device_flag_value(self, name): + """Return the net_deivce flag value based on the flag name""" + return self._get_flag_choices()[name] + + def get_flag_names(self) -> List[str]: + """Return the net_deivce flags as a list of strings + + Returns: + List[str]: A list of flag names + """ + return list(self._get_flag_choices()) + @property def promisc(self): """Return if this network interface is in promiscuous mode. @@ -1269,9 +1296,9 @@ class net_device(objects.StructType): Returns: bool: True if this network interface is in promiscuous mode. Otherwise, False """ - return self.flags & IFF_PROMISC == IFF_PROMISC + return self.flags & self._get_net_device_flag_value("IFF_PROMISC") != 0 - def get_net_namespace_id(self): + def get_net_namespace_id(self) -> int: """Return the network namespace id for this network interface. Returns: @@ -1288,6 +1315,17 @@ class net_device(objects.StructType): return net_ns_id + def get_operational_state(self) -> str: + """Return the netwok device oprational state (RFC 2863) string + + Returns: + str: A string with the operational state + """ + if self.operstate >= len(IF_OPER_STATES): + vollog.warning(f"Invalid net_device operational state '{self.operstate}'") + return "INVALID" + + return IF_OPER_STATES[self.operstate] class in_device(objects.StructType): def get_addresses(self): @@ -1320,7 +1358,7 @@ class inet6_dev(objects.StructType): return symbol_space = self._context.symbol_space - table_name = self.vol.type_name.split(constants.BANG)[0] + table_name = self.get_symbol_table_name() inet6_ifaddr_symname = table_name + constants.BANG + "inet6_ifaddr" if not symbol_space.has_type(inet6_ifaddr_symname) or not symbol_space.get_type( inet6_ifaddr_symname @@ -1351,7 +1389,7 @@ class in_ifaddr(objects.StructType): Returns: str: the IPv4 scope type. """ - table_name = self.vol.type_name.split(constants.BANG)[0] + table_name = self.get_symbol_table_name() rt_scope_enum = self._context.symbol_space.get_enumeration( table_name + constants.BANG + "rt_scope_t" ) @@ -1368,8 +1406,7 @@ class in_ifaddr(objects.StructType): Returns: str: the IPv4 address """ - ipv4_bytes = struct.pack(" Date: Sat, 27 Jan 2024 17:48:09 -0300 Subject: [PATCH 0005/1352] Minor fixes --- volatility3/framework/symbols/linux/extensions/__init__.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 3a088a959..a7dc28bea 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -365,7 +365,7 @@ class maple_tree(objects.StructType): # None. If however you wanted to parse from a node, but ignore some parts of the tree below it then # this could be populated with the addresses of the nodes you wish to ignore. - if seen == None: + if seen is None: seen = set() # protect against unlikely loop @@ -1265,7 +1265,7 @@ class net_device(objects.StructType): return self._format_as_mac_address(hwaddr) def _get_flag_choices(self) -> Dict: - """Return the net_deivce flags as a list of strings""" + """Return the net_device flags as a list of strings""" vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) try: # kernels >= 3.15 @@ -1327,6 +1327,7 @@ class net_device(objects.StructType): return IF_OPER_STATES[self.operstate] + class in_device(objects.StructType): def get_addresses(self): """Yield the IPv4 ifaddr addresses From 620b9b41838119153dd22672d41c573962734438 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 27 Jan 2024 17:52:26 -0300 Subject: [PATCH 0006/1352] Fix: Explicit returns mixed with implicit (fall through) returns --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index a7dc28bea..915d92cd1 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1260,7 +1260,7 @@ class net_device(objects.StructType): vollog.debug( f"Unable to read network inteface mac address from {self.dev_addr:#x}" ) - return + return None return self._format_as_mac_address(hwaddr) From 5a8a0def35d30fef31f90eecca67f32c0953c9bc Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 30 Jan 2024 12:53:09 -0300 Subject: [PATCH 0007/1352] Fix docstring typos --- volatility3/framework/symbols/linux/extensions/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 915d92cd1..ccb626569 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1278,11 +1278,11 @@ class net_device(objects.StructType): return choices def _get_net_device_flag_value(self, name): - """Return the net_deivce flag value based on the flag name""" + """Return the net_device flag value based on the flag name""" return self._get_flag_choices()[name] def get_flag_names(self) -> List[str]: - """Return the net_deivce flags as a list of strings + """Return the net_device flags as a list of strings Returns: List[str]: A list of flag names From c72fa7544db63bbe72bd1dd1576df2d8ed6baa3b Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 30 Jan 2024 12:55:16 -0300 Subject: [PATCH 0008/1352] Convert IF_OPER_STATES to enum --- .../framework/constants/linux/__init__.py | 23 +++++++++++-------- .../symbols/linux/extensions/__init__.py | 10 ++++---- 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 21e0b47f7..b5972ca51 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -5,6 +5,7 @@ Linux-specific values that aren't found in debug symbols """ +from enum import Enum KERNEL_NAME = "__kernel__" @@ -315,13 +316,15 @@ NET_DEVICE_FLAGS = { "IFF_ECHO": 0x40000, } -# RFC 2863 operational status. Kernels >= 2.6.17. See IF_OPER_* in include/uapi/linux/if.h -IF_OPER_STATES = ( - "UNKNOWN", - "NOTPRESENT", - "DOWN", - "LOWERLAYERDOWN", - "TESTING", - "DORMANT", - "UP", -) + +# Kernels >= 2.6.17. See IF_OPER_* in include/uapi/linux/if.h +class IF_OPER_STATES(Enum): + """RFC 2863 - Network interface operational status""" + + UNKNOWN = 0 + NOTPRESENT = 1 + DOWN = 2 + LOWERLAYERDOWN = 3 + TESTING = 4 + DORMANT = 5 + UP = 6 diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index ccb626569..510302cdb 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -16,7 +16,7 @@ from volatility3.framework.constants.linux import BLUETOOTH_PROTOCOLS, SOCKET_ST from volatility3.framework.constants.linux import CAPABILITIES, NET_DEVICE_FLAGS from volatility3.framework.constants.linux import IFA_HOST, IFA_LINK, IFA_SITE from volatility3.framework.constants.linux import IF_OPER_STATES -from volatility3.framework.renderers import conversion +from volatility3.framework.renderers import conversion, UnparsableValue from volatility3.framework import exceptions, objects, interfaces, symbols from volatility3.framework.layers import linear from volatility3.framework.objects import utility @@ -1321,11 +1321,11 @@ class net_device(objects.StructType): Returns: str: A string with the operational state """ - if self.operstate >= len(IF_OPER_STATES): + try: + return IF_OPER_STATES(self.operstate).name + except ValueError: vollog.warning(f"Invalid net_device operational state '{self.operstate}'") - return "INVALID" - - return IF_OPER_STATES[self.operstate] + return UnparsableValue() class in_device(objects.StructType): From 1b153cc5676fe2161162ef208ab3dfa0e4fcb342 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 30 Jan 2024 13:13:19 -0300 Subject: [PATCH 0009/1352] Manage net_device flag default value & error --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 510302cdb..b5f650f6b 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1279,7 +1279,7 @@ class net_device(objects.StructType): def _get_net_device_flag_value(self, name): """Return the net_device flag value based on the flag name""" - return self._get_flag_choices()[name] + return self._get_flag_choices().get(name, UnparsableValue()) def get_flag_names(self) -> List[str]: """Return the net_device flags as a list of strings From 6f1e7c2145ba34643587db4322237731c88b2a5d Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 2 Feb 2024 16:43:58 +1100 Subject: [PATCH 0010/1352] Add test for linux.ip.Addr and linux-sample-1.bin --- test/test_volatility.py | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index aaad615bc..a5d97ce6e 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -6,6 +6,7 @@ # import os +import re import subprocess import sys import shutil @@ -331,6 +332,22 @@ def test_linux_tty_check(image, volatility, python): assert rc == 0 +def test_linux_ip_addr(image, volatility, python): + rc, out, err = runvol_plugin("linux.ip.Addr", image, volatility, python) + out = out.lower() + + assert re.search( + rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+false\s+192.168.201.161\s+24\s+global\s+up", + out, + ) + assert re.search( + rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+false\s+fe80::20c:29ff:fe8f:edca\s+64\s+link\s+up", + out, + ) + assert out.count(b"\n") >= 8 + assert rc == 0 + + # MAC From 260fbd8d241013c866b0dc4ef54b73793ee9f501 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 2 Feb 2024 17:03:14 +1100 Subject: [PATCH 0011/1352] Python os.path module precisely does that by checking the current platform and, based on it, utilizes either the posixpath or ntpath modules --- test/test_volatility.py | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index a5d97ce6e..61e6fe029 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -12,7 +12,6 @@ import sys import shutil import tempfile import hashlib -import ntpath import json # @@ -125,11 +124,7 @@ def test_windows_dumpfiles(image, volatility, python): known_files = json.load(json_file) failed_chksms = 0 - - if sys.platform == "win32": - file_name = ntpath.basename(image) - else: - file_name = os.path.basename(image) + file_name = os.path.basename(image) try: for addr in known_files["windows_dumpfiles"][file_name]: From 7b1c75cc87791218fe13a4b4e10bf8a0773f2198 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 2 Feb 2024 20:57:26 +1100 Subject: [PATCH 0012/1352] Linux: Add the linux.ip.Link plugin by @eve-mem - On top of the @eve-mem, I've added the queue length field to mimic the ip link command. - Furthermore, I've included some functions to export the network device flags exactly as they are presented to userland --- volatility3/framework/plugins/linux/ip.py | 91 ++++++++++++- .../symbols/linux/extensions/__init__.py | 121 +++++++++++++++++- 2 files changed, 208 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 19393a853..a8d7e813e 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -6,7 +6,6 @@ from typing import List from volatility3.framework import interfaces, renderers, constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins -from volatility3.framework.objects import utility class Addr(plugins.PluginInterface): @@ -30,7 +29,7 @@ class Addr(plugins.PluginInterface): mac_addr = net_dev.get_mac_address() promisc = net_dev.promisc operational_state = net_dev.get_operational_state() - iface_name = utility.array_to_string(net_dev.name) + iface_name = net_dev.get_device_name() iface_ifindex = net_dev.ifindex try: net_ns_id = net_dev.get_net_namespace_id() @@ -80,3 +79,91 @@ class Addr(plugins.PluginInterface): ] return renderers.TreeGrid(headers, self._generator()) + + +class Link(plugins.PluginInterface): + """Lists information about network interfaces similar to `ip link show`""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ) + ] + + def _gather_net_dev_link_info(self, net_device): + mac_addr = net_device.get_mac_address() + operational_state = net_device.get_operational_state() + iface_name = net_device.get_device_name() + mtu = net_device.mtu + qdisc_name = net_device.get_qdisc_name() + qlen = net_device.get_queue_length() + + # Format flags to string. Drop IFF_ to match iproute2 'ip link' output. + # Also, note that iproute2 removes IFF_RUNNING, see print_link_flags() + flags_list = [ + flag.replace("IFF_", "") + for flag in net_device.get_flag_names() + if flag != "IFF_RUNNING" + ] + flags_str = ",".join(flags_list) + + yield iface_name, mac_addr, operational_state, mtu, qdisc_name, qlen, flags_str + + @classmethod + def list_net_devices( + cls, + vmlinux: interfaces.context.ModuleInterface, + ) -> (interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface): + """Lists network devices + + Args: + vmlinux (ModuleInterface): The kernel symbols object + + Yields: + tuple: + net: Network namespace + net_device: Network device structure + """ + table_name = vmlinux.symbol_table_name + net_type_symname = table_name + constants.BANG + "net" + net_device_symname = table_name + constants.BANG + "net_device" + + # 'net_namespace_list' exists from kernels >= 2.6.24 + net_namespace_list = vmlinux.object_from_symbol("net_namespace_list") + for net in net_namespace_list.to_list(net_type_symname, "list"): + for net_device in net.dev_base_head.to_list(net_device_symname, "dev_list"): + yield net, net_device + + def _generator(self): + vmlinux = self.context.modules[self.config["kernel"]] + + for net_dev, net_device in self.list_net_devices(vmlinux): + for device_link_info in self._gather_net_dev_link_info(net_device): + try: + net_ns_id = net_dev.get_net_namespace_id() + except AttributeError: + net_ns_id = renderers.NotAvailableValue() + + fields = [net_ns_id, *device_link_info] + yield (0, fields) + + def run(self): + headers = [ + ("NS", int), + ("Interface", str), + ("MAC", str), + ("State", str), + ("MTU", int), + ("Qdisc", str), + ("Qlen", int), + ("Flags", str), + ] + + return renderers.TreeGrid(headers, self._generator()) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index b5f650f6b..a1b8a3e83 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -21,6 +21,7 @@ from volatility3.framework import exceptions, objects, interfaces, symbols from volatility3.framework.layers import linear from volatility3.framework.objects import utility from volatility3.framework.symbols import generic, linux, intermed +from volatility3.framework.symbols.wrappers import Flags from volatility3.framework.symbols.linux.extensions import elf vollog = logging.getLogger(__name__) @@ -1237,6 +1238,14 @@ class net(objects.StructType): class net_device(objects.StructType): + def get_device_name(self) -> str: + """Return the network device name + + Returns: + str: The network device name + """ + return utility.array_to_string(self.name) + def _format_as_mac_address(self, hwaddr): return ":".join([f"{x:02x}" for x in hwaddr[: self.addr_len]]) @@ -1281,13 +1290,105 @@ class net_device(objects.StructType): """Return the net_device flag value based on the flag name""" return self._get_flag_choices().get(name, UnparsableValue()) + def _get_netdev_state_t(self): + vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + try: + # At least from kernels 2.6.30 + return vmlinux.get_enumeration("netdev_state_t") + except exceptions.SymbolError: + raise exceptions.VolatilityException( + "Unsupported kernel or wrong ISF. Cannot find 'netdev_state_t' enumeration" + ) + + def is_running(self) -> bool: + """Test if the network device has been brought up + Based on netif_running() + + Returns: + bool: True if the device is UP + """ + netdev_state_t_enum = self._get_netdev_state_t() + + # It should be safe. netdev_state_t::__LINK_STATE_START has been available since + # at least kernels 2.6.30 + return ( + self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_START"]) != 0 + ) + + def is_carrier_ok(self) -> bool: + """Check if carrier is present on network device + Based on netif_carrier_ok() + + Returns: + bool: True if carrier present + """ + netdev_state_t_enum = self._get_netdev_state_t() + + # It should be safe. netdev_state_t::__LINK_STATE_NOCARRIER has been available + # since at least kernels 2.6.30 + return ( + self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_NOCARRIER"]) + == 0 + ) + + def is_dormant(self) -> bool: + """Check if the network device is dormant + Based on netif_dormant(() + + Returns: + bool: True if the network device is dormant + """ + netdev_state_t_enum = self._get_netdev_state_t() + + # It should be safe. netdev_state_t::__LINK_STATE_DORMANT has been available + # since at least kernels 2.6.30 + return ( + self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_DORMANT"]) != 0 + ) + + def is_operational(self) -> bool: + """Test if the carrier is operational + Based on netif_oper_up() + + Returns: + bool: True if the device is UP + """ + + return self.get_operational_state() in ("UP", "UNKNOWN") + def get_flag_names(self) -> List[str]: - """Return the net_device flags as a list of strings + """Return the net_device flags as a list of strings. + This is the combination of flags exported through kernel APIs to userspace. + Based on dev_get_flags() Returns: List[str]: A list of flag names """ - return list(self._get_flag_choices()) + choices = self._get_flag_choices() + clear_flags = choices.get("IFF_PROMISC", 0) + clear_flags |= choices.get("IFF_ALLMULTI", 0) + clear_flags |= choices.get("IFF_RUNNING", 0) + clear_flags |= choices.get("IFF_LOWER_UP", 0) + clear_flags |= choices.get("IFF_DORMANT", 0) + + clear_gflags = choices.get("IFF_PROMISC", 0) + clear_gflags |= choices.get("IFF_ALLMULTI)", 0) + + flags = (self.flags & ~clear_flags) | (self.gflags & ~clear_gflags) + + if self.is_running(): + if self.is_operational(): + flags |= choices.get("IFF_RUNNING", 0) + if self.is_carrier_ok(): + flags |= choices.get("IFF_LOWER_UP", 0) + if self.is_dormant(): + flags |= choices.get("IFF_DORMANT", 0) + + net_device_flags_enum_flags = Flags(choices) + net_device_flags = net_device_flags_enum_flags(flags) + + # It's preferable to provide a deterministic list of items. i.e. for testing + return sorted(net_device_flags) @property def promisc(self): @@ -1327,6 +1428,22 @@ class net_device(objects.StructType): vollog.warning(f"Invalid net_device operational state '{self.operstate}'") return UnparsableValue() + def get_qdisc_name(self) -> str: + """Return the network device queuing discipline (qdisc) name + + Returns: + str: A string with the queuing discipline (qdisc) name + """ + return utility.array_to_string(self.qdisc.ops.id) + + def get_queue_length(self) -> int: + """Return the netwrok device transmision qeueue length (qlen) + + Returns: + int: the netwrok device transmision qeueue length (qlen) + """ + return self.tx_queue_len + class in_device(objects.StructType): def get_addresses(self): From 8b6bd0f74ea65e4a1394b971c7aaf521dff36d14 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 2 Feb 2024 21:02:05 +1100 Subject: [PATCH 0013/1352] Add linux.ip.Link test using linux-sample-1.bin image --- test/test_volatility.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index 61e6fe029..3185b7d58 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -343,6 +343,21 @@ def test_linux_ip_addr(image, volatility, python): assert rc == 0 +def test_linux_ip_link(image, volatility, python): + rc, out, err = runvol_plugin("linux.ip.Link", image, volatility, python) + + assert re.search( + rb"-\s+lo\s+00:00:00:00:00:00\s+UNKNOWN\s+16436\s+noqueue\s+0\s+LOOPBACK,LOWER_UP,UP", + out, + ) + assert re.search( + rb"-\s+eth0\s+00:0c:29:8f:ed:ca\s+UP\s+1500\s+pfifo_fast\s+1000\s+BROADCAST,LOWER_UP,MULTICAST,UP", + out, + ) + assert out.count(b"\n") >= 6 + assert rc == 0 + + # MAC From 5219e8aaae87e0b39c707765fb9a09717ffe3f2c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 2 Feb 2024 21:03:03 +1100 Subject: [PATCH 0014/1352] Remove lowercase matching from linux.ip.Addr test --- test/test_volatility.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 3185b7d58..348c161da 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -329,14 +329,13 @@ def test_linux_tty_check(image, volatility, python): def test_linux_ip_addr(image, volatility, python): rc, out, err = runvol_plugin("linux.ip.Addr", image, volatility, python) - out = out.lower() assert re.search( - rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+false\s+192.168.201.161\s+24\s+global\s+up", + rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+False\s+192.168.201.161\s+24\s+global\s+UP", out, ) assert re.search( - rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+false\s+fe80::20c:29ff:fe8f:edca\s+64\s+link\s+up", + rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+False\s+fe80::20c:29ff:fe8f:edca\s+64\s+link\s+UP", out, ) assert out.count(b"\n") >= 8 From 828b6882328b214419de325dc90ed29891f9794b Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 2 Feb 2024 21:29:10 +1100 Subject: [PATCH 0015/1352] Fix issue with net namespace id and improve code --- volatility3/framework/plugins/linux/ip.py | 47 +++++++---------------- 1 file changed, 13 insertions(+), 34 deletions(-) diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index a8d7e813e..6b523379b 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -104,6 +104,10 @@ class Link(plugins.PluginInterface): mtu = net_device.mtu qdisc_name = net_device.get_qdisc_name() qlen = net_device.get_queue_length() + try: + net_ns_id = net_device.get_net_namespace_id() + except AttributeError: + net_ns_id = renderers.NotAvailableValue() # Format flags to string. Drop IFF_ to match iproute2 'ip link' output. # Also, note that iproute2 removes IFF_RUNNING, see print_link_flags() @@ -114,45 +118,20 @@ class Link(plugins.PluginInterface): ] flags_str = ",".join(flags_list) - yield iface_name, mac_addr, operational_state, mtu, qdisc_name, qlen, flags_str - - @classmethod - def list_net_devices( - cls, - vmlinux: interfaces.context.ModuleInterface, - ) -> (interfaces.objects.ObjectInterface, interfaces.objects.ObjectInterface): - """Lists network devices - - Args: - vmlinux (ModuleInterface): The kernel symbols object - - Yields: - tuple: - net: Network namespace - net_device: Network device structure - """ - table_name = vmlinux.symbol_table_name - net_type_symname = table_name + constants.BANG + "net" - net_device_symname = table_name + constants.BANG + "net_device" - - # 'net_namespace_list' exists from kernels >= 2.6.24 - net_namespace_list = vmlinux.object_from_symbol("net_namespace_list") - for net in net_namespace_list.to_list(net_type_symname, "list"): - for net_device in net.dev_base_head.to_list(net_device_symname, "dev_list"): - yield net, net_device + yield net_ns_id, iface_name, mac_addr, operational_state, mtu, qdisc_name, qlen, flags_str def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] - for net_dev, net_device in self.list_net_devices(vmlinux): - for device_link_info in self._gather_net_dev_link_info(net_device): - try: - net_ns_id = net_dev.get_net_namespace_id() - except AttributeError: - net_ns_id = renderers.NotAvailableValue() + net_type_symname = vmlinux.symbol_table_name + constants.BANG + "net" + net_device_symname = vmlinux.symbol_table_name + constants.BANG + "net_device" - fields = [net_ns_id, *device_link_info] - yield (0, fields) + # 'net_namespace_list' exists from kernels >= 2.6.24 + net_namespace_list = vmlinux.object_from_symbol("net_namespace_list") + for net_ns in net_namespace_list.to_list(net_type_symname, "list"): + for net_dev in net_ns.dev_base_head.to_list(net_device_symname, "dev_list"): + for fields in self._gather_net_dev_link_info(net_dev): + yield 0, fields def run(self): headers = [ From aae3f5bfef27a9bf4c56408df3a6a38f70186e21 Mon Sep 17 00:00:00 2001 From: Eve Date: Tue, 26 Mar 2024 06:43:22 +0000 Subject: [PATCH 0016/1352] Linux: add first draft of sockscan plugin --- .../framework/plugins/linux/sockscan.py | 318 ++++++++++++++++++ 1 file changed, 318 insertions(+) create mode 100644 volatility3/framework/plugins/linux/sockscan.py diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py new file mode 100644 index 000000000..52b33d9c1 --- /dev/null +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -0,0 +1,318 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +import struct +from typing import Callable, Tuple, List, Dict + +from volatility3.framework import interfaces, exceptions, constants, objects +from volatility3.framework.renderers import TreeGrid, NotAvailableValue, format_hints +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import sockstat +from volatility3.framework import symbols +from volatility3.framework import symbols, constants +from volatility3.framework.layers import scanners + +vollog = logging.getLogger(__name__) + + +class Sockscan(plugins.PluginInterface): + """Scans for network connections found in memory layer.""" + + _required_framework_version = (2, 6, 0) + + @classmethod + def get_requirements(cls): + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="SockHandlers", component=sockstat.SockHandlers, version=(1, 0, 0) + ), + requirements.VersionRequirement( + name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) + ), + ] + + def _generator(self, symbol_table_name: str): + """Scans for sockets. Each row represents a kernel socket. + + Args: + symbol_table_name: The name of the kernel module on which to operate + + Yields: + family: Socket family string (AF_UNIX, AF_INET, etc) + sock_type: Socket type string (STREAM, DGRAM, etc) + protocol: Protocol string (UDP, TCP, etc) + source addr: Source address string + source port: Source port string (not all of them are int) + destination addr: Destination address string + destination port: Destination port (not all of them are int) + state: State strings (LISTEN, CONNECTED, etc) + """ + + # get vmlinux module from context in order to build objects and read symbols + vmlinux = self.context.modules[symbol_table_name] + + # get kernel layer from context so that it's dependencies can be found, and therefore scanned. + # kernel layer will be virtual and built ontop of a physical layer. + kernel_layer = self.context.layers[vmlinux.layer_name] + + # detmine if kernel is 64bit or not. The plugin scans for pointers and these need to formated + # to the correct size so that they can be accurately located in the physical layer. + if symbols.symbol_table_is_64bit(self.context, vmlinux.symbol_table_name): + pack_format = "Q" # 64 bit + else: + pack_format = "I" # 32 bit + + # TODO: Update plugin to support multiple dependencies. e.g. a memory layer and swap file. + # This is a shared problem with psscan and having a generic solution would be useful. + # Find the memory layer to scan, and provide warnings if more than one is located. + if len(kernel_layer.dependencies) > 1: + vollog.warning( + f"Kernel layer depends on multiple layers however only {kernel_layer.dependencies[0]} will be scanned by this plugin." + ) + elif len(kernel_layer.dependencies) == 0: + vollog.error( + f"Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan." + ) + raise exceptions.LayerException( + vmlinux.layer_name, f"Layer {vmlinux.layer_name} has no dependencies" + ) + memory_layer_name = kernel_layer.dependencies[0] + memory_layer = self.context.layers[kernel_layer.dependencies[0]] + + # use the init process to build a sock handler + # TODO: look into options so that sockstat.SockHandlers so that process_sock can + # be used without a task object. + init_task = vmlinux.object_from_symbol(symbol_name="init_task") + sock_handler = sockstat.SockHandlers(vmlinux, init_task) + + # set to track seen sockets so that results are not duplicated between methods + sock_physical_addresses = set() + + # get progress_callback in order to use this in the scanners. + # TODO: perhaps add more detail to progress, showing method in progress and number of hits found + progress_callback = self._progress_callback + + # TODO: update scanning logic so that all needles can be scanned for at the same time + # this would allow the results to be shown as the scanning is happening and would + # make the plugin faster. It would require working out which needle caused the match + # and applying the logic at that point to get to the socket. + + # Method 1 - find sockets by file operations, then follow pointers to sockets + file_ops_symbol_names = ["socket_file_ops", "sockfs_dentry_operations"] + file_ops_needles = [] + for symbol_name in file_ops_symbol_names: + + # TODO: handle cases where symbol is not found + needle_addr = vmlinux.object_from_symbol(symbol_name).vol.offset + # use canonicalize to set the appropriate sign extension for the addr + addr = kernel_layer.canonicalize(needle_addr) + packed_addr = struct.pack(pack_format, addr) + file_ops_needles.append(packed_addr) + vollog.log( + constants.LOGLEVEL_VVVV, + f"Method 1 will scan for {symbol_name} using the bytes: {packed_addr.hex()}", + ) + + # get file struct to find the offset to the f_op pointer + # this is so that the file object can be created at the correct offset, + # the results of the scanner will be for the f_op member within the file + f_op_offset = vmlinux.get_type("file").members["f_op"][0] + + for addr, _ in memory_layer.scan( + self.context, + scanners.MultiStringScanner(file_ops_needles), + progress_callback, + ): + try: + # create file in the memory_layer, the native layer matches the + # kernel so that pointers can be followed + pfile = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "file", + offset=addr - f_op_offset, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, + ) + dentry = pfile.get_dentry() + if not dentry: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(addr)} as unable to locate dentry", + ) + continue + + d_inode = dentry.d_inode + if not d_inode: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(addr)} as unable to locate inode for dentry", + ) + continue + + socket_alloc = linux.LinuxUtilities.container_of( + d_inode, "socket_alloc", "vfs_inode", vmlinux + ) + socket = socket_alloc.socket + if not (socket and socket.sk): + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(addr)} as socket created by LinuxUtilities.container_of is invalid", + ) + continue + + # sucessfully trversed from file to sock, this will exist in the + # kernel layer, and need to be translated to the memory layer. + sock = socket.sk.dereference() + sock_physical_addresses.add(kernel_layer.translate(sock.vol.offset)[0]) + + except exceptions.InvalidAddressException as error: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Unable to follow file at {hex(addr)} to socket due to invalid address: {error}", + ) + + # Method 2 - find sockets by socket destructor directly inside sock objects + socket_destructor_symbol_names = [ + "sock_def_destruct", + "packet_sock_destruct", + "unix_sock_destructor", + "netlink_sock_destruct", + "inet_sock_destruct", + ] + + socket_destructor_needles = [] + for socket_destructor_symbol_name in socket_destructor_symbol_names: + addr = kernel_layer.canonicalize( + vmlinux.get_symbol(socket_destructor_symbol_name).address + + vmlinux.offset + ) + packed_addr = struct.pack(pack_format, addr) + socket_destructor_needles.append(packed_addr) + vollog.log( + constants.LOGLEVEL_VVVV, + f"Method 2 will scan for {socket_destructor_symbol_name} using the bytes: {packed_addr.hex()}", + ) + + # get sock struct to find the offset to the sk_destruct pointer + # this is so that the sock object can be created at the correct offset, + # the results of the scanner will be for the sk_destruct member within the scock + sk_destruct_offset = vmlinux.get_type("sock").members["sk_destruct"][0] + + for addr, _ in memory_layer.scan( + self.context, + scanners.MultiStringScanner(socket_destructor_needles), + progress_callback, + ): + sock_physical_addresses.add(addr - sk_destruct_offset) + + # TODO Method 3 - find sock by sk_error_report symbols + # sk_error_report_symbol_names = ['sock_def_error_report', 'inet_sk_rebuild_header', 'inet_listen'] + # this would be similar to Method 2, but using a different pointer within sock. + + # now that the set of results has been created, process them and display the results + for addr in sorted(sock_physical_addresses): + psock = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "sock", + offset=addr, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, + ) + try: + sock_type = psock.get_type() + + family = psock.get_family() + # remove results with no family + if family == None: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping socket at {hex(addr)} as unable to determin family.", + ) + continue + + # TODO: invesitgate options for more invalid address handling in proccess_sock + # and the later formatting on it's results. + sock_fields = sock_handler.process_sock(psock) + # if no sock_fields we're able to be extracted then skip this result. + if not sock_fields: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping socket at {hex(addr)} as unable to process with SockHandlers.", + ) + continue + + sock, sock_stat, extended = sock_fields + src, src_port, dst, dst_port, state = sock_stat + protocol = sock.get_protocol() + + # format results + src = NotAvailableValue() if src is None else str(src) + src_port = NotAvailableValue() if src_port is None else str(src_port) + dst = NotAvailableValue() if dst is None else str(dst) + dst_port = NotAvailableValue() if dst_port is None else str(dst_port) + state = NotAvailableValue() if state is None else str(state) + protocol = NotAvailableValue() if protocol is None else str(protocol) + # extended attributes is a dict, so this is formated to string show each + # key and value pair, seperated with a comma. + socket_filter_str = ( + ",".join(f"{k}={v}" for k, v in extended.items()) + if extended + else NotAvailableValue() + ) + + # remove empty results + if (src == "0.0.0.0" or isinstance(src, NotAvailableValue)) and ( + dst == "0.0.0.0" or isinstance(src, NotAvailableValue) + ): + if state == "UNCONNECTED": + continue + elif src_port == "0" and dst_port == "0": + continue + + fields = ( + format_hints.Hex(sock.vol.offset), + family, + sock_type, + protocol, + src, + src_port, + dst, + dst_port, + state, + socket_filter_str, + ) + + yield (0, fields) + except exceptions.InvalidAddressException as error: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Unable create results for socket at {hex(addr)} to invalid address: {error}", + ) + + def run(self): + + tree_grid_args = [ + ("Sock Offset", format_hints.Hex), + ("Family", str), + ("Type", str), + ("Proto", str), + ("Source Addr", str), + ("Source Port", str), + ("Destination Addr", str), + ("Destination Port", str), + ("State", str), + ("Filter", str), + ] + + return TreeGrid( + tree_grid_args, + self._generator(self.config["kernel"]), + ) From 67291ce90fcbea2462293082b1f5d246dfca1b24 Mon Sep 17 00:00:00 2001 From: Eve Date: Wed, 27 Mar 2024 09:29:01 +0000 Subject: [PATCH 0017/1352] Linux: update sockscan to scan memory layer only once for needles --- .../framework/plugins/linux/sockscan.py | 388 ++++++++++-------- 1 file changed, 210 insertions(+), 178 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 52b33d9c1..d02757238 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -4,13 +4,12 @@ import logging import struct -from typing import Callable, Tuple, List, Dict +from typing import List, Set -from volatility3.framework import interfaces, exceptions, constants, objects +from volatility3.framework import exceptions, constants from volatility3.framework.renderers import TreeGrid, NotAvailableValue, format_hints from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins -from volatility3.framework.objects import utility from volatility3.framework.symbols import linux from volatility3.plugins.linux import sockstat from volatility3.framework import symbols @@ -41,6 +40,62 @@ class Sockscan(plugins.PluginInterface): ), ] + def _canonicalize_symbol_addrs( + self, symbol_table_name: List[str], symbol_names: str + ) -> Set[bytes]: + """Takes a list of symbol names and converts the address of each to the bytes + as they would appear in memory so that they can be scanned for. + + Symbols that cannot be found are ignored and not included in the results. + + Args: + symbol_table_name: The name of the kernel module on which to operate + symbol_names: A list of symbol names to be looked up + + Returns: + A set of bytes which are the packed addresses. + """ + # get vmlinux module from context in order to build objects and read symbols + vmlinux = self.context.modules[symbol_table_name] + + # get kernel layer from context so that it's dependencies can be found, and therefore scanned. + # kernel layer will be virtual and built ontop of a physical layer. + kernel_layer = self.context.layers[vmlinux.layer_name] + + # detmine if kernel is 64bit or not. The plugin scans for pointers and these need to formated + # to the correct size so that they can be accurately located in the physical layer. + if symbols.symbol_table_is_64bit(self.context, vmlinux.symbol_table_name): + pack_format = "Q" # 64 bit + else: + pack_format = "I" # 32 bit + + packed_needles = set() + for symbol_name in symbol_names: + try: + needle_addr = vmlinux.object_from_symbol(symbol_name).vol.offset + except exceptions.SymbolError: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Unable to find symbol {symbol_name} this will not be scanned for.", + ) + continue + # use canonicalize to set the appropriate sign extension for the addr + addr = kernel_layer.canonicalize(needle_addr) + packed_addr = struct.pack(pack_format, addr) + packed_needles.add(packed_addr) + vollog.log( + constants.LOGLEVEL_VVVV, + f"Will scan for {symbol_name} using the bytes: {packed_addr.hex()}", + ) + + # make a warning if no symbols at all could be resolved. + if len(packed_needles) == 0: + vollog.warning( + f"_canonicalize_symbol_addrs was unable to resolve any symbols, use -vvvv for more information." + ) + + return packed_needles + def _generator(self, symbol_table_name: str): """Scans for sockets. Each row represents a kernel socket. @@ -48,6 +103,7 @@ class Sockscan(plugins.PluginInterface): symbol_table_name: The name of the kernel module on which to operate Yields: + addr: Physical offset family: Socket family string (AF_UNIX, AF_INET, etc) sock_type: Socket type string (STREAM, DGRAM, etc) protocol: Protocol string (UDP, TCP, etc) @@ -65,15 +121,9 @@ class Sockscan(plugins.PluginInterface): # kernel layer will be virtual and built ontop of a physical layer. kernel_layer = self.context.layers[vmlinux.layer_name] - # detmine if kernel is 64bit or not. The plugin scans for pointers and these need to formated - # to the correct size so that they can be accurately located in the physical layer. - if symbols.symbol_table_is_64bit(self.context, vmlinux.symbol_table_name): - pack_format = "Q" # 64 bit - else: - pack_format = "I" # 32 bit - # TODO: Update plugin to support multiple dependencies. e.g. a memory layer and swap file. # This is a shared problem with psscan and having a generic solution would be useful. + # Find the memory layer to scan, and provide warnings if more than one is located. if len(kernel_layer.dependencies) > 1: vollog.warning( @@ -95,91 +145,23 @@ class Sockscan(plugins.PluginInterface): init_task = vmlinux.object_from_symbol(symbol_name="init_task") sock_handler = sockstat.SockHandlers(vmlinux, init_task) - # set to track seen sockets so that results are not duplicated between methods - sock_physical_addresses = set() - # get progress_callback in order to use this in the scanners. # TODO: perhaps add more detail to progress, showing method in progress and number of hits found progress_callback = self._progress_callback - # TODO: update scanning logic so that all needles can be scanned for at the same time - # this would allow the results to be shown as the scanning is happening and would - # make the plugin faster. It would require working out which needle caused the match - # and applying the logic at that point to get to the socket. - # Method 1 - find sockets by file operations, then follow pointers to sockets - file_ops_symbol_names = ["socket_file_ops", "sockfs_dentry_operations"] - file_ops_needles = [] - for symbol_name in file_ops_symbol_names: - - # TODO: handle cases where symbol is not found - needle_addr = vmlinux.object_from_symbol(symbol_name).vol.offset - # use canonicalize to set the appropriate sign extension for the addr - addr = kernel_layer.canonicalize(needle_addr) - packed_addr = struct.pack(pack_format, addr) - file_ops_needles.append(packed_addr) - vollog.log( - constants.LOGLEVEL_VVVV, - f"Method 1 will scan for {symbol_name} using the bytes: {packed_addr.hex()}", - ) - + file_ops_symbol_names = [ + "socket_file_ops", + "sockfs_dentry_operations", + ] + file_ops_needles = self._canonicalize_symbol_addrs( + symbol_table_name, file_ops_symbol_names + ) # get file struct to find the offset to the f_op pointer # this is so that the file object can be created at the correct offset, # the results of the scanner will be for the f_op member within the file f_op_offset = vmlinux.get_type("file").members["f_op"][0] - for addr, _ in memory_layer.scan( - self.context, - scanners.MultiStringScanner(file_ops_needles), - progress_callback, - ): - try: - # create file in the memory_layer, the native layer matches the - # kernel so that pointers can be followed - pfile = self.context.object( - vmlinux.symbol_table_name + constants.BANG + "file", - offset=addr - f_op_offset, - layer_name=memory_layer_name, - native_layer_name=vmlinux.layer_name, - ) - dentry = pfile.get_dentry() - if not dentry: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping file at {hex(addr)} as unable to locate dentry", - ) - continue - - d_inode = dentry.d_inode - if not d_inode: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping file at {hex(addr)} as unable to locate inode for dentry", - ) - continue - - socket_alloc = linux.LinuxUtilities.container_of( - d_inode, "socket_alloc", "vfs_inode", vmlinux - ) - socket = socket_alloc.socket - if not (socket and socket.sk): - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping file at {hex(addr)} as socket created by LinuxUtilities.container_of is invalid", - ) - continue - - # sucessfully trversed from file to sock, this will exist in the - # kernel layer, and need to be translated to the memory layer. - sock = socket.sk.dereference() - sock_physical_addresses.add(kernel_layer.translate(sock.vol.offset)[0]) - - except exceptions.InvalidAddressException as error: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Unable to follow file at {hex(addr)} to socket due to invalid address: {error}", - ) - # Method 2 - find sockets by socket destructor directly inside sock objects socket_destructor_symbol_names = [ "sock_def_destruct", @@ -188,114 +170,164 @@ class Sockscan(plugins.PluginInterface): "netlink_sock_destruct", "inet_sock_destruct", ] - - socket_destructor_needles = [] - for socket_destructor_symbol_name in socket_destructor_symbol_names: - addr = kernel_layer.canonicalize( - vmlinux.get_symbol(socket_destructor_symbol_name).address - + vmlinux.offset - ) - packed_addr = struct.pack(pack_format, addr) - socket_destructor_needles.append(packed_addr) - vollog.log( - constants.LOGLEVEL_VVVV, - f"Method 2 will scan for {socket_destructor_symbol_name} using the bytes: {packed_addr.hex()}", - ) - + socket_destructor_needles = self._canonicalize_symbol_addrs( + symbol_table_name, socket_destructor_symbol_names + ) # get sock struct to find the offset to the sk_destruct pointer # this is so that the sock object can be created at the correct offset, # the results of the scanner will be for the sk_destruct member within the scock sk_destruct_offset = vmlinux.get_type("sock").members["sk_destruct"][0] - for addr, _ in memory_layer.scan( - self.context, - scanners.MultiStringScanner(socket_destructor_needles), - progress_callback, - ): - sock_physical_addresses.add(addr - sk_destruct_offset) - # TODO Method 3 - find sock by sk_error_report symbols # sk_error_report_symbol_names = ['sock_def_error_report', 'inet_sk_rebuild_header', 'inet_listen'] # this would be similar to Method 2, but using a different pointer within sock. - # now that the set of results has been created, process them and display the results - for addr in sorted(sock_physical_addresses): - psock = self.context.object( - vmlinux.symbol_table_name + constants.BANG + "sock", - offset=addr, - layer_name=memory_layer_name, - native_layer_name=vmlinux.layer_name, - ) - try: - sock_type = psock.get_type() + # Using the calculated needles, scan the memory layer and attempt to parse the sockets located. + for needle_addr, match in memory_layer.scan( + self.context, + scanners.MultiStringScanner(socket_destructor_needles | file_ops_needles), + progress_callback, + ): + psock = None + sock_physical_addr = None - family = psock.get_family() - # remove results with no family - if family == None: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping socket at {hex(addr)} as unable to determin family.", - ) - continue - - # TODO: invesitgate options for more invalid address handling in proccess_sock - # and the later formatting on it's results. - sock_fields = sock_handler.process_sock(psock) - # if no sock_fields we're able to be extracted then skip this result. - if not sock_fields: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping socket at {hex(addr)} as unable to process with SockHandlers.", - ) - continue - - sock, sock_stat, extended = sock_fields - src, src_port, dst, dst_port, state = sock_stat - protocol = sock.get_protocol() - - # format results - src = NotAvailableValue() if src is None else str(src) - src_port = NotAvailableValue() if src_port is None else str(src_port) - dst = NotAvailableValue() if dst is None else str(dst) - dst_port = NotAvailableValue() if dst_port is None else str(dst_port) - state = NotAvailableValue() if state is None else str(state) - protocol = NotAvailableValue() if protocol is None else str(protocol) - # extended attributes is a dict, so this is formated to string show each - # key and value pair, seperated with a comma. - socket_filter_str = ( - ",".join(f"{k}={v}" for k, v in extended.items()) - if extended - else NotAvailableValue() + # if match is from socket_destructor_needles simply calculate the offset + # to the sock + if match in socket_destructor_needles: + sock_physical_addr = needle_addr - sk_destruct_offset + psock = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "sock", + offset=sock_physical_addr, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, ) - # remove empty results - if (src == "0.0.0.0" or isinstance(src, NotAvailableValue)) and ( - dst == "0.0.0.0" or isinstance(src, NotAvailableValue) - ): - if state == "UNCONNECTED": - continue - elif src_port == "0" and dst_port == "0": + # if match is from file_ops_needles attempt to walk from file object to + # the sock + if match in file_ops_needles: + try: + # create file in the memory_layer, the native layer matches the + # kernel so that pointers can be followed + sock_physical_addr = needle_addr - f_op_offset + pfile = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "file", + offset=sock_physical_addr, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, + ) + dentry = pfile.get_dentry() + if not dentry: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(needle_addr)} as unable to locate dentry", + ) continue - fields = ( - format_hints.Hex(sock.vol.offset), - family, - sock_type, - protocol, - src, - src_port, - dst, - dst_port, - state, - socket_filter_str, - ) + d_inode = dentry.d_inode + if not d_inode: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(needle_addr)} as unable to locate inode for dentry", + ) + continue - yield (0, fields) - except exceptions.InvalidAddressException as error: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Unable create results for socket at {hex(addr)} to invalid address: {error}", - ) + socket_alloc = linux.LinuxUtilities.container_of( + d_inode, "socket_alloc", "vfs_inode", vmlinux + ) + socket = socket_alloc.socket + if not (socket and socket.sk): + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(needle_addr)} as socket created by LinuxUtilities.container_of is invalid", + ) + continue + + # sucessfully trversed from file to sock, this will exist in the + # kernel layer, and need to be translated to the memory layer. + psock = socket.sk.dereference() + except exceptions.InvalidAddressException as error: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Unable to follow file at {hex(needle_addr)} to socket due to invalid address: {error}", + ) + + if psock is not None: + try: + sock_type = psock.get_type() + + family = psock.get_family() + # remove results with no family + if family == None: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping socket at {hex(sock_physical_addr)} as unable to determin family.", + ) + continue + + # TODO: invesitgate options for more invalid address handling in proccess_sock + # and the later formatting of it's results. + sock_fields = sock_handler.process_sock(psock) + # if no sock_fields we're able to be extracted then skip this result. + if not sock_fields: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping socket at {hex(sock_physical_addr)} as unable to process with SockHandlers.", + ) + continue + + sock, sock_stat, extended = sock_fields + src, src_port, dst, dst_port, state = sock_stat + protocol = sock.get_protocol() + + # format results + src = NotAvailableValue() if src is None else str(src) + src_port = ( + NotAvailableValue() if src_port is None else str(src_port) + ) + dst = NotAvailableValue() if dst is None else str(dst) + dst_port = ( + NotAvailableValue() if dst_port is None else str(dst_port) + ) + state = NotAvailableValue() if state is None else str(state) + protocol = ( + NotAvailableValue() if protocol is None else str(protocol) + ) + # extended attributes is a dict, so this is formated to string show each + # key and value pair, seperated with a comma. + socket_filter_str = ( + ",".join(f"{k}={v}" for k, v in extended.items()) + if extended + else NotAvailableValue() + ) + + # remove empty results + if (src == "0.0.0.0" or isinstance(src, NotAvailableValue)) and ( + dst == "0.0.0.0" or isinstance(src, NotAvailableValue) + ): + if state == "UNCONNECTED": + continue + elif src_port == "0" and dst_port == "0": + continue + + fields = ( + format_hints.Hex(sock_physical_addr), + family, + sock_type, + protocol, + src, + src_port, + dst, + dst_port, + state, + socket_filter_str, + ) + + yield (0, fields) + except exceptions.InvalidAddressException as error: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Unable create results for socket at {hex(sock_physical_addr)} due to invalid address: {error}", + ) def run(self): From 4f1f48087611818f874a033db4257b162e468c3f Mon Sep 17 00:00:00 2001 From: Eve Date: Wed, 27 Mar 2024 09:32:49 +0000 Subject: [PATCH 0018/1352] Linux: add test for sockscan plugin --- test/test_volatility.py | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 6e54aa053..0f935546d 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -196,7 +196,7 @@ def test_windows_thrdscan(image, volatility, python): assert out.find(b"\t4\t8") != -1 assert out.find(b"\t4\t12") != -1 assert out.find(b"\t4\t16") != -1 - #assert out.find(b"this raieses AssertionError") != -1 + # assert out.find(b"this raieses AssertionError") != -1 assert rc == 0 @@ -368,6 +368,27 @@ def test_linux_library_list(image, volatility, python): assert rc == 0 +def test_linux_sockscan(image, volatility, python): + # designed for linux-sample-1.dmp SHA1:1C3A4627EDCA94A7ADE3414592BEF0E62D7D3BB6 + rc, out, err = runvol_plugin("linux.sockscan.Sockscan", image, volatility, python) + + assert re.search( + rb"AF_UNIX\s+STREAM\s+-\s+/tmp/pulse-JldaJj8OxQLa/native\s+14054\s+-\s+14053\s+ESTABLISHED\s+-", + out, + ) + assert re.search( + rb"AF_INET\s+STREAM\s+TCP\s+192.168.201.161\s+22\s+192.168.201.1\s+59982\s+ESTABLISHED\s+-", + out, + ) + assert re.search( + rb"AF_INET\s+STREAM\s+TCP\s+0.0.0.0\s+901\s+0.0.0.0\s+0\s+LISTEN\s+-", + out, + ) + + assert out.count(b"\n") >= 50 + assert rc == 0 + + # MAC From 2c8b757ef02bcf6052705a32da6559789aff4201 Mon Sep 17 00:00:00 2001 From: Eve Date: Thu, 28 Mar 2024 08:55:07 +0000 Subject: [PATCH 0019/1352] Linux: update sockscan family check to use 'is None' rather than '== None' as per CodeQL --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index d02757238..89f35e6bb 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -257,7 +257,7 @@ class Sockscan(plugins.PluginInterface): family = psock.get_family() # remove results with no family - if family == None: + if family is None: vollog.log( constants.LOGLEVEL_VVVV, f"Skipping socket at {hex(sock_physical_addr)} as unable to determin family.", From f3f5650a1d4c5456a8aaa61c58d724bbabf47e97 Mon Sep 17 00:00:00 2001 From: Eve Date: Thu, 28 Mar 2024 09:03:39 +0000 Subject: [PATCH 0020/1352] Linux: update sockscan with checks to reduce possible duplication of results --- volatility3/framework/plugins/linux/sockscan.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 89f35e6bb..d3413dea0 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -182,6 +182,9 @@ class Sockscan(plugins.PluginInterface): # sk_error_report_symbol_names = ['sock_def_error_report', 'inet_sk_rebuild_header', 'inet_listen'] # this would be similar to Method 2, but using a different pointer within sock. + # add a set of seen addresses to stop possible duplication of results. + seen_sock_physical_addr = set() + # Using the calculated needles, scan the memory layer and attempt to parse the sockets located. for needle_addr, match in memory_layer.scan( self.context, @@ -251,7 +254,8 @@ class Sockscan(plugins.PluginInterface): f"Unable to follow file at {hex(needle_addr)} to socket due to invalid address: {error}", ) - if psock is not None: + if psock is not None and sock_physical_addr not in seen_sock_physical_addr: + seen_sock_physical_addr.add(sock_physical_addr) try: sock_type = psock.get_type() From fb67d630835e2f7f78b055193de4cfd8696f8f23 Mon Sep 17 00:00:00 2001 From: Eve Date: Thu, 28 Mar 2024 09:21:54 +0000 Subject: [PATCH 0021/1352] Linux: update tests for sockscan to be more generic --- test/test_volatility.py | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 0f935546d..3d88eeab1 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -372,17 +372,26 @@ def test_linux_sockscan(image, volatility, python): # designed for linux-sample-1.dmp SHA1:1C3A4627EDCA94A7ADE3414592BEF0E62D7D3BB6 rc, out, err = runvol_plugin("linux.sockscan.Sockscan", image, volatility, python) - assert re.search( - rb"AF_UNIX\s+STREAM\s+-\s+/tmp/pulse-JldaJj8OxQLa/native\s+14054\s+-\s+14053\s+ESTABLISHED\s+-", - out, + # ensure that multiple unix paths for sockets have been found + assert ( + len( + re.findall( + rb"(/[ -~]+?){1,8}", + out, + ) + ) + >= 10 ) - assert re.search( - rb"AF_INET\s+STREAM\s+TCP\s+192.168.201.161\s+22\s+192.168.201.1\s+59982\s+ESTABLISHED\s+-", - out, - ) - assert re.search( - rb"AF_INET\s+STREAM\s+TCP\s+0.0.0.0\s+901\s+0.0.0.0\s+0\s+LISTEN\s+-", - out, + + # ensure that multiple IPv4 addresses have been found + assert ( + len( + re.findall( + rb"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}", + out, + ) + ) + >= 10 ) assert out.count(b"\n") >= 50 From 3fa63061ddd2bba4a80c843bbb2a2095a7c1e67c Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 3 Apr 2024 20:29:24 +0100 Subject: [PATCH 0022/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: Donghyun Kim --- volatility3/framework/plugins/linux/sockscan.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index d3413dea0..dc657c65b 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -12,7 +12,6 @@ from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.symbols import linux from volatility3.plugins.linux import sockstat -from volatility3.framework import symbols from volatility3.framework import symbols, constants from volatility3.framework.layers import scanners From e4ea19debfeb61d0e441309dcb4edabb22c2dd46 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 2 Aug 2024 11:41:52 +0100 Subject: [PATCH 0023/1352] Linux: sockscan update based on comments from @gcmoreira, add version, make use of relative_child_offset, fix f string. --- volatility3/framework/plugins/linux/sockscan.py | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index dc657c65b..cab4b9718 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -22,7 +22,8 @@ class Sockscan(plugins.PluginInterface): """Scans for network connections found in memory layer.""" _required_framework_version = (2, 6, 0) - + _version = (1, 0, 0) + @classmethod def get_requirements(cls): return [ @@ -35,12 +36,12 @@ class Sockscan(plugins.PluginInterface): name="SockHandlers", component=sockstat.SockHandlers, version=(1, 0, 0) ), requirements.VersionRequirement( - name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) + name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) ), ] def _canonicalize_symbol_addrs( - self, symbol_table_name: List[str], symbol_names: str + self, symbol_table_name: str, symbol_names: List[str] ) -> Set[bytes]: """Takes a list of symbol names and converts the address of each to the bytes as they would appear in memory so that they can be scanned for. @@ -88,9 +89,9 @@ class Sockscan(plugins.PluginInterface): ) # make a warning if no symbols at all could be resolved. - if len(packed_needles) == 0: + if not packed_needles: vollog.warning( - f"_canonicalize_symbol_addrs was unable to resolve any symbols, use -vvvv for more information." + "_canonicalize_symbol_addrs was unable to resolve any symbols, use -vvvv for more information." ) return packed_needles @@ -159,7 +160,7 @@ class Sockscan(plugins.PluginInterface): # get file struct to find the offset to the f_op pointer # this is so that the file object can be created at the correct offset, # the results of the scanner will be for the f_op member within the file - f_op_offset = vmlinux.get_type("file").members["f_op"][0] + f_op_offset = vmlinux.get_type("file").relative_child_offset("f_op") # Method 2 - find sockets by socket destructor directly inside sock objects socket_destructor_symbol_names = [ @@ -175,7 +176,7 @@ class Sockscan(plugins.PluginInterface): # get sock struct to find the offset to the sk_destruct pointer # this is so that the sock object can be created at the correct offset, # the results of the scanner will be for the sk_destruct member within the scock - sk_destruct_offset = vmlinux.get_type("sock").members["sk_destruct"][0] + sk_destruct_offset = vmlinux.get_type("sock").relative_child_offset("sk_destruct") # TODO Method 3 - find sock by sk_error_report symbols # sk_error_report_symbol_names = ['sock_def_error_report', 'inet_sk_rebuild_header', 'inet_listen'] From a3393a971155a0ef095509fdb758f6e2b37994b7 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 2 Aug 2024 11:46:04 +0100 Subject: [PATCH 0024/1352] Linux: fix black formatting issues --- volatility3/framework/plugins/linux/sockscan.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index cab4b9718..35e8237df 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -23,7 +23,7 @@ class Sockscan(plugins.PluginInterface): _required_framework_version = (2, 6, 0) _version = (1, 0, 0) - + @classmethod def get_requirements(cls): return [ @@ -176,7 +176,9 @@ class Sockscan(plugins.PluginInterface): # get sock struct to find the offset to the sk_destruct pointer # this is so that the sock object can be created at the correct offset, # the results of the scanner will be for the sk_destruct member within the scock - sk_destruct_offset = vmlinux.get_type("sock").relative_child_offset("sk_destruct") + sk_destruct_offset = vmlinux.get_type("sock").relative_child_offset( + "sk_destruct" + ) # TODO Method 3 - find sock by sk_error_report symbols # sk_error_report_symbol_names = ['sock_def_error_report', 'inet_sk_rebuild_header', 'inet_listen'] From 3c377320e5b2ddfe6f9e6c9101790af88faa0ade Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 2 Aug 2024 15:41:04 +0100 Subject: [PATCH 0025/1352] Linux: Begin to breakdown the functions in sockscan plugin --- .../framework/plugins/linux/sockscan.py | 338 ++++++++++-------- 1 file changed, 191 insertions(+), 147 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 35e8237df..57b4daf31 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -96,22 +96,15 @@ class Sockscan(plugins.PluginInterface): return packed_needles - def _generator(self, symbol_table_name: str): - """Scans for sockets. Each row represents a kernel socket. + def _find_memory_layer_name(self, symbol_table_name: str): + """Find the memory layer below the kernel. Only returns a single layer, + and will warn the user if multiple layers are found. Args: - symbol_table_name: The name of the kernel module on which to operate + symbol_table_name: The name of the kernel module on which to operate. - Yields: - addr: Physical offset - family: Socket family string (AF_UNIX, AF_INET, etc) - sock_type: Socket type string (STREAM, DGRAM, etc) - protocol: Protocol string (UDP, TCP, etc) - source addr: Source address string - source port: Source port string (not all of them are int) - destination addr: Destination address string - destination port: Destination port (not all of them are int) - state: State strings (LISTEN, CONNECTED, etc) + Returns: + memory_layer_name: The name of the layer below the kernel to be scanned. """ # get vmlinux module from context in order to build objects and read symbols @@ -136,20 +129,15 @@ class Sockscan(plugins.PluginInterface): raise exceptions.LayerException( vmlinux.layer_name, f"Layer {vmlinux.layer_name} has no dependencies" ) + memory_layer_name = kernel_layer.dependencies[0] - memory_layer = self.context.layers[kernel_layer.dependencies[0]] - # use the init process to build a sock handler - # TODO: look into options so that sockstat.SockHandlers so that process_sock can - # be used without a task object. - init_task = vmlinux.object_from_symbol(symbol_name="init_task") - sock_handler = sockstat.SockHandlers(vmlinux, init_task) + return memory_layer_name - # get progress_callback in order to use this in the scanners. - # TODO: perhaps add more detail to progress, showing method in progress and number of hits found - progress_callback = self._progress_callback + def _find_file_ops_needles(self, symbol_table_name: str): + # get vmlinux module from context in order to read symbols + vmlinux = self.context.modules[symbol_table_name] - # Method 1 - find sockets by file operations, then follow pointers to sockets file_ops_symbol_names = [ "socket_file_ops", "sockfs_dentry_operations", @@ -162,7 +150,12 @@ class Sockscan(plugins.PluginInterface): # the results of the scanner will be for the f_op member within the file f_op_offset = vmlinux.get_type("file").relative_child_offset("f_op") - # Method 2 - find sockets by socket destructor directly inside sock objects + return (file_ops_needles, f_op_offset) + + def _find_sk_destruct_needles(self, symbol_table_name: str): + # get vmlinux module from context in order to read symbols + vmlinux = self.context.modules[symbol_table_name] + socket_destructor_symbol_names = [ "sock_def_destruct", "packet_sock_destruct", @@ -179,6 +172,173 @@ class Sockscan(plugins.PluginInterface): sk_destruct_offset = vmlinux.get_type("sock").relative_child_offset( "sk_destruct" ) + return (socket_destructor_needles, sk_destruct_offset) + + def _walk_file_ops_needles( + self, symbol_table_name, memory_layer_name, needle_addr, f_op_offset + ): + vmlinux = self.context.modules[symbol_table_name] + try: + # create file in the memory_layer, the native layer matches the + # kernel so that pointers can be followed + sock_physical_addr = needle_addr - f_op_offset + pfile = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "file", + offset=sock_physical_addr, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, + ) + dentry = pfile.get_dentry() + if not dentry: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(needle_addr)} as unable to locate dentry", + ) + return None + + d_inode = dentry.d_inode + if not d_inode: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(needle_addr)} as unable to locate inode for dentry", + ) + return None + + socket_alloc = linux.LinuxUtilities.container_of( + d_inode, "socket_alloc", "vfs_inode", vmlinux + ) + socket = socket_alloc.socket + if not (socket and socket.sk): + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping file at {hex(needle_addr)} as socket created by LinuxUtilities.container_of is invalid", + ) + return None + + # sucessfully trversed from file to sock, this will exist in the + # kernel layer, and need to be translated to the memory layer. + psock = socket.sk.dereference() + return psock + + except exceptions.InvalidAddressException as error: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Unable to follow file at {hex(needle_addr)} to socket due to invalid address: {error}", + ) + + def _extract_sock_fields(self, psock, sock_handler): + try: + sock_physical_addr = psock.vol.offset + sock_type = psock.get_type() + + family = psock.get_family() + # remove results with no family + if family is None: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping socket at {hex(sock_physical_addr)} as unable to determin family.", + ) + return None + + # TODO: invesitgate options for more invalid address handling in proccess_sock + # and the later formatting of it's results. + sock_fields = sock_handler.process_sock(psock) + # if no sock_fields we're able to be extracted then skip this result. + if not sock_fields: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping socket at {hex(sock_physical_addr)} as unable to process with SockHandlers.", + ) + return None + + sock, sock_stat, extended = sock_fields + src, src_port, dst, dst_port, state = sock_stat + protocol = sock.get_protocol() + + # format results + src = NotAvailableValue() if src is None else str(src) + src_port = NotAvailableValue() if src_port is None else str(src_port) + dst = NotAvailableValue() if dst is None else str(dst) + dst_port = NotAvailableValue() if dst_port is None else str(dst_port) + state = NotAvailableValue() if state is None else str(state) + protocol = NotAvailableValue() if protocol is None else str(protocol) + # extended attributes is a dict, so this is formated to string show each + # key and value pair, seperated with a comma. + socket_filter_str = ( + ",".join(f"{k}={v}" for k, v in extended.items()) + if extended + else NotAvailableValue() + ) + + # remove empty results + if (src == "0.0.0.0" or isinstance(src, NotAvailableValue)) and ( + dst == "0.0.0.0" or isinstance(src, NotAvailableValue) + ): + if state == "UNCONNECTED": + return None + elif src_port == "0" and dst_port == "0": + return None + return ( + format_hints.Hex(sock_physical_addr), + family, + sock_type, + protocol, + src, + src_port, + dst, + dst_port, + state, + socket_filter_str, + ) + + except exceptions.InvalidAddressException as error: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Unable create results for socket at {hex(sock_physical_addr)} due to invalid address: {error}", + ) + + def _generator(self, symbol_table_name: str): + """Scans for sockets. Each row represents a kernel socket. + + Args: + symbol_table_name: The name of the kernel module on which to operate + + Yields: + addr: Physical offset + family: Socket family string (AF_UNIX, AF_INET, etc) + sock_type: Socket type string (STREAM, DGRAM, etc) + protocol: Protocol string (UDP, TCP, etc) + source addr: Source address string + source port: Source port string (not all of them are int) + destination addr: Destination address string + destination port: Destination port (not all of them are int) + state: State strings (LISTEN, CONNECTED, etc) + """ + + # get vmlinux module from context in order to build objects and read symbols + vmlinux = self.context.modules[symbol_table_name] + + # get the memory layer that is to be scanned. + memory_layer_name = self._find_memory_layer_name(symbol_table_name) + memory_layer = self.context.layers[memory_layer_name] + + # use the init process to build a sock handler + # TODO: look into options so that sockstat.SockHandlers so that process_sock can + # be used without a task object. + init_task = vmlinux.object_from_symbol(symbol_name="init_task") + sock_handler = sockstat.SockHandlers(vmlinux, init_task) + + # get progress_callback in order to use this in the scanners. + # TODO: perhaps add more detail to progress, showing method in progress and number of hits found + progress_callback = self._progress_callback + + # Method 1 - find sockets by file operations, then follow pointers to sockets + file_ops_needles, f_op_offset = self._find_file_ops_needles(symbol_table_name) + + # Method 2 - find sockets by socket destructor directly inside sock objects + socket_destructor_needles, sk_destruct_offset = self._find_sk_destruct_needles( + symbol_table_name + ) # TODO Method 3 - find sock by sk_error_report symbols # sk_error_report_symbol_names = ['sock_def_error_report', 'inet_sk_rebuild_header', 'inet_listen'] @@ -196,8 +356,7 @@ class Sockscan(plugins.PluginInterface): psock = None sock_physical_addr = None - # if match is from socket_destructor_needles simply calculate the offset - # to the sock + # if match is from socket_destructor_needles simply calculate the offset to the sock if match in socket_destructor_needles: sock_physical_addr = needle_addr - sk_destruct_offset psock = self.context.object( @@ -207,133 +366,18 @@ class Sockscan(plugins.PluginInterface): native_layer_name=vmlinux.layer_name, ) - # if match is from file_ops_needles attempt to walk from file object to - # the sock + # if match is from file_ops_needles attempt to walk from file object to the sock if match in file_ops_needles: - try: - # create file in the memory_layer, the native layer matches the - # kernel so that pointers can be followed - sock_physical_addr = needle_addr - f_op_offset - pfile = self.context.object( - vmlinux.symbol_table_name + constants.BANG + "file", - offset=sock_physical_addr, - layer_name=memory_layer_name, - native_layer_name=vmlinux.layer_name, - ) - dentry = pfile.get_dentry() - if not dentry: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping file at {hex(needle_addr)} as unable to locate dentry", - ) - continue - - d_inode = dentry.d_inode - if not d_inode: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping file at {hex(needle_addr)} as unable to locate inode for dentry", - ) - continue - - socket_alloc = linux.LinuxUtilities.container_of( - d_inode, "socket_alloc", "vfs_inode", vmlinux - ) - socket = socket_alloc.socket - if not (socket and socket.sk): - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping file at {hex(needle_addr)} as socket created by LinuxUtilities.container_of is invalid", - ) - continue - - # sucessfully trversed from file to sock, this will exist in the - # kernel layer, and need to be translated to the memory layer. - psock = socket.sk.dereference() - except exceptions.InvalidAddressException as error: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Unable to follow file at {hex(needle_addr)} to socket due to invalid address: {error}", - ) + psock = self._walk_file_ops_needles( + symbol_table_name, memory_layer_name, needle_addr, f_op_offset + ) if psock is not None and sock_physical_addr not in seen_sock_physical_addr: seen_sock_physical_addr.add(sock_physical_addr) - try: - sock_type = psock.get_type() - - family = psock.get_family() - # remove results with no family - if family is None: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping socket at {hex(sock_physical_addr)} as unable to determin family.", - ) - continue - - # TODO: invesitgate options for more invalid address handling in proccess_sock - # and the later formatting of it's results. - sock_fields = sock_handler.process_sock(psock) - # if no sock_fields we're able to be extracted then skip this result. - if not sock_fields: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping socket at {hex(sock_physical_addr)} as unable to process with SockHandlers.", - ) - continue - - sock, sock_stat, extended = sock_fields - src, src_port, dst, dst_port, state = sock_stat - protocol = sock.get_protocol() - - # format results - src = NotAvailableValue() if src is None else str(src) - src_port = ( - NotAvailableValue() if src_port is None else str(src_port) - ) - dst = NotAvailableValue() if dst is None else str(dst) - dst_port = ( - NotAvailableValue() if dst_port is None else str(dst_port) - ) - state = NotAvailableValue() if state is None else str(state) - protocol = ( - NotAvailableValue() if protocol is None else str(protocol) - ) - # extended attributes is a dict, so this is formated to string show each - # key and value pair, seperated with a comma. - socket_filter_str = ( - ",".join(f"{k}={v}" for k, v in extended.items()) - if extended - else NotAvailableValue() - ) - - # remove empty results - if (src == "0.0.0.0" or isinstance(src, NotAvailableValue)) and ( - dst == "0.0.0.0" or isinstance(src, NotAvailableValue) - ): - if state == "UNCONNECTED": - continue - elif src_port == "0" and dst_port == "0": - continue - - fields = ( - format_hints.Hex(sock_physical_addr), - family, - sock_type, - protocol, - src, - src_port, - dst, - dst_port, - state, - socket_filter_str, - ) + fields = self._extract_sock_fields(psock, sock_handler) + if fields: yield (0, fields) - except exceptions.InvalidAddressException as error: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Unable create results for socket at {hex(sock_physical_addr)} due to invalid address: {error}", - ) def run(self): From 100c23ba4bc132e25c1c70f6f48fc80cd547e29d Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 8 Oct 2024 18:37:32 +1100 Subject: [PATCH 0026/1352] fix black stable version issue with Python 3.8 --- .github/workflows/black.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml index 5adab3259..e29ab6f29 100644 --- a/.github/workflows/black.yml +++ b/.github/workflows/black.yml @@ -11,3 +11,5 @@ jobs: with: options: "--check --diff --verbose" src: "./volatility3" + # FIXME: Remove when Volatility3 minimum Python version is >3.8 + version: "24.8.0" From 2920694643d6951a980fe32df0e3afe295e5d418 Mon Sep 17 00:00:00 2001 From: atcuno Date: Wed, 19 Jun 2024 17:58:49 -0500 Subject: [PATCH 0027/1352] placeholder --- .../framework/plugins/windows/mftscan.py | 367 +++++++++--------- 1 file changed, 187 insertions(+), 180 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 9e6585345..0687c7796 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -20,6 +20,10 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self._record_map = {} + @classmethod def get_requirements(cls): return [ @@ -33,8 +37,10 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ), ] - def _generator(self): - layer = self.context.layers[self.config["primary"]] + def enumerate_mft_records(self, attr_callback): + phys_layer = self.context.layers[self.config["primary"]].config["memory_layer"] + + layer = self.context.layers[phys_layer] # Yara Rule to scan for MFT Header Signatures rules = yarascan.YaraScan.process_yara_options( @@ -47,87 +53,36 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): config_path=self.config_path, sub_path="windows", filename="mft", - class_types={"FILE_NAME_ENTRY": mft.MFTFileName, "MFT_ENTRY": mft.MFTEntry}, + class_types={"FILE_NAME_ENTRY": mft.MFTFileName, "MFT_ENTRY": mft.MFTEntry, "ATTRIBUTE": mft.MFTAttribute}, ) # get each of the individual Field Sets - mft_object = symbol_table + constants.BANG + "MFT_ENTRY" - attribute_object = symbol_table + constants.BANG + "ATTRIBUTE" - si_object = symbol_table + constants.BANG + "STANDARD_INFORMATION_ENTRY" - fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" + self.mft_object = symbol_table + constants.BANG + "MFT_ENTRY" + self.attribute_object = symbol_table + constants.BANG + "ATTRIBUTE" + self.si_object = symbol_table + constants.BANG + "STANDARD_INFORMATION_ENTRY" + self.fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" # Scan the layer for Raw MFT records and parse the fields - for offset, _rule_name, _name, _value in layer.scan( + for offset, _, _, _ in layer.scan( context=self.context, scanner=yarascan.YaraScanner(rules=rules) ): - with contextlib.suppress(exceptions.PagedInvalidAddressException): + with contextlib.suppress(exceptions.InvalidAddressException): mft_record = self.context.object( - mft_object, offset=offset, layer_name=layer.name + self.mft_object, offset=offset, layer_name=layer.name ) # We will update this on each pass in the next loop and use it as the new offset. attr_base_offset = mft_record.FirstAttrOffset attr = self.context.object( - attribute_object, + self.attribute_object, offset=offset + attr_base_offset, layer_name=layer.name, ) # There is no field that has a count of Attributes # Keep Attempting to read attributes until we get an invalid attr_header.AttrType - while attr.Attr_Header.AttrType.is_valid_choice: - vollog.debug(f"Attr Type: {attr.Attr_Header.AttrType.lookup()}") - - # MFT Flags determine the file type or dir - # If we don't have a valid enum, coerce to hex so we can keep the record - try: - mft_flag = mft_record.Flags.lookup() - except ValueError: - mft_flag = hex(mft_record.Flags) - - # Standard Information Attribute - if attr.Attr_Header.AttrType.lookup() == "STANDARD_INFORMATION": - attr_data = attr.Attr_Data.cast(si_object) - yield 0, ( - format_hints.Hex(attr_data.vol.offset), - mft_record.get_signature(), - mft_record.RecordNumber, - mft_record.LinkCount, - mft_flag, - renderers.NotApplicableValue(), - attr.Attr_Header.AttrType.lookup(), - conversion.wintime_to_datetime(attr_data.CreationTime), - conversion.wintime_to_datetime(attr_data.ModifiedTime), - conversion.wintime_to_datetime(attr_data.UpdatedTime), - conversion.wintime_to_datetime(attr_data.AccessedTime), - renderers.NotApplicableValue(), - ) - - # File Name Attribute - if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - attr_data = attr.Attr_Data.cast(fn_object) - file_name = attr_data.get_full_name() - - # If we don't have a valid enum, coerce to hex so we can keep the record - try: - permissions = attr_data.Flags.lookup() - except ValueError: - permissions = hex(attr_data.Flags) - - yield 1, ( - format_hints.Hex(attr_data.vol.offset), - mft_record.get_signature(), - mft_record.RecordNumber, - mft_record.LinkCount, - mft_flag, - permissions, - attr.Attr_Header.AttrType.lookup(), - conversion.wintime_to_datetime(attr_data.CreationTime), - conversion.wintime_to_datetime(attr_data.ModifiedTime), - conversion.wintime_to_datetime(attr_data.UpdatedTime), - conversion.wintime_to_datetime(attr_data.AccessedTime), - file_name, - ) + for record in attr_callback(mft_record, attr): + yield record # If there's no advancement the loop will never end, so break it now if attr.Attr_Header.Length == 0: @@ -135,12 +90,69 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Update the base offset to point to the next attribute attr_base_offset += attr.Attr_Header.Length + # Get the next attribute attr = self.context.object( - attribute_object, + self.attribute_object, offset=offset + attr_base_offset, layer_name=layer.name, ) + def parse_mft_records(self, mft_record, attr): + # MFT Flags determine the file type or dir + # If we don't have a valid enum, coerce to hex so we can keep the record + try: + mft_flag = mft_record.Flags.lookup() + except ValueError: + mft_flag = hex(mft_record.Flags) + + # Standard Information Attribute + if attr.Attr_Header.AttrType.lookup() == "STANDARD_INFORMATION": + attr_data = attr.Attr_Data.cast(self.si_object) + yield 0, ( + format_hints.Hex(attr_data.vol.offset), + mft_record.get_signature(), + mft_record.RecordNumber, + mft_record.LinkCount, + mft_flag, + renderers.NotApplicableValue(), + attr.Attr_Header.AttrType.lookup(), + conversion.wintime_to_datetime(attr_data.CreationTime), + conversion.wintime_to_datetime(attr_data.ModifiedTime), + conversion.wintime_to_datetime(attr_data.UpdatedTime), + conversion.wintime_to_datetime(attr_data.AccessedTime), + renderers.NotApplicableValue(), + ) + + # File Name Attribute + elif attr.Attr_Header.AttrType.lookup() == "FILE_NAME": + attr_data = attr.Attr_Data.cast(self.fn_object) + file_name = attr_data.get_full_name() + + # If we don't have a valid enum, coerce to hex so we can keep the record + try: + permissions = attr_data.Flags.lookup() + except ValueError: + permissions = hex(attr_data.Flags) + + yield 1, ( + format_hints.Hex(attr_data.vol.offset), + mft_record.get_signature(), + mft_record.RecordNumber, + mft_record.LinkCount, + mft_flag, + permissions, + attr.Attr_Header.AttrType.lookup(), + conversion.wintime_to_datetime(attr_data.CreationTime), + conversion.wintime_to_datetime(attr_data.ModifiedTime), + conversion.wintime_to_datetime(attr_data.UpdatedTime), + conversion.wintime_to_datetime(attr_data.AccessedTime), + file_name, + ) + + def _generator(self): + for record in self.enumerate_mft_records(self.parse_mft_records): + yield record + def generate_timeline(self): for row in self._generator(): _depth, row_data = row @@ -173,127 +185,98 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): self._generator(), ) - -class ADS(interfaces.plugins.PluginInterface): +class ADS(MFTScan): """Scans for Alternate Data Stream""" _required_framework_version = (2, 0, 0) - @classmethod - def get_requirements(cls): - return [ - requirements.TranslationLayerRequirement( - name="primary", - description="Memory layer for the kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) - ), - ] + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + + # which DATA attribute should be displayed + self._display_first_data = False + + def _parse_data_record(self, mft_record, attr): + if attr.Attr_Header.NonResidentFlag: + return + + # regular $DATA + if self._display_first_data: + content = attr.get_resident_filecontent() + if content: + content = format_hints.HexBytes(content) + else: + content = renderers.NotAvailableValue() + + yield 0, ( + format_hints.Hex(self._record_map[mft_record.RecordNumber][2]), + mft_record.get_signature(), + mft_record.RecordNumber, + attr.Attr_Header.AttrType.lookup(), + self._record_map[mft_record.RecordNumber][0], + content, + ) + + # ADS $DATA + elif attr.Attr_Header.NameLength > 0: + ads_name = attr.get_resident_filename() + if not ads_name: + ads_name = renderers.NotAvailableValue() + + content = attr.get_resident_filecontent() + if content: + content = format_hints.HexBytes(content) + else: + content = renderers.NotAvailableValue() + + yield 0, ( + format_hints.Hex(self._record_map[mft_record.RecordNumber][2]), + mft_record.get_signature(), + mft_record.RecordNumber, + attr.Attr_Header.AttrType.lookup(), + self._record_map[mft_record.RecordNumber][0], + ads_name, + content, + ) + + def parse_data_records(self, mft_record, attr): + rec_num = mft_record.RecordNumber + if rec_num not in self._record_map: + # file name, DATA count, offset + self._record_map[rec_num] = [renderers.NotAvailableValue(), 0, None] + + if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": + attr_data = attr.Attr_Data.cast(self.fn_object) + rec_name = attr_data.get_full_name() + self._record_map[rec_num][0] = rec_name + elif attr.Attr_Header.AttrType.lookup() == "DATA": + # first data + self._record_map[rec_num][2] = attr.Attr_Data.vol.offset + + display_data = False + + # first DATA attribute of this record + if self._record_map[rec_num][1] == 0: + if self._display_first_data: + display_data = True + else: + self._record_map[rec_num][1] = 1 + + # at the second DATA attribute of this record + elif not self._display_first_data: + display_data = True + + if display_data: + for record in self._parse_data_record( + mft_record, attr + ): + yield record def _generator(self): - layer = self.context.layers[self.config["primary"]] - - # Yara Rule to scan for MFT Header Signatures - rules = yarascan.YaraScan.process_yara_options( - {"yara_string": "/FILE0|FILE\\*|BAAD/"} - ) - - # Read in the Symbol File - symbol_table = intermed.IntermediateSymbolTable.create( - context=self.context, - config_path=self.config_path, - sub_path="windows", - filename="mft", - class_types={ - "MFT_ENTRY": mft.MFTEntry, - "FILE_NAME_ENTRY": mft.MFTFileName, - "ATTRIBUTE": mft.MFTAttribute, - }, - ) - - # get each of the individual Field Sets - mft_object = symbol_table + constants.BANG + "MFT_ENTRY" - attribute_object = symbol_table + constants.BANG + "ATTRIBUTE" - fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" - - # Scan the layer for Raw MFT records and parse the fields - for offset, _rule_name, _name, _value in layer.scan( - context=self.context, scanner=yarascan.YaraScanner(rules=rules) + for record in self.enumerate_mft_records( + self.parse_data_records ): - with contextlib.suppress(exceptions.PagedInvalidAddressException): - mft_record = self.context.object( - mft_object, offset=offset, layer_name=layer.name - ) - # We will update this on each pass in the next loop and use it as the new offset. - attr_base_offset = mft_record.FirstAttrOffset - - attr = self.context.object( - attribute_object, - offset=offset + attr_base_offset, - layer_name=layer.name, - ) - - # There is no field that has a count of Attributes - # Keep Attempting to read attributes until we get an invalid attr.AttrType - is_ads = False - file_name = renderers.NotAvailableValue - # The First $DATA Attr is the 'principal' file itself not the ADS - while attr.Attr_Header.AttrType.is_valid_choice: - if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - attr_data = attr.Attr_Data.cast(fn_object) - file_name = attr_data.get_full_name() - if attr.Attr_Header.AttrType.lookup() == "DATA": - if is_ads: - if not attr.Attr_Header.NonResidentFlag: - # Resident files are the most interesting. - if attr.Attr_Header.NameLength > 0: - ads_name = attr.get_resident_filename() - if not ads_name: - ads_name = renderers.NotAvailableValue - - content = attr.get_resident_filecontent() - if content: - # Preparing for Disassembly - disasm = interfaces.renderers.BaseAbsentValue - architecture = layer.metadata.get( - "architecture", None - ) - if architecture: - disasm = interfaces.renderers.Disassembly( - content, 0, architecture.lower() - ) - content = format_hints.HexBytes(content) - else: - content = renderers.NotAvailableValue() - disasm = interfaces.renderers.BaseAbsentValue() - - yield 0, ( - format_hints.Hex(attr_data.vol.offset), - mft_record.get_signature(), - mft_record.RecordNumber, - attr.Attr_Header.AttrType.lookup(), - file_name, - ads_name, - content, - disasm, - ) - else: - is_ads = True - - # If there's no advancement the loop will never end, so break it now - if attr.Attr_Header.Length == 0: - break - - # Update the base offset to point to the next attribute - attr_base_offset += attr.Attr_Header.Length - # Get the next attribute - attr = self.context.object( - attribute_object, - offset=offset + attr_base_offset, - layer_name=layer.name, - ) + yield record def run(self): return renderers.TreeGrid( @@ -305,7 +288,31 @@ class ADS(interfaces.plugins.PluginInterface): ("Filename", str), ("ADS Filename", str), ("Hexdump", format_hints.HexBytes), - ("Disasm", interfaces.renderers.Disassembly), ], self._generator(), ) + +class ResidentData(ADS): + """Scans for Alternate Data Stream""" + + _required_framework_version = (2, 0, 0) + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + + # which DATA attribute should be displayed + self._display_first_data = True + + def run(self): + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Record Type", str), + ("Record Number", int), + ("MFT Type", str), + ("Filename", str), + ("Hexdump", format_hints.HexBytes), + ], + self._generator(), + ) + From 8926823199e35cd26858f6782943f4ec4e53e20e Mon Sep 17 00:00:00 2001 From: atcuno Date: Wed, 19 Jun 2024 18:08:08 -0500 Subject: [PATCH 0028/1352] Format fixes --- .../framework/plugins/windows/mftscan.py | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 0687c7796..d6f4684ec 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -53,7 +53,11 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): config_path=self.config_path, sub_path="windows", filename="mft", - class_types={"FILE_NAME_ENTRY": mft.MFTFileName, "MFT_ENTRY": mft.MFTEntry, "ATTRIBUTE": mft.MFTAttribute}, + class_types={ + "FILE_NAME_ENTRY": mft.MFTFileName, + "MFT_ENTRY": mft.MFTEntry, + "ATTRIBUTE": mft.MFTAttribute + }, ) # get each of the individual Field Sets @@ -185,6 +189,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): self._generator(), ) + class ADS(MFTScan): """Scans for Alternate Data Stream""" @@ -242,7 +247,7 @@ class ADS(MFTScan): def parse_data_records(self, mft_record, attr): rec_num = mft_record.RecordNumber if rec_num not in self._record_map: - # file name, DATA count, offset + # file name, DATA count, offset self._record_map[rec_num] = [renderers.NotAvailableValue(), 0, None] if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": @@ -267,15 +272,11 @@ class ADS(MFTScan): display_data = True if display_data: - for record in self._parse_data_record( - mft_record, attr - ): + for record in self._parse_data_record(mft_record, attr): yield record def _generator(self): - for record in self.enumerate_mft_records( - self.parse_data_records - ): + for record in self.enumerate_mft_records(self.parse_data_records): yield record def run(self): @@ -292,6 +293,7 @@ class ADS(MFTScan): self._generator(), ) + class ResidentData(ADS): """Scans for Alternate Data Stream""" @@ -315,4 +317,3 @@ class ResidentData(ADS): ], self._generator(), ) - From 105b4bab25511dc8f5b2461f5f2a53422b55dafa Mon Sep 17 00:00:00 2001 From: atcuno Date: Wed, 19 Jun 2024 18:09:18 -0500 Subject: [PATCH 0029/1352] Format fixes --- volatility3/framework/plugins/windows/mftscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index d6f4684ec..540ab531c 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -56,7 +56,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): class_types={ "FILE_NAME_ENTRY": mft.MFTFileName, "MFT_ENTRY": mft.MFTEntry, - "ATTRIBUTE": mft.MFTAttribute + "ATTRIBUTE": mft.MFTAttribute, }, ) From 9b8eea015a4544752805f0dcfa2bde33b33e3084 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 18 Jul 2024 11:57:13 -0500 Subject: [PATCH 0030/1352] Address feedback --- .../framework/plugins/windows/mftscan.py | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 540ab531c..e2dfa12a3 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -5,6 +5,8 @@ import contextlib import datetime import logging +from typing import Generator, Iterable + from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import conversion, format_hints @@ -23,6 +25,10 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._record_map = {} + self.mft_object = None + self.attribute_object = None + self.si_object = None + self.fn_object = None @classmethod def get_requirements(cls): @@ -201,12 +207,17 @@ class ADS(MFTScan): # which DATA attribute should be displayed self._display_first_data = False - def _parse_data_record(self, mft_record, attr): + def _parse_data_record( + self, + mft_record: interfaces.objects.ObjectInterface, + attr: interfaces.objects.ObjectInterface, + ) -> Generator[Iterable, None, None]: + # we only care about resident data if attr.Attr_Header.NonResidentFlag: return # regular $DATA - if self._display_first_data: + elif self._display_first_data: content = attr.get_resident_filecontent() if content: content = format_hints.HexBytes(content) @@ -244,7 +255,11 @@ class ADS(MFTScan): content, ) - def parse_data_records(self, mft_record, attr): + def parse_data_records( + self, + mft_record: interfaces.objects.ObjectInterface, + attr: interfaces.objects.ObjectInterface, + ) -> Generator[Iterable, None, None]: rec_num = mft_record.RecordNumber if rec_num not in self._record_map: # file name, DATA count, offset From 2c73d8812a24eb8e34b84cfc6be61bf06a0c18b5 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 21 Jul 2024 08:55:27 -0500 Subject: [PATCH 0031/1352] Split layer gathering and add KeyError checks --- volatility3/framework/plugins/windows/mftscan.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index e2dfa12a3..6a4033a6f 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -44,7 +44,17 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ] def enumerate_mft_records(self, attr_callback): - phys_layer = self.context.layers[self.config["primary"]].config["memory_layer"] + try: + primary = self.context.layers[self.config["primary"]] + except KeyError: + vollog.error("Unable to obtain primary layer for scanning. Please file a bug on GitHub about this issue.") + return + + try: + phys_layer = primary.config["memory_layer"] + except KeyError: + vollog.error("Unable to obtain memory layer from primary layer. Please file a bug on GitHub about this issue.") + return layer = self.context.layers[phys_layer] From a8c6db2fc4b7d7a618477639e64d2c554c8961b2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 21 Jul 2024 11:56:52 -0500 Subject: [PATCH 0032/1352] Formatting fixes --- volatility3/framework/plugins/windows/mftscan.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 6a4033a6f..ec8dd5fe8 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -47,13 +47,17 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): try: primary = self.context.layers[self.config["primary"]] except KeyError: - vollog.error("Unable to obtain primary layer for scanning. Please file a bug on GitHub about this issue.") + vollog.error( + "Unable to obtain primary layer for scanning. Please file a bug on GitHub about this issue." + ) return try: phys_layer = primary.config["memory_layer"] except KeyError: - vollog.error("Unable to obtain memory layer from primary layer. Please file a bug on GitHub about this issue.") + vollog.error( + "Unable to obtain memory layer from primary layer. Please file a bug on GitHub about this issue." + ) return layer = self.context.layers[phys_layer] From dea0e156890e620ef78aeeadce8139a81e8e9042 Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 22 Jul 2024 16:27:05 -0500 Subject: [PATCH 0033/1352] Address feedback --- .../framework/plugins/windows/mftscan.py | 338 +++++++++++------- 1 file changed, 215 insertions(+), 123 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index ec8dd5fe8..0d858cec1 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -5,7 +5,7 @@ import contextlib import datetime import logging -from typing import Generator, Iterable +from typing import Generator, Iterable, Dict, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -22,13 +22,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - self._record_map = {} - self.mft_object = None - self.attribute_object = None - self.si_object = None - self.fn_object = None + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -43,9 +37,15 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ), ] - def enumerate_mft_records(self, attr_callback): + @staticmethod + def enumerate_mft_records( + context: interfaces.context.ContextInterface, + config: interfaces.configuration.HierarchicalDict, + config_path: str, + attr_callback + ) -> interfaces.objects.ObjectInterface: try: - primary = self.context.layers[self.config["primary"]] + primary = context.layers[config["primary"]] except KeyError: vollog.error( "Unable to obtain primary layer for scanning. Please file a bug on GitHub about this issue." @@ -60,7 +60,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) return - layer = self.context.layers[phys_layer] + layer = context.layers[phys_layer] # Yara Rule to scan for MFT Header Signatures rules = yarascan.YaraScan.process_yara_options( @@ -69,8 +69,8 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Read in the Symbol File symbol_table = intermed.IntermediateSymbolTable.create( - context=self.context, - config_path=self.config_path, + context=context, + config_path=config_path, sub_path="windows", filename="mft", class_types={ @@ -81,23 +81,21 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) # get each of the individual Field Sets - self.mft_object = symbol_table + constants.BANG + "MFT_ENTRY" - self.attribute_object = symbol_table + constants.BANG + "ATTRIBUTE" - self.si_object = symbol_table + constants.BANG + "STANDARD_INFORMATION_ENTRY" - self.fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" + mft_object = symbol_table + constants.BANG + "MFT_ENTRY" + attribute_object = symbol_table + constants.BANG + "ATTRIBUTE" # Scan the layer for Raw MFT records and parse the fields for offset, _, _, _ in layer.scan( - context=self.context, scanner=yarascan.YaraScanner(rules=rules) + context=context, scanner=yarascan.YaraScanner(rules=rules) ): with contextlib.suppress(exceptions.InvalidAddressException): - mft_record = self.context.object( - self.mft_object, offset=offset, layer_name=layer.name + mft_record = context.object( + mft_object, offset=offset, layer_name=layer.name ) # We will update this on each pass in the next loop and use it as the new offset. attr_base_offset = mft_record.FirstAttrOffset - attr = self.context.object( - self.attribute_object, + attr = context.object( + attribute_object, offset=offset + attr_base_offset, layer_name=layer.name, ) @@ -105,7 +103,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # There is no field that has a count of Attributes # Keep Attempting to read attributes until we get an invalid attr_header.AttrType while attr.Attr_Header.AttrType.is_valid_choice: - for record in attr_callback(mft_record, attr): + for record in attr_callback(mft_record, attr, symbol_table): yield record # If there's no advancement the loop will never end, so break it now @@ -115,13 +113,14 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Update the base offset to point to the next attribute attr_base_offset += attr.Attr_Header.Length # Get the next attribute - attr = self.context.object( - self.attribute_object, + attr = context.object( + attribute_object, offset=offset + attr_base_offset, layer_name=layer.name, ) - def parse_mft_records(self, mft_record, attr): + @staticmethod + def parse_mft_records(mft_record, attr, symbol_table): # MFT Flags determine the file type or dir # If we don't have a valid enum, coerce to hex so we can keep the record try: @@ -131,7 +130,8 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Standard Information Attribute if attr.Attr_Header.AttrType.lookup() == "STANDARD_INFORMATION": - attr_data = attr.Attr_Data.cast(self.si_object) + si_object = symbol_table + constants.BANG + "STANDARD_INFORMATION_ENTRY" + attr_data = attr.Attr_Data.cast(si_object) yield 0, ( format_hints.Hex(attr_data.vol.offset), mft_record.get_signature(), @@ -149,7 +149,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # File Name Attribute elif attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - attr_data = attr.Attr_Data.cast(self.fn_object) + fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" + + attr_data = attr.Attr_Data.cast(fn_object) file_name = attr_data.get_full_name() # If we don't have a valid enum, coerce to hex so we can keep the record @@ -173,8 +175,114 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): file_name, ) + @staticmethod + def parse_data_record( + mft_record: interfaces.objects.ObjectInterface, + attr: interfaces.objects.ObjectInterface, + record_map: Dict[int, Tuple[str, int, int]], + return_first_record: bool, + ) -> Generator[Iterable, None, None]: + """ + Returns the parsed data from a MFT record + """ + # we only care about resident data + if attr.Attr_Header.NonResidentFlag: + return + + content = attr.get_resident_filecontent() + if content: + content = format_hints.HexBytes(content) + else: + content = renderers.NotAvailableValue() + + # past the first $DATA record, attempt to get the ADS name + # NotApplicableValue = 1st Data + # NotAvailableValue = > 1st Data, but name was not parsable + ads_name = renderers.NotApplicableValue() + if not return_first_record and attr.Attr_Header.NameLength > 0: + ads_name = attr.get_resident_filename() + if not ads_name: + ads_name = renderers.NotAvailableValue() + + yield ( + format_hints.Hex(record_map[mft_record.RecordNumber][2]), + mft_record.get_signature(), + mft_record.RecordNumber, + attr.Attr_Header.AttrType.lookup(), + record_map[mft_record.RecordNumber][0], + ads_name, + content, + ) + + @classmethod + def _do_parse_data_records( + cls, + mft_record: interfaces.objects.ObjectInterface, + attr: interfaces.objects.ObjectInterface, + symbol_table, + record_map: Dict[int, Tuple[str, int, int]], + return_first_record: bool, + ) -> Generator[Iterable, None, None]: + """ + Parses DATA records while maintaining the FILE_NAME association + from previous parsing of the record + Suports returning the first/main $DATA as well as however many + ADS records a file might have + """ + rec_num = mft_record.RecordNumber + if rec_num not in record_map: + # file name, DATA count, offset + record_map[rec_num] = [renderers.NotAvailableValue(), 0, None] + + if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": + fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" + attr_data = attr.Attr_Data.cast(fn_object) + rec_name = attr_data.get_full_name() + record_map[rec_num][0] = rec_name + elif attr.Attr_Header.AttrType.lookup() == "DATA": + # first data + record_map[rec_num][2] = attr.Attr_Data.vol.offset + + display_data = False + + # first DATA attribute of this record + if record_map[rec_num][1] == 0 and return_first_record: + if return_first_record: + display_data = True + else: + record_map[rec_num][1] = 1 + + # at the second DATA attribute of this record + elif not return_first_record: + display_data = True + + if display_data: + for record in cls.parse_data_record( + mft_record, attr, record_map, return_first_record + ): + yield record + + @classmethod + def parse_data_records( + cls, + mft_record: interfaces.objects.ObjectInterface, + attr: interfaces.objects.ObjectInterface, + symbol_table, + return_first_record: bool, + ): + """ + Callback for parsing data records through enumerate_mft_records + """ + record_map = {} + for record in cls._do_parse_data_records( + mft_record, attr, symbol_table, record_map, return_first_record + ): + yield record + def _generator(self): - for record in self.enumerate_mft_records(self.parse_mft_records): + for record in self.enumerate_mft_records( + self.context, self.config, self.config_path, self.parse_mft_records + ): yield record def generate_timeline(self): @@ -210,103 +318,53 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) -class ADS(MFTScan): +class ADS(interfaces.plugins.PluginInterface): """Scans for Alternate Data Stream""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 7, 0) - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) + _version = (1, 0, 0) - # which DATA attribute should be displayed - self._display_first_data = False + @classmethod + def get_requirements(cls): + return [ + requirements.PluginRequirement( + name="MFTScan", plugin=MFTScan, version=(2, 0, 0) + ), + requirements.TranslationLayerRequirement( + name="primary", + description="Memory layer for the kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) + ), + ] - def _parse_data_record( - self, + @staticmethod + def parse_ads_data_records( mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, - ) -> Generator[Iterable, None, None]: - # we only care about resident data - if attr.Attr_Header.NonResidentFlag: - return - - # regular $DATA - elif self._display_first_data: - content = attr.get_resident_filecontent() - if content: - content = format_hints.HexBytes(content) - else: - content = renderers.NotAvailableValue() - - yield 0, ( - format_hints.Hex(self._record_map[mft_record.RecordNumber][2]), - mft_record.get_signature(), - mft_record.RecordNumber, - attr.Attr_Header.AttrType.lookup(), - self._record_map[mft_record.RecordNumber][0], - content, - ) - - # ADS $DATA - elif attr.Attr_Header.NameLength > 0: - ads_name = attr.get_resident_filename() - if not ads_name: - ads_name = renderers.NotAvailableValue() - - content = attr.get_resident_filecontent() - if content: - content = format_hints.HexBytes(content) - else: - content = renderers.NotAvailableValue() - - yield 0, ( - format_hints.Hex(self._record_map[mft_record.RecordNumber][2]), - mft_record.get_signature(), - mft_record.RecordNumber, - attr.Attr_Header.AttrType.lookup(), - self._record_map[mft_record.RecordNumber][0], - ads_name, - content, - ) - - def parse_data_records( - self, - mft_record: interfaces.objects.ObjectInterface, - attr: interfaces.objects.ObjectInterface, - ) -> Generator[Iterable, None, None]: - rec_num = mft_record.RecordNumber - if rec_num not in self._record_map: - # file name, DATA count, offset - self._record_map[rec_num] = [renderers.NotAvailableValue(), 0, None] - - if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - attr_data = attr.Attr_Data.cast(self.fn_object) - rec_name = attr_data.get_full_name() - self._record_map[rec_num][0] = rec_name - elif attr.Attr_Header.AttrType.lookup() == "DATA": - # first data - self._record_map[rec_num][2] = attr.Attr_Data.vol.offset - - display_data = False - - # first DATA attribute of this record - if self._record_map[rec_num][1] == 0: - if self._display_first_data: - display_data = True - else: - self._record_map[rec_num][1] = 1 - - # at the second DATA attribute of this record - elif not self._display_first_data: - display_data = True - - if display_data: - for record in self._parse_data_record(mft_record, attr): - yield record + symbol_table, + ): + return MFTScan.parse_data_records(mft_record, attr, symbol_table, False) def _generator(self): - for record in self.enumerate_mft_records(self.parse_data_records): - yield record + for ( + offset, + rec_type, + rec_num, + attr_type, + file_name, + ads_name, + content, + ) in MFTScan.enumerate_mft_records( + self.context, self.config, self.config_path, self.parse_ads_data_records + ): + yield ( + 0, + (offset, rec_type, rec_num, attr_type, file_name, ads_name, content), + ) def run(self): return renderers.TreeGrid( @@ -323,16 +381,50 @@ class ADS(MFTScan): ) -class ResidentData(ADS): +class ResidentData(interfaces.plugins.PluginInterface): """Scans for Alternate Data Stream""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 7, 0) - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) + _version = (1, 0, 0) - # which DATA attribute should be displayed - self._display_first_data = True + @classmethod + def get_requirements(cls): + return [ + requirements.PluginRequirement( + name="MFTScan", plugin=MFTScan, version=(2, 0, 0) + ), + requirements.TranslationLayerRequirement( + name="primary", + description="Memory layer for the kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) + ), + ] + + @staticmethod + def parse_first_data_records( + mft_record: interfaces.objects.ObjectInterface, + attr: interfaces.objects.ObjectInterface, + symbol_table, + ): + return MFTScan.parse_data_records(mft_record, attr, symbol_table, True) + + def _generator(self): + for ( + offset, + rec_type, + rec_num, + attr_type, + file_name, + _, + content, + ) in MFTScan.enumerate_mft_records( + self.context, self.config, self.config_path, self.parse_first_data_records + ): + yield (0, (offset, rec_type, rec_num, attr_type, file_name, content)) def run(self): return renderers.TreeGrid( From da843b0367b7353274626f79d09ddb4377a9148b Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 22 Jul 2024 16:27:39 -0500 Subject: [PATCH 0034/1352] Address feedback --- volatility3/framework/plugins/windows/mftscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 0d858cec1..6a2aac440 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -42,7 +42,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): context: interfaces.context.ContextInterface, config: interfaces.configuration.HierarchicalDict, config_path: str, - attr_callback + attr_callback, ) -> interfaces.objects.ObjectInterface: try: primary = context.layers[config["primary"]] From 33716be15b4088e7743bc938f2c0e83ab8b5ea18 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 31 Jul 2024 13:56:38 -0500 Subject: [PATCH 0035/1352] Rework for proper ADS recovery. Memory OOM issues --- .../framework/plugins/windows/mftscan.py | 51 +++++++++++-------- 1 file changed, 31 insertions(+), 20 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 6a2aac440..430f3fc02 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -84,8 +84,10 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): mft_object = symbol_table + constants.BANG + "MFT_ENTRY" attribute_object = symbol_table + constants.BANG + "ATTRIBUTE" + record_map = {} + # Scan the layer for Raw MFT records and parse the fields - for offset, _, _, _ in layer.scan( + for offset, _rule_name, _name, _value in layer.scan( context=context, scanner=yarascan.YaraScanner(rules=rules) ): with contextlib.suppress(exceptions.InvalidAddressException): @@ -103,7 +105,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # There is no field that has a count of Attributes # Keep Attempting to read attributes until we get an invalid attr_header.AttrType while attr.Attr_Header.AttrType.is_valid_choice: - for record in attr_callback(mft_record, attr, symbol_table): + for record in attr_callback(record_map, mft_record, attr, symbol_table): yield record # If there's no advancement the loop will never end, so break it now @@ -120,7 +122,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) @staticmethod - def parse_mft_records(mft_record, attr, symbol_table): + def parse_mft_records(record_map, mft_record, attr, symbol_table): # MFT Flags determine the file type or dir # If we don't have a valid enum, coerce to hex so we can keep the record try: @@ -189,21 +191,27 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): if attr.Attr_Header.NonResidentFlag: return + # we aren't looking ADS when we want the first data record + if return_first_record: + ads_name = renderers.NotApplicableValue() + + # skip records without a name if we want ADS entries + elif attr.Attr_Header.NameLength == 0: + return + + else: + # past the first $DATA record, attempt to get the ADS name + # NotAvailableValue = > 1st Data, but name was not parsable + ads_name = attr.get_resident_filename() + if not ads_name: + ads_name = renderers.NotAvailableValue() + content = attr.get_resident_filecontent() if content: content = format_hints.HexBytes(content) else: content = renderers.NotAvailableValue() - # past the first $DATA record, attempt to get the ADS name - # NotApplicableValue = 1st Data - # NotAvailableValue = > 1st Data, but name was not parsable - ads_name = renderers.NotApplicableValue() - if not return_first_record and attr.Attr_Header.NameLength > 0: - ads_name = attr.get_resident_filename() - if not ads_name: - ads_name = renderers.NotAvailableValue() - yield ( format_hints.Hex(record_map[mft_record.RecordNumber][2]), mft_record.get_signature(), @@ -246,14 +254,15 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): display_data = False # first DATA attribute of this record - if record_map[rec_num][1] == 0 and return_first_record: + if record_map[rec_num][1] == 0: if return_first_record: display_data = True - else: - record_map[rec_num][1] = 1 + + record_map[rec_num][1] = 1 # at the second DATA attribute of this record - elif not return_first_record: + elif record_map[rec_num][1] == 1 and not return_first_record: + print("at second record") display_data = True if display_data: @@ -265,6 +274,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def parse_data_records( cls, + record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, symbol_table, @@ -273,7 +283,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """ Callback for parsing data records through enumerate_mft_records """ - record_map = {} for record in cls._do_parse_data_records( mft_record, attr, symbol_table, record_map, return_first_record ): @@ -343,11 +352,12 @@ class ADS(interfaces.plugins.PluginInterface): @staticmethod def parse_ads_data_records( + record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, symbol_table, ): - return MFTScan.parse_data_records(mft_record, attr, symbol_table, False) + return MFTScan.parse_data_records(record_map, mft_record, attr, symbol_table, False) def _generator(self): for ( @@ -382,7 +392,7 @@ class ADS(interfaces.plugins.PluginInterface): class ResidentData(interfaces.plugins.PluginInterface): - """Scans for Alternate Data Stream""" + """Scans for MFT Records with Resident Data""" _required_framework_version = (2, 7, 0) @@ -406,11 +416,12 @@ class ResidentData(interfaces.plugins.PluginInterface): @staticmethod def parse_first_data_records( + record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, symbol_table, ): - return MFTScan.parse_data_records(mft_record, attr, symbol_table, True) + return MFTScan.parse_data_records(record_map, mft_record, attr, symbol_table, True) def _generator(self): for ( From da41124b1cb936ab168555568cf17512f719b6b4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 2 Sep 2024 14:20:02 -0500 Subject: [PATCH 0036/1352] Fix formatting with black --- volatility3/framework/plugins/windows/mftscan.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 430f3fc02..2929b0522 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -105,7 +105,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # There is no field that has a count of Attributes # Keep Attempting to read attributes until we get an invalid attr_header.AttrType while attr.Attr_Header.AttrType.is_valid_choice: - for record in attr_callback(record_map, mft_record, attr, symbol_table): + for record in attr_callback( + record_map, mft_record, attr, symbol_table + ): yield record # If there's no advancement the loop will never end, so break it now @@ -357,7 +359,9 @@ class ADS(interfaces.plugins.PluginInterface): attr: interfaces.objects.ObjectInterface, symbol_table, ): - return MFTScan.parse_data_records(record_map, mft_record, attr, symbol_table, False) + return MFTScan.parse_data_records( + record_map, mft_record, attr, symbol_table, False + ) def _generator(self): for ( @@ -421,7 +425,9 @@ class ResidentData(interfaces.plugins.PluginInterface): attr: interfaces.objects.ObjectInterface, symbol_table, ): - return MFTScan.parse_data_records(record_map, mft_record, attr, symbol_table, True) + return MFTScan.parse_data_records( + record_map, mft_record, attr, symbol_table, True + ) def _generator(self): for ( From 685dc97298719b9bcfb24d5a020b7d4550580f4c Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Mon, 30 Sep 2024 18:11:23 -0500 Subject: [PATCH 0037/1352] fix resident data bug for duplicate mft record numbers --- .../framework/plugins/windows/mftscan.py | 20 +++++++++---------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 2929b0522..16425ca22 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -215,11 +215,11 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): content = renderers.NotAvailableValue() yield ( - format_hints.Hex(record_map[mft_record.RecordNumber][2]), + format_hints.Hex(record_map[mft_record.vol.offset][2]), mft_record.get_signature(), mft_record.RecordNumber, attr.Attr_Header.AttrType.lookup(), - record_map[mft_record.RecordNumber][0], + record_map[mft_record.vol.offset][0], ads_name, content, ) @@ -239,31 +239,29 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Suports returning the first/main $DATA as well as however many ADS records a file might have """ - rec_num = mft_record.RecordNumber - if rec_num not in record_map: + if mft_record.vol.offset not in record_map: # file name, DATA count, offset - record_map[rec_num] = [renderers.NotAvailableValue(), 0, None] - + record_map[mft_record.vol.offset] = [renderers.NotAvailableValue(), 0, None] if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" attr_data = attr.Attr_Data.cast(fn_object) rec_name = attr_data.get_full_name() - record_map[rec_num][0] = rec_name + record_map[mft_record.vol.offset][0] = rec_name elif attr.Attr_Header.AttrType.lookup() == "DATA": # first data - record_map[rec_num][2] = attr.Attr_Data.vol.offset + record_map[mft_record.vol.offset][2] = attr.Attr_Data.vol.offset display_data = False # first DATA attribute of this record - if record_map[rec_num][1] == 0: + if record_map[mft_record.vol.offset][1] == 0: if return_first_record: display_data = True - record_map[rec_num][1] = 1 + record_map[mft_record.vol.offset][1] = 1 # at the second DATA attribute of this record - elif record_map[rec_num][1] == 1 and not return_first_record: + elif record_map[mft_record.vol.offset][1] == 1 and not return_first_record: print("at second record") display_data = True From 79f81f0af9193878f0290d0ae05d5178e71502c6 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 15 Oct 2024 14:11:27 -0500 Subject: [PATCH 0038/1352] Address feedback --- .../framework/plugins/windows/mftscan.py | 37 +++++-------------- 1 file changed, 9 insertions(+), 28 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 16425ca22..94dce8c4d 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -40,12 +40,12 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @staticmethod def enumerate_mft_records( context: interfaces.context.ContextInterface, - config: interfaces.configuration.HierarchicalDict, config_path: str, + primary_layer_name: str, attr_callback, ) -> interfaces.objects.ObjectInterface: try: - primary = context.layers[config["primary"]] + primary = context.layers[primary_layer_name] except KeyError: vollog.error( "Unable to obtain primary layer for scanning. Please file a bug on GitHub about this issue." @@ -105,10 +105,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # There is no field that has a count of Attributes # Keep Attempting to read attributes until we get an invalid attr_header.AttrType while attr.Attr_Header.AttrType.is_valid_choice: - for record in attr_callback( + yield from attr_callback( record_map, mft_record, attr, symbol_table - ): - yield record + ) # If there's no advancement the loop will never end, so break it now if attr.Attr_Header.Length == 0: @@ -225,12 +224,12 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) @classmethod - def _do_parse_data_records( + def parse_data_records( cls, + record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, symbol_table, - record_map: Dict[int, Tuple[str, int, int]], return_first_record: bool, ) -> Generator[Iterable, None, None]: """ @@ -262,7 +261,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # at the second DATA attribute of this record elif record_map[mft_record.vol.offset][1] == 1 and not return_first_record: - print("at second record") display_data = True if display_data: @@ -271,26 +269,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ): yield record - @classmethod - def parse_data_records( - cls, - record_map: Dict[int, Tuple[str, int, int]], - mft_record: interfaces.objects.ObjectInterface, - attr: interfaces.objects.ObjectInterface, - symbol_table, - return_first_record: bool, - ): - """ - Callback for parsing data records through enumerate_mft_records - """ - for record in cls._do_parse_data_records( - mft_record, attr, symbol_table, record_map, return_first_record - ): - yield record - def _generator(self): for record in self.enumerate_mft_records( - self.context, self.config, self.config_path, self.parse_mft_records + self.context, self.config_path, self.config["primary"], self.parse_mft_records ): yield record @@ -371,7 +352,7 @@ class ADS(interfaces.plugins.PluginInterface): ads_name, content, ) in MFTScan.enumerate_mft_records( - self.context, self.config, self.config_path, self.parse_ads_data_records + self.context, self.config_path, self.config["primary"], self.parse_ads_data_records ): yield ( 0, @@ -437,7 +418,7 @@ class ResidentData(interfaces.plugins.PluginInterface): _, content, ) in MFTScan.enumerate_mft_records( - self.context, self.config, self.config_path, self.parse_first_data_records + self.context, self.config_path, self.config["primary"], self.parse_first_data_records ): yield (0, (offset, rec_type, rec_num, attr_type, file_name, content)) From adee265b1775a15913c0ce7d591cd9c6ccb32e18 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 15 Oct 2024 14:12:23 -0500 Subject: [PATCH 0039/1352] Address feedback --- .../framework/plugins/windows/mftscan.py | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 94dce8c4d..014516b7c 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -105,9 +105,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # There is no field that has a count of Attributes # Keep Attempting to read attributes until we get an invalid attr_header.AttrType while attr.Attr_Header.AttrType.is_valid_choice: - yield from attr_callback( - record_map, mft_record, attr, symbol_table - ) + yield from attr_callback(record_map, mft_record, attr, symbol_table) # If there's no advancement the loop will never end, so break it now if attr.Attr_Header.Length == 0: @@ -271,7 +269,10 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self): for record in self.enumerate_mft_records( - self.context, self.config_path, self.config["primary"], self.parse_mft_records + self.context, + self.config_path, + self.config["primary"], + self.parse_mft_records, ): yield record @@ -352,7 +353,10 @@ class ADS(interfaces.plugins.PluginInterface): ads_name, content, ) in MFTScan.enumerate_mft_records( - self.context, self.config_path, self.config["primary"], self.parse_ads_data_records + self.context, + self.config_path, + self.config["primary"], + self.parse_ads_data_records, ): yield ( 0, @@ -418,7 +422,10 @@ class ResidentData(interfaces.plugins.PluginInterface): _, content, ) in MFTScan.enumerate_mft_records( - self.context, self.config_path, self.config["primary"], self.parse_first_data_records + self.context, + self.config_path, + self.config["primary"], + self.parse_first_data_records, ): yield (0, (offset, rec_type, rec_num, attr_type, file_name, content)) From d5a0b93383fda59267bdd9b42e716b70ad66595c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 31 Oct 2024 12:28:40 +0100 Subject: [PATCH 0040/1352] add TAINT_FLAGS constant --- .../framework/constants/linux/__init__.py | 85 +++++++++++++++++++ 1 file changed, 85 insertions(+) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 7c485d3c3..9f25c9225 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -347,3 +347,88 @@ class PT_FLAGS(Flag): MODULE_MAXIMUM_CORE_SIZE = 20000000 MODULE_MAXIMUM_CORE_TEXT_SIZE = 20000000 MODULE_MINIMUM_SIZE = 4096 + + +TAINT_FLAGS = { + "P": { + "shift": 1 << 0, + "desc": "PROPRIETARY_MODULE", + "when_present": True, + "module": True, + }, + "G": { + "shift": 1 << 0, + "desc": "PROPRIETARY_MODULE", + "when_present": False, + "module": True, + }, + "F": { + "shift": 1 << 1, + "desc": "FORCED_MODULE", + "when_present": True, + "module": False, + }, + # CPU_OUT_OF_SPEC was TAINT_UNSAFE_SMP on < 3.15-rc1 : https://lore.kernel.org/linux-kernel//20140303080432.GA25489@localhost/t/#:~:text=liked%20your%20proposal%3A-,%3E%20Right,-%2C%20I%20was%20about + "S": { + "shift": 1 << 2, + "desc": "CPU_OUT_OF_SPEC", + "when_present": True, + "module": False, + }, + "R": { + "shift": 1 << 3, + "desc": "FORCED_RMMOD", + "when_present": True, + "module": False, + }, + "M": { + "shift": 1 << 4, + "desc": "MACHINE_CHECK", + "when_present": True, + "module": False, + }, + "B": {"shift": 1 << 5, "desc": "BAD_PAGE", "when_present": True, "module": False}, + "U": {"shift": 1 << 6, "desc": "USER", "when_present": True, "module": False}, + "D": {"shift": 1 << 7, "desc": "DIE", "when_present": True, "module": False}, + "A": { + "shift": 1 << 8, + "desc": "OVERRIDDEN_ACPI_TABLE", + "when_present": True, + "module": False, + }, + "W": {"shift": 1 << 9, "desc": "WARN", "when_present": True, "module": False}, + "C": {"shift": 1 << 10, "desc": "CRAP", "when_present": True, "module": True}, + "I": { + "shift": 1 << 11, + "desc": "FIRMWARE_WORKAROUND", + "when_present": True, + "module": False, + }, + "O": {"shift": 1 << 12, "desc": "OOT_MODULE", "when_present": True, "module": True}, + "E": { + "shift": 1 << 13, + "desc": "UNSIGNED_MODULE", + "when_present": True, + "module": True, + }, + "L": { + "shift": 1 << 14, + "desc": "SOFTLOCKUP", + "when_present": True, + "module": False, + }, + "K": {"shift": 1 << 15, "desc": "LIVEPATCH", "when_present": True, "module": True}, + "X": {"shift": 1 << 16, "desc": "AUX", "when_present": True, "module": True}, + "T": {"shift": 1 << 17, "desc": "RANDSTRUCT", "when_present": True, "module": True}, + "N": {"shift": 1 << 18, "desc": "TEST", "when_present": True, "module": True}, +} +"""Flags used to taint kernel and modules, for debugging purposes. + +Map based on 6.12-rc5. + +Documentation : + - https://www.kernel.org/doc/Documentation/admin-guide/sysctl/kernel.rst#:~:text=guide/sysrq.rst.-,tainted,-%3D%3D%3D%3D%3D%3D%3D%0A%0ANon%2Dzero%20if + - https://www.kernel.org/doc/Documentation/admin-guide/tainted-kernels.rst#:~:text=More%20detailed%20explanation%20for%20tainting + - taint_flag kernel struct + - taint_flags kernel constant +""" From e1b343a284436ee4d92a7b8a6daf0a98dd01fdeb Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 31 Oct 2024 12:33:54 +0100 Subject: [PATCH 0041/1352] add module taints parsing apis --- .../symbols/linux/extensions/__init__.py | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index aa3e8c675..89e2cde27 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -279,6 +279,77 @@ class module(generic.GenericIntelProcess): return None + def _module_flags_taints_pre_4_10_rc1(self) -> str: + """Convert the module's taints value to a 1-1 character mapping. + Relies on statically defined taints mappings in the framework. + + Returns: + The raw taints string. + """ + taints_string = "" + for char, infos in linux_constants.TAINT_FLAGS.items(): + if infos["module"] and self.taints_value & infos["shift"]: + taints_string += char + + return taints_string + + def _module_flags_taints_post_4_10_rc1(self) -> str: + """Convert the module's taints value to a 1-1 character mapping. + Relies on kernel symbol embedded taints definitions. + + struct taint_flag { + char c_true; /* character printed when tainted */ + char c_false; /* character printed when not tainted */ + bool module; /* also show as a per-module taint flag */ + }; + + Returns: + The raw taints string. + """ + taints_string = "" + for i, taint_flag in enumerate(self.taint_flags_list): + c_true = chr(taint_flag.c_true) + c_false = chr(taint_flag.c_false) + if taint_flag.module and (self.taints_value & (1 << i)): + taints_string += c_true + elif taint_flag.module and c_false != " ": + taints_string += c_false + + return taints_string + + def get_taints_as_plain_string(self) -> str: + """Convert the module's taints value to a 1-1 character mapping. + + Returns: + The raw taints string. + + Documentation: + - module_flags_taint kernel function + """ + + if self.taint_flags_list: + return self._module_flags_taints_post_4_10_rc1() + return self._module_flags_taints_pre_4_10_rc1() + + def get_taints_parsed(self) -> List[str]: + """Convert the module's taints string to a 1-1 descriptor mapping. + + Returns: + A comprehensive (user-friendly) taint descriptor list. + + Documentation: + - module_flags_taint kernel function + """ + comprehensive_taints = [] + for c in self.get_taints_as_plain_string(): + infos = linux_constants.TAINT_FLAGS.get(c) + if not infos: + comprehensive_taints.append(f"") + elif infos["when_present"]: + comprehensive_taints.append(infos["desc"]) + + return comprehensive_taints + @property def section_symtab(self): if self.has_member("kallsyms"): @@ -307,6 +378,17 @@ class module(generic.GenericIntelProcess): return self.strtab raise AttributeError("module -> strtab: Unable to get strtab") + @property + def taints_value(self) -> int: + return self.taints + + @property + def taint_flags_list(self) -> Optional[List[interfaces.objects.ObjectInterface]]: + kernel = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + if kernel.has_symbol("taint_flags"): + return list(kernel.object_from_symbol("taint_flags")) + return None + class task_struct(generic.GenericIntelProcess): def add_process_layer( From c88ebe89270355d188770c74b39eb8acef1f3549 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 31 Oct 2024 12:35:54 +0100 Subject: [PATCH 0042/1352] introduce modxview linux plugin --- .../framework/plugins/linux/modxview.py | 195 ++++++++++++++++++ 1 file changed, 195 insertions(+) create mode 100644 volatility3/framework/plugins/linux/modxview.py diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py new file mode 100644 index 000000000..66b644164 --- /dev/null +++ b/volatility3/framework/plugins/linux/modxview.py @@ -0,0 +1,195 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List, Dict, Set, Iterator +from volatility3.plugins.linux import lsmod, check_modules, hidden_modules +from volatility3.framework import interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.constants import architectures + +vollog = logging.getLogger(__name__) + + +class Modxview(interfaces.plugins.PluginInterface): + """Centralize lsmod, check_modules and hidden_modules results to efficiently + spot modules presence and taints.""" + + _version = (1, 0, 0) + _required_framework_version = (2, 11, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.PluginRequirement( + name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + ), + requirements.PluginRequirement( + name="check_modules", + plugin=check_modules.Check_modules, + version=(0, 0, 0), + ), + requirements.PluginRequirement( + name="hidden_modules", + plugin=hidden_modules.Hidden_modules, + version=(1, 0, 0), + ), + requirements.BooleanRequirement( + name="plain_taints", + description="Display the plain taints string for each module.", + optional=True, + default=False, + ), + ] + + @classmethod + def run_lsmod( + cls, context: interfaces.context.ContextInterface, kernel_name: str + ) -> List[extensions.module]: + """Wrapper for the lsmod plugin.""" + return list(lsmod.Lsmod.list_modules(context, kernel_name)) + + @classmethod + def run_check_modules( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + ) -> List[extensions.module]: + """Wrapper for the check_modules plugin. + Here, we extract the /sys/module/ list.""" + kernel = context.modules[kernel_name] + sysfs_modules: dict = check_modules.Check_modules.get_kset_modules( + context, kernel_name + ) + + # Convert get_kset_modules() offsets back to module objects + return [ + kernel.object(object_type="module", offset=m_offset, absolute=True) + for m_offset in sysfs_modules.values() + ] + + @classmethod + def run_hidden_modules( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + known_modules_addresses: Set[int], + ) -> List[extensions.module]: + """Wrapper for the hidden_modules plugin.""" + modules_memory_boundaries = ( + hidden_modules.Hidden_modules.get_modules_memory_boundaries( + context, kernel_name + ) + ) + return list( + hidden_modules.Hidden_modules.get_hidden_modules( + context, + kernel_name, + known_modules_addresses, + modules_memory_boundaries, + ) + ) + + @classmethod + def flatten_run_modules_results( + cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True + ) -> Iterator[extensions.module]: + """Flatten a dictionary mapping plugin names and modules list, to a single merged list. + This is useful to get a generic lookup list of all the detected modules. + + Args: + run_results: dictionary of plugin names mapping a list of detected modules + deduplicate: remove duplicate modules, based on their offsets + + Returns: + Iterator of modules objects + """ + seen_addresses = set() + for modules in run_results.values(): + for module in modules: + if deduplicate and module.vol.offset in seen_addresses: + continue + yield module + + @classmethod + def run_modules_scanners( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + run_hidden_modules: bool = True, + ) -> Dict[str, List[extensions.module]]: + """Run module scanning plugins and aggregate the results. + + Args: + run_hidden_modules: specify if the hidden_modules plugin should be run + Returns: + Dictionary mapping each plugin to its corresponding result + """ + + kernel = context.modules[kernel_name] + run_results = {} + run_results["lsmod"] = cls.run_lsmod(context, kernel_name) + run_results["check_modules"] = cls.run_check_modules(context, kernel_name) + if run_hidden_modules: + known_module_addresses = set( + context.layers[kernel.layer_name].canonicalize(module.vol.offset) + for module in run_results["lsmod"] + run_results["check_modules"] + ) + run_results["hidden_modules"] = cls.run_hidden_modules( + context, kernel_name, known_module_addresses + ) + + return run_results + + def _generator(self): + kernel_name = self.config["kernel"] + run_results = self.run_modules_scanners(self.context, kernel_name) + modules_offsets = {} + for key in ["lsmod", "check_modules", "hidden_modules"]: + modules_offsets[key] = set(module.vol.offset for module in run_results[key]) + + seen_addresses = set() + for modules_list in run_results.values(): + for module in modules_list: + if module.vol.offset in seen_addresses: + continue + seen_addresses.add(module.vol.offset) + + if self.config.get("plain_taints"): + taints = module.get_taints_as_plain_string() + else: + taints = ",".join(module.get_taints_parsed()) + + yield ( + 0, + ( + module.get_name() or NotAvailableValue(), + format_hints.Hex(module.vol.offset), + module.vol.offset in modules_offsets["lsmod"], + module.vol.offset in modules_offsets["check_modules"], + module.vol.offset in modules_offsets["hidden_modules"], + taints or NotAvailableValue(), + ), + ) + + def run(self): + columns = [ + ("Name", str), + ("Address", format_hints.Hex), + ("In /proc/modules", bool), + ("In /sys/module/", bool), + ("Hidden", bool), + ("Taints", str), + ] + + return TreeGrid( + columns, + self._generator(), + ) From 9440f53429a1f9c7d77d51eeb75c2b5938da040f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 1 Nov 2024 15:05:25 +0100 Subject: [PATCH 0043/1352] use a dict of dataclasses for taint_flags --- .../framework/constants/linux/__init__.py | 112 +++++++----------- .../symbols/linux/extensions/__init__.py | 12 +- 2 files changed, 47 insertions(+), 77 deletions(-) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 9f25c9225..6cf8585f5 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -6,6 +6,7 @@ Linux-specific values that aren't found in debug symbols """ from enum import IntEnum, Flag +from dataclasses import dataclass KERNEL_NAME = "__kernel__" @@ -349,78 +350,47 @@ MODULE_MAXIMUM_CORE_TEXT_SIZE = 20000000 MODULE_MINIMUM_SIZE = 4096 +@dataclass +class TaintFlag: + shift: int + desc: str + when_present: bool + module: bool + + TAINT_FLAGS = { - "P": { - "shift": 1 << 0, - "desc": "PROPRIETARY_MODULE", - "when_present": True, - "module": True, - }, - "G": { - "shift": 1 << 0, - "desc": "PROPRIETARY_MODULE", - "when_present": False, - "module": True, - }, - "F": { - "shift": 1 << 1, - "desc": "FORCED_MODULE", - "when_present": True, - "module": False, - }, - # CPU_OUT_OF_SPEC was TAINT_UNSAFE_SMP on < 3.15-rc1 : https://lore.kernel.org/linux-kernel//20140303080432.GA25489@localhost/t/#:~:text=liked%20your%20proposal%3A-,%3E%20Right,-%2C%20I%20was%20about - "S": { - "shift": 1 << 2, - "desc": "CPU_OUT_OF_SPEC", - "when_present": True, - "module": False, - }, - "R": { - "shift": 1 << 3, - "desc": "FORCED_RMMOD", - "when_present": True, - "module": False, - }, - "M": { - "shift": 1 << 4, - "desc": "MACHINE_CHECK", - "when_present": True, - "module": False, - }, - "B": {"shift": 1 << 5, "desc": "BAD_PAGE", "when_present": True, "module": False}, - "U": {"shift": 1 << 6, "desc": "USER", "when_present": True, "module": False}, - "D": {"shift": 1 << 7, "desc": "DIE", "when_present": True, "module": False}, - "A": { - "shift": 1 << 8, - "desc": "OVERRIDDEN_ACPI_TABLE", - "when_present": True, - "module": False, - }, - "W": {"shift": 1 << 9, "desc": "WARN", "when_present": True, "module": False}, - "C": {"shift": 1 << 10, "desc": "CRAP", "when_present": True, "module": True}, - "I": { - "shift": 1 << 11, - "desc": "FIRMWARE_WORKAROUND", - "when_present": True, - "module": False, - }, - "O": {"shift": 1 << 12, "desc": "OOT_MODULE", "when_present": True, "module": True}, - "E": { - "shift": 1 << 13, - "desc": "UNSIGNED_MODULE", - "when_present": True, - "module": True, - }, - "L": { - "shift": 1 << 14, - "desc": "SOFTLOCKUP", - "when_present": True, - "module": False, - }, - "K": {"shift": 1 << 15, "desc": "LIVEPATCH", "when_present": True, "module": True}, - "X": {"shift": 1 << 16, "desc": "AUX", "when_present": True, "module": True}, - "T": {"shift": 1 << 17, "desc": "RANDSTRUCT", "when_present": True, "module": True}, - "N": {"shift": 1 << 18, "desc": "TEST", "when_present": True, "module": True}, + "P": TaintFlag( + shift=1 << 0, desc="PROPRIETARY_MODULE", when_present=True, module=True + ), + "G": TaintFlag( + shift=1 << 0, desc="PROPRIETARY_MODULE", when_present=False, module=True + ), + "F": TaintFlag(shift=1 << 1, desc="FORCED_MODULE", when_present=True, module=False), + "S": TaintFlag( + shift=1 << 2, desc="CPU_OUT_OF_SPEC", when_present=True, module=False + ), + "R": TaintFlag(shift=1 << 3, desc="FORCED_RMMOD", when_present=True, module=False), + "M": TaintFlag(shift=1 << 4, desc="MACHINE_CHECK", when_present=True, module=False), + "B": TaintFlag(shift=1 << 5, desc="BAD_PAGE", when_present=True, module=False), + "U": TaintFlag(shift=1 << 6, desc="USER", when_present=True, module=False), + "D": TaintFlag(shift=1 << 7, desc="DIE", when_present=True, module=False), + "A": TaintFlag( + shift=1 << 8, desc="OVERRIDDEN_ACPI_TABLE", when_present=True, module=False + ), + "W": TaintFlag(shift=1 << 9, desc="WARN", when_present=True, module=False), + "C": TaintFlag(shift=1 << 10, desc="CRAP", when_present=True, module=True), + "I": TaintFlag( + shift=1 << 11, desc="FIRMWARE_WORKAROUND", when_present=True, module=False + ), + "O": TaintFlag(shift=1 << 12, desc="OOT_MODULE", when_present=True, module=True), + "E": TaintFlag( + shift=1 << 13, desc="UNSIGNED_MODULE", when_present=True, module=True + ), + "L": TaintFlag(shift=1 << 14, desc="SOFTLOCKUP", when_present=True, module=False), + "K": TaintFlag(shift=1 << 15, desc="LIVEPATCH", when_present=True, module=True), + "X": TaintFlag(shift=1 << 16, desc="AUX", when_present=True, module=True), + "T": TaintFlag(shift=1 << 17, desc="RANDSTRUCT", when_present=True, module=True), + "N": TaintFlag(shift=1 << 18, desc="TEST", when_present=True, module=True), } """Flags used to taint kernel and modules, for debugging purposes. diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 89e2cde27..42c1a470d 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -287,8 +287,8 @@ class module(generic.GenericIntelProcess): The raw taints string. """ taints_string = "" - for char, infos in linux_constants.TAINT_FLAGS.items(): - if infos["module"] and self.taints_value & infos["shift"]: + for char, taint_flag in linux_constants.TAINT_FLAGS.items(): + if taint_flag.module and self.taints_value & taint_flag.shift: taints_string += char return taints_string @@ -342,11 +342,11 @@ class module(generic.GenericIntelProcess): """ comprehensive_taints = [] for c in self.get_taints_as_plain_string(): - infos = linux_constants.TAINT_FLAGS.get(c) - if not infos: + taint_flag = linux_constants.TAINT_FLAGS.get(c) + if not taint_flag: comprehensive_taints.append(f"") - elif infos["when_present"]: - comprehensive_taints.append(infos["desc"]) + elif taint_flag.when_present: + comprehensive_taints.append(taint_flag.desc) return comprehensive_taints From 9d08c4681ae1cf18ddf4bd53ff970f6a9bc26573 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 1 Nov 2024 15:07:23 +0100 Subject: [PATCH 0044/1352] add module offset to seen_addresses --- volatility3/framework/plugins/linux/modxview.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 66b644164..f44984926 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -116,6 +116,7 @@ class Modxview(interfaces.plugins.PluginInterface): for module in modules: if deduplicate and module.vol.offset in seen_addresses: continue + seen_addresses.add(module.vol.offset) yield module @classmethod From b209ea36a284ae1a75ba18222cbe8db1c1eede4f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 1 Nov 2024 15:12:52 +0100 Subject: [PATCH 0045/1352] remove slashes in columns --- volatility3/framework/plugins/linux/modxview.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index f44984926..d79f5e7a9 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -184,8 +184,8 @@ class Modxview(interfaces.plugins.PluginInterface): columns = [ ("Name", str), ("Address", format_hints.Hex), - ("In /proc/modules", bool), - ("In /sys/module/", bool), + ("In procfs", bool), + ("In sysfs", bool), ("Hidden", bool), ("Taints", str), ] From 512c1abe801b731f9f36551db51075d4d41413e1 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 4 Nov 2024 17:45:56 +1100 Subject: [PATCH 0046/1352] linux: VMCoreInfo plugin: Add VMCoreInfo API and its respective plugin --- .../framework/constants/linux/__init__.py | 6 ++ .../framework/plugins/linux/vmcoreinfo.py | 49 +++++++++ .../framework/symbols/linux/__init__.py | 102 +++++++++++++++++- 3 files changed, 156 insertions(+), 1 deletion(-) create mode 100644 volatility3/framework/plugins/linux/vmcoreinfo.py diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 7c485d3c3..dde256754 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -347,3 +347,9 @@ class PT_FLAGS(Flag): MODULE_MAXIMUM_CORE_SIZE = 20000000 MODULE_MAXIMUM_CORE_TEXT_SIZE = 20000000 MODULE_MINIMUM_SIZE = 4096 + +# VMCOREINFO +VMCOREINFO_MAGIC = b"VMCOREINFO\x00" +# Aligned to 4 bytes. See storenote() in kernels < 4.19 or append_kcore_note() in kernels >= 4.19 +VMCOREINFO_MAGIC_ALIGNED = VMCOREINFO_MAGIC + b"\x00" +OSRELEASE_TAG = b"OSRELEASE=" diff --git a/volatility3/framework/plugins/linux/vmcoreinfo.py b/volatility3/framework/plugins/linux/vmcoreinfo.py new file mode 100644 index 000000000..ea30520e3 --- /dev/null +++ b/volatility3/framework/plugins/linux/vmcoreinfo.py @@ -0,0 +1,49 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +from typing import List + +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.symbols import linux +from volatility3.framework.renderers import format_hints + + +class VMCoreInfo(plugins.PluginInterface): + """Enumerate VMCoreInfo tables""" + + _required_framework_version = (2, 11, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.TranslationLayerRequirement( + name="primary", description="Memory layer to scan" + ), + requirements.VersionRequirement( + name="VMCoreInfo", component=linux.VMCoreInfo, version=(1, 0, 0) + ), + ] + + def _generator(self): + layer_name = self.config["primary"] + for ( + vmcoreinfo_offset, + vmcoreinfo, + ) in linux.VMCoreInfo.search_vmcoreinfo_elf_note( + context=self.context, + layer_name=layer_name, + ): + for key, value in vmcoreinfo.items(): + yield 0, (format_hints.Hex(vmcoreinfo_offset), key, value) + + def run(self): + headers = [ + ("Offset", format_hints.Hex), + ("Key", str), + ("Value", str), + ] + return renderers.TreeGrid(headers, self._generator()) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 3289775b6..b0b6b7325 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -2,15 +2,18 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import math +import string import contextlib from abc import ABC, abstractmethod -from typing import Iterator, List, Tuple, Optional, Union +from typing import Iterator, List, Tuple, Optional, Union, Dict from volatility3 import framework from volatility3.framework import constants, exceptions, interfaces, objects from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux import extensions +from volatility3.framework.layers import scanners +from volatility3.framework.constants import linux as linux_constants class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): @@ -832,3 +835,100 @@ class PageCache(object): page = self.vmlinux.object("page", offset=page_addr, absolute=True) if page: yield page + + +class VMCoreInfo(interfaces.configuration.VersionableInterface): + _required_framework_version = (2, 11, 0) + + _version = (1, 0, 0) + + @staticmethod + def _vmcoreinfo_data_to_dict( + vmcoreinfo_data, + ) -> Optional[Dict[str, str]]: + """Converts the input VMCoreInfo data buffer into a dictionary""" + + # Ensure the whole buffer is printable + if not all(c in string.printable.encode() for c in vmcoreinfo_data): + # Abort, we are in the wrong place + return None + + vmcoreinfo_dict = dict() + for line in vmcoreinfo_data.decode().splitlines(): + if not line: + break + + key, value = line.split("=", 1) + vmcoreinfo_dict[key] = value + + return vmcoreinfo_dict + + @classmethod + def search_vmcoreinfo_elf_note( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + progress_callback: constants.ProgressCallback = None, + ) -> Iterator[Tuple[int, Dict[str, str]]]: + """Enumerates each VMCoreInfo ELF note table found in memory along with its offset. + + This approach is independent of any external ISF symbol or type, requiring only the + Elf64_Note found in 'elf.json', which is already included in the framework. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + layer_name: The layer within the context in which the module exists + progress_callback: A function that takes a percentage (and an optional description) that will be called periodically + + Yields: + Tuples with the VMCoreInfo ELF note offset and the VMCoreInfo table parsed in a dictionary. + """ + + elf_table_name = intermed.IntermediateSymbolTable.create( + context, "elf_symbol_table", "linux", "elf" + ) + module = context.module(elf_table_name, layer_name, 0) + layer = context.layers[layer_name] + + # Both Elf32_Note and Elf64_Note are of the same size + elf_note_size = context.symbol_space[elf_table_name].get_type("Elf64_Note").size + + for vmcoreinfo_offset in layer.scan( + scanner=scanners.BytesScanner(linux_constants.VMCOREINFO_MAGIC_ALIGNED), + context=context, + progress_callback=progress_callback, + ): + # vmcoreinfo_note kernels >= 2.6.24 fd59d231f81cb02870b9cf15f456a897f3669b4e + vmcoreinfo_elf_note_offset = vmcoreinfo_offset - elf_note_size + + # Elf32_Note and Elf64_Note are identical, so either can be used interchangeably here + elf_note = module.object( + object_type="Elf64_Note", + offset=vmcoreinfo_elf_note_offset, + absolute=True, + ) + + # Ensure that we are within an ELF note + if ( + elf_note.n_namesz != len(linux_constants.VMCOREINFO_MAGIC) + or elf_note.n_type != 0 + or elf_note.n_descsz == 0 + ): + continue + + vmcoreinfo_data_offset = vmcoreinfo_offset + len( + linux_constants.VMCOREINFO_MAGIC_ALIGNED + ) + + # Also, confirm this with the first tag, which has consistently been OSRELEASE + vmcoreinfo_data = layer.read(vmcoreinfo_data_offset, elf_note.n_descsz) + if not vmcoreinfo_data.startswith(linux_constants.OSRELEASE_TAG): + continue + + table = cls._vmcoreinfo_data_to_dict(vmcoreinfo_data) + if not table: + # Wrong VMCoreInfo note offset, keep trying + continue + + # A valid VMCoreInfo ELF note exists at 'vmcoreinfo_elf_note_offset' + yield vmcoreinfo_elf_note_offset, table From b4b78342763e743b25828bb6d684ba5e1be5f1d1 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 4 Nov 2024 17:47:57 +1100 Subject: [PATCH 0047/1352] linux: K/ASLR via VMCoreInfo --- volatility3/framework/automagic/linux.py | 108 ++++++++++++++++++++++- 1 file changed, 105 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 52a73f45a..fde060733 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -76,8 +76,12 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): isf_url=isf_path, ) context.symbol_space.append(table) + kaslr_shift, aslr_shift = cls.find_aslr( - context, table_name, layer_name, progress_callback=progress_callback + context, + table_name, + layer_name, + progress_callback=progress_callback, ) layer_class: Type = intel.Intel @@ -118,7 +122,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): return None @classmethod - def find_aslr( + def find_aslr_classic( cls, context: interfaces.context.ContextInterface, symbol_table: str, @@ -126,7 +130,17 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): progress_callback: constants.ProgressCallback = None, ) -> Tuple[int, int]: """Determines the offset of the actual DTB in physical space and its - symbol offset.""" + symbol offset. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + symbol_table: The name of the kernel module on which to operate + layer_name: The layer within the context in which the module exists + progress_callback: A function that takes a percentage (and an optional description) that will be called periodically + + Returns: + kaslr_shirt and aslr_shift + """ init_task_symbol = symbol_table + constants.BANG + "init_task" init_task_json_address = context.symbol_space.get_symbol( init_task_symbol @@ -184,6 +198,59 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): vollog.debug("Scanners could not determine any ASLR shifts, using 0 for both") return 0, 0 + @classmethod + def find_aslr_vmcoreinfo( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + progress_callback: constants.ProgressCallback = None, + ) -> Optional[Tuple[int, int]]: + """Determines the ASLR offsets using the VMCOREINFO ELF note + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + layer_name: The layer within the context in which the module exists + progress_callback: A function that takes a percentage (and an optional description) that will be called periodically + + Returns: + kaslr_shirt and aslr_shift + """ + + for ( + _vmcoreinfo_offset, + vmcoreinfo, + ) in linux.VMCoreInfo.search_vmcoreinfo_elf_note( + context=context, + layer_name=layer_name, + progress_callback=progress_callback, + ): + + phys_base_str = vmcoreinfo.get("NUMBER(phys_base)") + if phys_base_str is None: + # We are in kernel (x86) < 4.10 401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe where it was SYMBOL(phys_base) + # It's the symbol address instead of the value itself, which is useless for calculating the physical address. + # raise Exception("Kernel < 4.10") + continue + + kerneloffset_str = vmcoreinfo.get("KERNELOFFSET") + if kerneloffset_str is None: + # KERNELOFFSET: (x86) kernels < 3.13 b6085a865762236bb84934161273cdac6dd11c2d + continue + + aslr_shift = int(kerneloffset_str, 16) + kaslr_shift = int(phys_base_str) + aslr_shift + + vollog.debug( + "Linux ASLR shift values found in VMCOREINFO ELF note: physical 0x%x virtual 0x%x", + kaslr_shift, + aslr_shift, + ) + + return kaslr_shift, aslr_shift + + vollog.debug("The vmcoreinfo scanner could not determine any ASLR shifts") + return None + @classmethod def virtual_to_physical_address(cls, addr: int) -> int: """Converts a virtual linux address to a physical one (does not account @@ -192,6 +259,41 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): return addr - 0xFFFFFFFF80000000 return addr - 0xC0000000 + @classmethod + def find_aslr( + cls, + context: interfaces.context.ContextInterface, + symbol_table: str, + layer_name: str, + progress_callback: constants.ProgressCallback = None, + ) -> Tuple[int, int]: + """Determines the offset of the actual DTB in physical space and its + symbol offset. + Args: + context: The context to retrieve required elements (layers, symbol tables) from + symbol_table: The name of the kernel module on which to operate + layer_name: The layer within the context in which the module exists + progress_callback: A function that takes a percentage (and an optional description) that will be called periodically + + Returns: + kaslr_shirt and aslr_shift + """ + + aslr_shifts = cls.find_aslr_vmcoreinfo( + context, layer_name, progress_callback=progress_callback + ) + if aslr_shifts: + kaslr_shift, aslr_shift = aslr_shifts + else: + # Fallback to the traditional scanner method + kaslr_shift, aslr_shift = cls.find_aslr_classic( + context, + symbol_table, + layer_name, + progress_callback=progress_callback, + ) + return kaslr_shift, aslr_shift + class LinuxSymbolFinder(symbol_finder.SymbolFinder): """Linux symbol loader based on uname signature strings.""" From 6610779e5c070e7b3225b47cbb3a0980caa1881f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 4 Nov 2024 19:30:30 +1100 Subject: [PATCH 0048/1352] linux: VMCoreInfo: Remove debug comment --- volatility3/framework/automagic/linux.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index fde060733..248bbf04d 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -229,7 +229,6 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): if phys_base_str is None: # We are in kernel (x86) < 4.10 401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe where it was SYMBOL(phys_base) # It's the symbol address instead of the value itself, which is useless for calculating the physical address. - # raise Exception("Kernel < 4.10") continue kerneloffset_str = vmcoreinfo.get("KERNELOFFSET") From 0ad8054f125c360afadcd25db70c1f67d8265e57 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 7 Nov 2024 20:26:26 +1100 Subject: [PATCH 0049/1352] intel layer: minor improve lru_cache argument --- volatility3/framework/layers/intel.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 2b0df5372..33d5432cc 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -252,7 +252,7 @@ class Intel(linear.LinearlyMappedLayer): return entry, position - @functools.lru_cache(1025) + @functools.lru_cache(maxsize=1025) def _get_valid_table(self, base_address: int) -> Optional[bytes]: """Extracts the table, validates it and returns it if it's valid.""" table = self._context.layers.read( From 9ae7c2bb109681bbd8b6cffc5a1f5b7f1dfa71cf Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 7 Nov 2024 20:28:21 +1100 Subject: [PATCH 0050/1352] Data layer interface: Convert address_mask to a cached property --- volatility3/framework/interfaces/layers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py index e2a68780a..78687d8d5 100644 --- a/volatility3/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -136,7 +136,7 @@ class DataLayerInterface( def minimum_address(self) -> int: """Returns the minimum valid address of the space.""" - @property + @functools.cached_property def address_mask(self) -> int: """Returns a mask which encapsulates all the active bits of an address for this layer.""" From 73d4f2fc88e15ac038f962cb5f5b11acf7855091 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 7 Nov 2024 20:31:20 +1100 Subject: [PATCH 0051/1352] Linux: Add support for PROT_NONE, Intel Side Channel Vulnerability L1TF changes and fix _maxphyaddr in x86-64 --- volatility3/framework/automagic/linux.py | 6 +- .../framework/constants/linux/__init__.py | 8 ++ volatility3/framework/layers/intel.py | 100 ++++++++++++++++-- 3 files changed, 105 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 52a73f45a..27e07e564 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -80,14 +80,14 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): context, table_name, layer_name, progress_callback=progress_callback ) - layer_class: Type = intel.Intel if "init_top_pgt" in table.symbols: - layer_class = intel.Intel32e + layer_class = intel.LinuxIntel32e dtb_symbol_name = "init_top_pgt" elif "init_level4_pgt" in table.symbols: - layer_class = intel.Intel32e + layer_class = intel.LinuxIntel32e dtb_symbol_name = "init_level4_pgt" else: + layer_class = intel.LinuxIntel dtb_symbol_name = "swapper_pg_dir" dtb = cls.virtual_to_physical_address( diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 7c485d3c3..303c534ed 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -11,6 +11,14 @@ KERNEL_NAME = "__kernel__" """The value hard coded from the Linux Kernel (hence not extracted from the layer itself)""" +# Translation Layer constants +PAGE_BIT_PRESENT = 0 +PAGE_BIT_PSE = 7 # Page Size Extension: 4 MB (or 2MB) page +PAGE_BIT_PROTNONE = 8 +PAGE_BIT_PAT_LARGE = 12 # 2MB or 1GB pages +PAGE_PRESENT = 1 << PAGE_BIT_PRESENT +PAGE_PROTNONE = 1 << PAGE_BIT_PROTNONE + # include/linux/sched.h PF_KTHREAD = 0x00200000 # I'm a kernel thread diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 33d5432cc..e6d20d992 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -13,6 +13,7 @@ from volatility3 import classproperty from volatility3.framework import exceptions, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers import linear +from volatility3.framework.constants import linux as linux_constants vollog = logging.getLogger(__name__) @@ -163,12 +164,17 @@ class Intel(linear.LinearlyMappedLayer): entry, f"Page Fault at entry {hex(entry)} in page entry", ) - page = self._mask(entry, self._maxphyaddr - 1, position + 1) | self._mask( - offset, position, 0 - ) + + pfn = self.pte_pfn(entry) + page_offset = self._mask(offset, position, 0) + page = pfn << self.page_shift | page_offset return page, 1 << (position + 1), self._base_layer + def pte_pfn(self, entry: int) -> int: + """Extracts the page frame number (PFN) from the page table entry (PTE) entry""" + return entry >> self.page_shift + def _translate_entry(self, offset: int) -> Tuple[int, int]: """Translates a specific offset based on paging tables. @@ -203,10 +209,10 @@ class Intel(linear.LinearlyMappedLayer): "Page Fault at entry " + hex(entry) + " in table " + name, ) # Check if we're a large page - if large_page and (entry & (1 << 7)): + if large_page and (entry & (1 << linux_constants.PAGE_BIT_PSE)): # Mask off the PAT bit - if entry & (1 << 12): - entry -= 1 << 12 + if entry & (1 << linux_constants.PAGE_BIT_PAT_LARGE): + entry -= 1 << linux_constants.PAGE_BIT_PAT_LARGE # We're a large page, the rest is finished below # If we want to implement PSE-36, it would need to be done here break @@ -501,3 +507,85 @@ class WindowsIntel32e(WindowsMixin, Intel32e): def _translate(self, offset: int) -> Tuple[int, int, str]: return self._translate_swap(self, offset, self._bits_per_register // 2) + + +class LinuxMixin(Intel): + @functools.cached_property + def register_mask(self) -> int: + return (1 << self._bits_per_register) - 1 + + @functools.cached_property + def physical_mask(self) -> int: + # From kernels 4.18 the physical mask is dynamic: See AMD SME, Intel Multi-Key Total + # Memory Encryption and CONFIG_DYNAMIC_PHYSICAL_MASK: 94d49eb30e854c84d1319095b5dd0405a7da9362 + physical_mask = (1 << self._maxphyaddr) - 1 + # TODO: Come back once SME support is available in the framework + return physical_mask + + @functools.cached_property + def page_mask(self) -> int: + # Note that within the Intel class it's a class method. However, since it uses + # complement operations and we are working in Python, it would be more careful to + # limit it to the architecture's pointer size. + return ~(self.page_size - 1) & self.register_mask + + @functools.cached_property + def physical_page_mask(self) -> int: + return self.page_mask & self.physical_mask + + @functools.cached_property + def pte_pfn_mask(self) -> int: + return self.physical_page_mask + + @functools.cached_property + def pte_flags_mask(self) -> int: + return ~self.pte_pfn_mask & self.register_mask + + def pte_flags(self, pte) -> int: + return pte & self.pte_flags_mask + + def is_pte_present(self, entry: int) -> bool: + return ( + self.pte_flags(entry) + & (linux_constants.PAGE_PRESENT | linux_constants.PAGE_PROTNONE) + ) != 0 + + def _page_is_valid(self, entry: int) -> bool: + # Overrides the Intel static method with the Linux-specific implementation + return self.is_pte_present(entry) + + def pte_needs_invert(self, entry) -> bool: + # Entries that were set to PROT_NONE (PAGE_PRESENT/PAGE_GLOBAL) are inverted + return not (entry & linux_constants.PAGE_PRESENT) + + def protnone_mask(self, entry: int) -> int: + """Gets a mask to XOR with the page table entry to get the correct PFN""" + return ~0 & self.register_mask if self.pte_needs_invert(entry) else 0 + + def pte_pfn(self, entry: int) -> int: + """Extracts the page frame number from the page table entry""" + pfn = entry ^ self.protnone_mask(entry) + return (pfn & self.pte_pfn_mask) >> self.page_shift + + +class LinuxIntel(LinuxMixin, Intel): + pass + + +class LinuxIntelPAE(LinuxMixin, IntelPAE): + pass + + +class LinuxIntel32e(LinuxMixin, Intel32e): + # In the Linux kernel, the __PHYSICAL_MASK_SHIFT is a mask used to extract the + # physical address from a PTE. In Volatility3, this is referred to as _maxphyaddr. + # + # Until kernel version 4.17, Linux x86-64 used a 46-bit mask. With commit + # b83ce5ee91471d19c403ff91227204fb37c95fb2, this was extended to 52 bits, + # applying to both 4 and 5-level page tables. + # + # We initially used 52 bits for all Intel 64-bit systems, but this produced incorrect + # results for PROT_NONE pages. Since the mask value is defined by a preprocessor macro, + # it's difficult to detect the exact bit shift used in the current kernel. + # Using 46 bits has proven reliable for our use case, as seen in tools like crashtool. + _maxphyaddr = 46 From c7259037356fde4cf6120acddecbae4af16c9ea0 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 7 Nov 2024 18:08:58 +0100 Subject: [PATCH 0052/1352] introduce scatter-gather scatterlists --- .../framework/symbols/linux/__init__.py | 1 + .../symbols/linux/extensions/__init__.py | 104 ++++++++++++++++++ 2 files changed, 105 insertions(+) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 3289775b6..e8a3d5240 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -43,6 +43,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.optional_set_type_class("bpf_prog_aux", extensions.bpf_prog_aux) self.optional_set_type_class("kernel_cap_struct", extensions.kernel_cap_struct) self.optional_set_type_class("kernel_cap_t", extensions.kernel_cap_t) + self.optional_set_type_class("scatterlist", extensions.scatterlist) # kernels >= 4.18 self.optional_set_type_class("timespec64", extensions.timespec64) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index aa3e8c675..0dd657372 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2410,3 +2410,107 @@ class rb_root(objects.StructType): """ yield from self._walk_nodes(root_node=self.rb_node) + + +class scatterlist(objects.StructType): + SG_CHAIN = 0x01 + SG_END = 0x02 + SG_PAGE_LINK_MASK = SG_CHAIN | SG_END + + def _sg_flags(self) -> int: + return self.page_link & self.SG_PAGE_LINK_MASK + + def _sg_is_chain(self) -> int: + return self._sg_flags() & self.SG_CHAIN + + def _sg_is_last(self) -> int: + return self._sg_flags() & self.SG_END + + def _sg_chain_ptr(self) -> int: + """Clears the last two bits basically.""" + return self.page_link & ~self.SG_PAGE_LINK_MASK + + def _sg_dma_len(self) -> int: + # Depends on CONFIG_NEED_SG_DMA_LENGTH + if self.has_member("dma_length"): + return self.dma_length + return self.length + + def _get_sg_max_single_alloc(self) -> int: + """Based on kernel's SG_MAX_SINGLE_ALLOC. + + Doc. from kernel source : + * Maximum number of entries that will be allocated in one piece, if + * a list larger than this is required then chaining will be utilized. + """ + return self._context.layers[self.vol.layer_name].page_size // self.vol.size + + def _sg_next(self) -> interfaces.objects.ObjectInterface: + """Get the next scatterlist struct from the list. + Based on kernel's sg_next. + + Doc. from kernel source : + * Notes on SG table design. + * + * We use the unsigned long page_link field in the scatterlist struct to place + * the page pointer AND encode information about the sg table as well. The two + * lower bits are reserved for this information. + * + * If bit 0 is set, then the page_link contains a pointer to the next sg + * table list. Otherwise the next entry is at sg + 1. + * + * If bit 1 is set, then this sg entry is the last element in a list. + """ + if self._sg_is_last(): + return None + + if self._sg_is_chain(): + next_address = self._sg_chain_ptr() + else: + next_address = self.vol.offset + self.vol.size + + sg = self._context.object( + self.get_symbol_table_name() + constants.BANG + "scatterlist", + self.vol.layer_name, + next_address, + ) + return sg + + def for_each_sg(self) -> Iterator[interfaces.objects.ObjectInterface]: + """Iterate over each struct in the scatterlist.""" + sg = self + sg_max_single_alloc = self._get_sg_max_single_alloc() + + # Empty scatterlists protection + if sg.page_link == 0 and sg._sg_dma_len() == 0 and sg.dma_address == 0: + return None + else: + # Yield itself first + yield sg + + entries_count = 1 + # entries_count <= sg_max_single_alloc should always be true if the + # scatterlists were correctly chained. + while entries_count <= sg_max_single_alloc: + sg = sg._sg_next() + if sg is None: + break + # Points to a new scatterlist + elif sg._sg_is_chain(): + entries_count = 0 + else: + entries_count += 1 + yield sg + + def get_content( + self, + ) -> Iterator[bytes]: + """Traverse a scatterlist to gather content located at each + dma_address position. + + Returns: + An iterator of bytes + """ + physical_layer = self._context.layers["memory_layer"] + for sg in self.for_each_sg(): + yield from physical_layer.read(sg.dma_address, sg._sg_dma_len()) From 1fd51772600dc14ad6893e76362c9b8f599be180 Mon Sep 17 00:00:00 2001 From: lesander <4174509+lesander@users.noreply.github.com> Date: Fri, 8 Nov 2024 11:33:20 +0100 Subject: [PATCH 0053/1352] move dependency definitions to pyproject.toml and bump minimal cpython version to 3.9.0 since 3.8.0 is EOL. --- README.md | 48 +++++++++++++--------------------------- mypy.ini | 4 ---- pyproject.toml | 42 ++++++++++++++++++++++++++++++----- requirements-dev.txt | 9 -------- requirements-minimal.txt | 2 -- requirements.txt | 23 ------------------- setup.py | 24 -------------------- 7 files changed, 51 insertions(+), 101 deletions(-) delete mode 100644 mypy.ini delete mode 100644 requirements-dev.txt delete mode 100644 requirements-minimal.txt delete mode 100644 requirements.txt delete mode 100644 setup.py diff --git a/README.md b/README.md index 1463c2bde..78eb7c491 100644 --- a/README.md +++ b/README.md @@ -18,62 +18,44 @@ the Volatility Software License (VSL). See the [LICENSE](https://www.volatilityfoundation.org/license/vsl-v1.0) file for more details. -## Requirements +## Installing -Volatility 3 requires Python 3.8.0 or later. To install the most minimal set of dependencies (some plugins will not work) use a command such as: +Volatility 3 requires Python 3.9.0 or later and is published on the [PyPi registry](https://pypi.org/project/volatility3). ```shell -pip3 install -r requirements-minimal.txt +pip install volatility3 ``` -Alternately, the minimal packages will be installed automatically when Volatility 3 is installed using pip. However, as noted in the Quick Start section below, Volatility 3 does not *need* to be installed prior to using it. +If you want to use the latest development version of Volatility 3 we recommend you manually clone this repository and install an editable version of the project. +We recommend you use a virtual environment to keep installed dependencies separate from system packages. -```shell -pip3 install . -``` - -To enable the full range of Volatility 3 functionality, use a command like the one below. For partial functionality, comment out any unnecessary packages in [requirements.txt](requirements.txt) prior to running the command. - -```shell -pip3 install -r requirements.txt -``` - -## Downloading Volatility - -The latest stable version of Volatility will always be the stable branch of the GitHub repository. You can get the latest version of the code using the following command: +The latest stable version of Volatility will always be the `stable` branch of the GitHub repository. The default branch is `develop`. ```shell git clone https://github.com/volatilityfoundation/volatility3.git +cd volatility3/ +python3 -m venv venv && . venv/bin/activate +pip install -e .[dev] ``` ## Quick Start -1. Clone the latest version of Volatility from GitHub: - - ```shell - git clone https://github.com/volatilityfoundation/volatility3.git - ``` +1. Install Volatility 3 as documented in the Installing section of the readme. 2. See available options: ```shell - python3 vol.py -h + vol -h ``` -3. To get more information on a Windows memory sample and to make sure -Volatility supports that sample type, run -`python3 vol.py -f windows.info` - - Example: +3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `vol -f windows.info`: ```shell - python3 vol.py -f /home/user/samples/stuxnet.vmem windows.info + vol -f /home/user/samples/stuxnet.vmem windows.info ``` -4. Run some other plugins. The `-f` or `--single-location` is not strictly -required, but most plugins expect a single sample. Some also -require/accept other options. Run `python3 vol.py -h` -for more information on a particular command. +4. Run some other plugins. The `-f` or `--single-location` is not strictly required, but most plugins expect a single sample. +Some also require/accept other options. Run `vol -h` for more information on a particular command. ## Symbol Tables diff --git a/mypy.ini b/mypy.ini deleted file mode 100644 index 6fb9f9ed3..000000000 --- a/mypy.ini +++ /dev/null @@ -1,4 +0,0 @@ -[mypy] -mypy_path = ./stubs -show_traceback = True -ignore_missing_imports = True diff --git a/pyproject.toml b/pyproject.toml index 2e1636a43..91848e1fd 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,15 +6,39 @@ readme = "README.md" authors = [ { name = "Volatility Foundation", email = "volatility@volatilityfoundation.org" }, ] -requires-python = ">=3.8.0" +requires-python = ">=3.9.0" license = { text = "VSL" } dynamic = ["dependencies", "optional-dependencies", "version"] +dependencies = [ + "pefile>=2024.8.26", +] + +[project.optional-dependencies] +full = [ + "yara-python>=4.5.1,<5", + "capstone>=5.0.3,<6", + "pycryptodome>=3.21.0,<4", + "leechcorepyc>=2.19.2,<3; sys_platform != 'darwin'", +] + +cloud = [ + "gcsfs>=2024.10.0", + "s3fs>=2024.10.0", +] + +dev = [ + "volatility3[full,cloud]", + "jsonschema>=4.23.0,<5", + "pyinstaller>=6.11.0,<7", + "pyinstaller-hooks-contrib>=2024.9", +] + [project.urls] -Homepage = "https://github.com/volatilityfoundation/volatility3/" -"Bug Tracker" = "https://github.com/volatilityfoundation/volatility3/issues" -Documentation = "https://volatility3.readthedocs.io/" -"Source Code" = "https://github.com/volatilityfoundation/volatility3" +homepage = "https://github.com/volatilityfoundation/volatility3/" +documentation = "https://volatility3.readthedocs.io/" +repository = "https://github.com/volatilityfoundation/volatility3" +issues = "https://github.com/volatilityfoundation/volatility3/issues" [project.scripts] vol = "volatility3.cli:main" @@ -22,11 +46,17 @@ volshell = "volatility3.cli.volshell:main" [tool.setuptools.dynamic] version = { attr = "volatility3.framework.constants._version.PACKAGE_VERSION" } -dependencies = { file = "requirements-minimal.txt" } [tool.setuptools.packages.find] include = ["volatility3*"] +[tool.mypy] +mypy_path = "./stubs" +show_traceback = true + +[tool.mypy.overrides] +ignore_missing_imports = true + [build-system] requires = ["setuptools>=68"] build-backend = "setuptools.build_meta" diff --git a/requirements-dev.txt b/requirements-dev.txt deleted file mode 100644 index ae3482290..000000000 --- a/requirements-dev.txt +++ /dev/null @@ -1,9 +0,0 @@ --r requirements.txt - -# This can improve error messages regarding improperly configured ISF files, -# but is only recommended for development -jsonschema>=2.3.0 - -# Used to build executable file -pyinstaller>=6.5.0 -pyinstaller-hooks-contrib>=2024.3 \ No newline at end of file diff --git a/requirements-minimal.txt b/requirements-minimal.txt deleted file mode 100644 index c030b332d..000000000 --- a/requirements-minimal.txt +++ /dev/null @@ -1,2 +0,0 @@ -# These packages are required for core functionality. -pefile>=2023.2.7 #foo \ No newline at end of file diff --git a/requirements.txt b/requirements.txt deleted file mode 100644 index e0d366391..000000000 --- a/requirements.txt +++ /dev/null @@ -1,23 +0,0 @@ -# Include the minimal requirements --r requirements-minimal.txt - -# The following packages are optional. -# If certain packages are not necessary, place a comment (#) at the start of the line. - -# This is required for the yara plugins -yara-python>=3.8.0 - -# This is required for several plugins that perform malware analysis and disassemble code. -# It can also improve accuracy of Windows 8 and later memory samples. -# FIXME: Version 6.0.0 is incompatible (#1336) so we'll need an adaptor at some point -capstone>=3.0.5,<6.0.0 - -# This is required by plugins that decrypt passwords, password hashes, etc. -pycryptodome - -# This is required for memory acquisition via leechcore/pcileech. -leechcorepyc>=2.4.0; sys_platform != 'darwin' - -# This is required for memory analysis on a Amazon/MinIO S3 and Google Cloud object storage -gcsfs>=2023.1.0 -s3fs>=2023.1.0 diff --git a/setup.py b/setup.py deleted file mode 100644 index 3af033160..000000000 --- a/setup.py +++ /dev/null @@ -1,24 +0,0 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 -# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 -# - -import setuptools - - -def get_requires(filename): - requirements = [] - with open(filename, "r", encoding="utf-8") as fh: - for line in fh.readlines(): - stripped_line = line.strip() - if stripped_line == "" or stripped_line.startswith(("#", "-r")): - continue - requirements.append(stripped_line) - return requirements - - -setuptools.setup( - extras_require={ - "dev": get_requires("requirements-dev.txt"), - "full": get_requires("requirements.txt"), - }, -) From a04c04c4e3789008987ef18207ed242ff606ba1e Mon Sep 17 00:00:00 2001 From: lesander <4174509+lesander@users.noreply.github.com> Date: Fri, 8 Nov 2024 14:03:08 +0100 Subject: [PATCH 0054/1352] fix ci --- .github/workflows/install.yml | 6 +----- .github/workflows/test.yaml | 6 ++---- .readthedocs.yml | 5 ++++- MANIFEST.in | 2 +- doc/requirements.txt | 9 --------- pyproject.toml | 15 ++++++++++++++- test/README.md | 6 ++---- test/requirements-testing.txt | 11 ----------- 8 files changed, 24 insertions(+), 36 deletions(-) delete mode 100644 doc/requirements.txt delete mode 100644 test/requirements-testing.txt diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml index 398ff8ae3..9b9cbed4d 100644 --- a/.github/workflows/install.yml +++ b/.github/workflows/install.yml @@ -20,12 +20,8 @@ jobs: - name: Setup python-pip run: python -m pip install --upgrade pip - - name: Install dependencies - run: | - pip install -r requirements.txt - - name: Install volatility3 run: pip install . - name: Run volatility3 - run: vol --help \ No newline at end of file + run: vol --help diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 6358dd45d..930b68526 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -16,10 +16,8 @@ jobs: - name: Install dependencies run: | - python -m pip install --upgrade pip - pip install Cmake - pip install build - pip install -r ./test/requirements-testing.txt + python -m pip install --upgrade pip Cmake build + pip install .[test] - name: Build PyPi packages run: | diff --git a/.readthedocs.yml b/.readthedocs.yml index e7c2b25d5..628e79ebf 100644 --- a/.readthedocs.yml +++ b/.readthedocs.yml @@ -20,4 +20,7 @@ build: # Optionally set the version of Python and requirements required to build your docs python: install: - - requirements: doc/requirements.txt + - method: pip + path: . + extra_requirements: + - docs diff --git a/MANIFEST.in b/MANIFEST.in index 1cec729f6..863621381 100644 --- a/MANIFEST.in +++ b/MANIFEST.in @@ -1,6 +1,6 @@ prune development include * .* -include doc/make.bat doc/Makefile doc/requirements.txt +include pyproject.toml doc/make.bat doc/Makefile recursive-include doc/source * recursive-include volatility3 *.json recursive-exclude doc/source volatility3.*.rst diff --git a/doc/requirements.txt b/doc/requirements.txt deleted file mode 100644 index d3ba51224..000000000 --- a/doc/requirements.txt +++ /dev/null @@ -1,9 +0,0 @@ -# These packages are required for building the documentation. -sphinx>=4.0.0,<7 -sphinx_autodoc_typehints>=1.4.0 -sphinx-rtd-theme>=0.4.3 - -yara-python -yara-x -pycryptodome -pefile diff --git a/pyproject.toml b/pyproject.toml index 91848e1fd..a966e41b2 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -8,7 +8,7 @@ authors = [ ] requires-python = ">=3.9.0" license = { text = "VSL" } -dynamic = ["dependencies", "optional-dependencies", "version"] +dynamic = ["version"] dependencies = [ "pefile>=2024.8.26", @@ -34,6 +34,19 @@ dev = [ "pyinstaller-hooks-contrib>=2024.9", ] +test = [ + "volatility3[dev]", + "pytest>=8.3.3,<9", + "yara-x>=0.10.0,<1", +] + +docs = [ + "volatility3[dev]", + "sphinx>=8.0.0,<7", + "sphinx-autodoc-typehints>=2.5.0,<3", + "sphinx-rtd-theme>=3.0.1,<4", +] + [project.urls] homepage = "https://github.com/volatilityfoundation/volatility3/" documentation = "https://volatility3.readthedocs.io/" diff --git a/test/README.md b/test/README.md index dcbe289b0..5891d9508 100644 --- a/test/README.md +++ b/test/README.md @@ -2,14 +2,12 @@ ## Requirements -The Volatility 3 Testing Framework requires the same version of Python as Volatility3 itself. To install the current set of dependencies that the framework requires, use a command like this: +The Volatility 3 Testing Framework requires the same version of Python as Volatility 3 itself. To install the current set of dependencies that the framework requires, use a command like this: ```shell -pip3 install -r requirements-testing.txt +pip3 install -e .[test] ``` -NOTE: `requirements-testing.txt` can be found in this current `test/` directory. - ## Quick Start: Manual Testing 1. To test Volatility 3 on an image, first download one with a command such as: diff --git a/test/requirements-testing.txt b/test/requirements-testing.txt deleted file mode 100644 index 51c8f602c..000000000 --- a/test/requirements-testing.txt +++ /dev/null @@ -1,11 +0,0 @@ -# These packages are required for core functionality. -pefile>=2017.8.1 #foo - -# The following packages are optional. -# If certain packages are not necessary, place a comment (#) at the start of the line. - -# This is required for the yara plugins -yara-python>=3.8.0 -yara-x>=0.5.0 - -pytest>=7.0.0 From b739f8d067c024f84087bfdc2443b174cf559462 Mon Sep 17 00:00:00 2001 From: lesander <4174509+lesander@users.noreply.github.com> Date: Fri, 8 Nov 2024 14:05:54 +0100 Subject: [PATCH 0055/1352] revert 3.8 to 3.9 soft bump --- README.md | 2 +- pyproject.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 78eb7c491..cc33d3cc4 100644 --- a/README.md +++ b/README.md @@ -20,7 +20,7 @@ more details. ## Installing -Volatility 3 requires Python 3.9.0 or later and is published on the [PyPi registry](https://pypi.org/project/volatility3). +Volatility 3 requires Python 3.8.0 or later and is published on the [PyPi registry](https://pypi.org/project/volatility3). ```shell pip install volatility3 diff --git a/pyproject.toml b/pyproject.toml index a966e41b2..fc1ab96cb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -6,7 +6,7 @@ readme = "README.md" authors = [ { name = "Volatility Foundation", email = "volatility@volatilityfoundation.org" }, ] -requires-python = ">=3.9.0" +requires-python = ">=3.8.0" license = { text = "VSL" } dynamic = ["version"] From 8f33aaf5b4ee859b12ca35347144597bec59ee1b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 8 Nov 2024 17:45:53 +0100 Subject: [PATCH 0056/1352] Optional type hints --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 0dd657372..e5a074a49 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2445,7 +2445,7 @@ class scatterlist(objects.StructType): """ return self._context.layers[self.vol.layer_name].page_size // self.vol.size - def _sg_next(self) -> interfaces.objects.ObjectInterface: + def _sg_next(self) -> Optional[interfaces.objects.ObjectInterface]: """Get the next scatterlist struct from the list. Based on kernel's sg_next. @@ -2476,7 +2476,7 @@ class scatterlist(objects.StructType): ) return sg - def for_each_sg(self) -> Iterator[interfaces.objects.ObjectInterface]: + def for_each_sg(self) -> Optional[Iterator[interfaces.objects.ObjectInterface]]: """Iterate over each struct in the scatterlist.""" sg = self sg_max_single_alloc = self._get_sg_max_single_alloc() @@ -2504,7 +2504,7 @@ class scatterlist(objects.StructType): def get_content( self, - ) -> Iterator[bytes]: + ) -> Optional[Iterator[bytes]]: """Traverse a scatterlist to gather content located at each dma_address position. From 485ef894e113cf68eb1acaef3c679b675639281d Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 8 Nov 2024 17:49:08 +0100 Subject: [PATCH 0057/1352] remove taints_value overload attr --- .../framework/symbols/linux/extensions/__init__.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 42c1a470d..f9f72c161 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -288,7 +288,7 @@ class module(generic.GenericIntelProcess): """ taints_string = "" for char, taint_flag in linux_constants.TAINT_FLAGS.items(): - if taint_flag.module and self.taints_value & taint_flag.shift: + if taint_flag.module and self.taints & taint_flag.shift: taints_string += char return taints_string @@ -310,7 +310,7 @@ class module(generic.GenericIntelProcess): for i, taint_flag in enumerate(self.taint_flags_list): c_true = chr(taint_flag.c_true) c_false = chr(taint_flag.c_false) - if taint_flag.module and (self.taints_value & (1 << i)): + if taint_flag.module and (self.taints & (1 << i)): taints_string += c_true elif taint_flag.module and c_false != " ": taints_string += c_false @@ -378,10 +378,6 @@ class module(generic.GenericIntelProcess): return self.strtab raise AttributeError("module -> strtab: Unable to get strtab") - @property - def taints_value(self) -> int: - return self.taints - @property def taint_flags_list(self) -> Optional[List[interfaces.objects.ObjectInterface]]: kernel = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) From dd3542b127b751ad083c91be4e8ffd373a1c74f7 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 8 Nov 2024 17:51:48 +0100 Subject: [PATCH 0058/1352] explicit loop iterator --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index f9f72c161..402f8c9c6 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -341,10 +341,10 @@ class module(generic.GenericIntelProcess): - module_flags_taint kernel function """ comprehensive_taints = [] - for c in self.get_taints_as_plain_string(): - taint_flag = linux_constants.TAINT_FLAGS.get(c) + for character in self.get_taints_as_plain_string(): + taint_flag = linux_constants.TAINT_FLAGS.get(character) if not taint_flag: - comprehensive_taints.append(f"") + comprehensive_taints.append(f"") elif taint_flag.when_present: comprehensive_taints.append(taint_flag.desc) From 05e8f8ff1075adbb398076a7d91701ba256b8d8a Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 13 Nov 2024 12:20:03 +1100 Subject: [PATCH 0059/1352] intel layer: Move constants to the Intel class --- .../framework/constants/linux/__init__.py | 8 ------- volatility3/framework/layers/intel.py | 24 ++++++++++++------- 2 files changed, 15 insertions(+), 17 deletions(-) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 303c534ed..7c485d3c3 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -11,14 +11,6 @@ KERNEL_NAME = "__kernel__" """The value hard coded from the Linux Kernel (hence not extracted from the layer itself)""" -# Translation Layer constants -PAGE_BIT_PRESENT = 0 -PAGE_BIT_PSE = 7 # Page Size Extension: 4 MB (or 2MB) page -PAGE_BIT_PROTNONE = 8 -PAGE_BIT_PAT_LARGE = 12 # 2MB or 1GB pages -PAGE_PRESENT = 1 << PAGE_BIT_PRESENT -PAGE_PROTNONE = 1 << PAGE_BIT_PROTNONE - # include/linux/sched.h PF_KTHREAD = 0x00200000 # I'm a kernel thread diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index e6d20d992..25a98fc21 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -13,7 +13,6 @@ from volatility3 import classproperty from volatility3.framework import exceptions, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers import linear -from volatility3.framework.constants import linux as linux_constants vollog = logging.getLogger(__name__) @@ -23,6 +22,16 @@ INTEL_TRANSLATION_DEBUGGING = False class Intel(linear.LinearlyMappedLayer): """Translation Layer for the Intel IA32 memory mapping.""" + _PAGE_BIT_PRESENT = 0 + _PAGE_BIT_PSE = 7 # Page Size Extension: 4 MB (or 2MB) page + _PAGE_BIT_PROTNONE = 8 + _PAGE_BIT_PAT_LARGE = 12 # 2MB or 1GB pages + + _PAGE_PRESENT = 1 << _PAGE_BIT_PRESENT + _PAGE_PSE = 1 << _PAGE_BIT_PSE + _PAGE_PROTNONE = 1 << _PAGE_BIT_PROTNONE + _PAGE_PAT_LARGE = 1 << _PAGE_BIT_PAT_LARGE + _entry_format = " bool: - return ( - self.pte_flags(entry) - & (linux_constants.PAGE_PRESENT | linux_constants.PAGE_PROTNONE) - ) != 0 + return (self.pte_flags(entry) & (self._PAGE_PRESENT | self._PAGE_PROTNONE)) != 0 def _page_is_valid(self, entry: int) -> bool: # Overrides the Intel static method with the Linux-specific implementation @@ -556,7 +562,7 @@ class LinuxMixin(Intel): def pte_needs_invert(self, entry) -> bool: # Entries that were set to PROT_NONE (PAGE_PRESENT/PAGE_GLOBAL) are inverted - return not (entry & linux_constants.PAGE_PRESENT) + return not (entry & self._PAGE_PRESENT) def protnone_mask(self, entry: int) -> int: """Gets a mask to XOR with the page table entry to get the correct PFN""" From 36c19aa6d91b561ab57db34eb6c6a2ba7bbe2316 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 13 Nov 2024 12:21:03 +1100 Subject: [PATCH 0060/1352] core: Bump framework minor version --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index ce803a687..55ef19e4b 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 11 # Number of changes that only add to the interface +VERSION_MINOR = 12 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From 173e35105a6fc614e0ae329331e8e21e63f52f14 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 13 Nov 2024 12:30:11 +1100 Subject: [PATCH 0061/1352] LinuxMixin: Make new methods internal --- volatility3/framework/layers/intel.py | 46 ++++++++++++++------------- 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 25a98fc21..dc88c20bf 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -174,13 +174,13 @@ class Intel(linear.LinearlyMappedLayer): f"Page Fault at entry {hex(entry)} in page entry", ) - pfn = self.pte_pfn(entry) + pfn = self._pte_pfn(entry) page_offset = self._mask(offset, position, 0) page = pfn << self.page_shift | page_offset return page, 1 << (position + 1), self._base_layer - def pte_pfn(self, entry: int) -> int: + def _pte_pfn(self, entry: int) -> int: """Extracts the page frame number (PFN) from the page table entry (PTE) entry""" return entry >> self.page_shift @@ -520,11 +520,11 @@ class WindowsIntel32e(WindowsMixin, Intel32e): class LinuxMixin(Intel): @functools.cached_property - def register_mask(self) -> int: + def _register_mask(self) -> int: return (1 << self._bits_per_register) - 1 @functools.cached_property - def physical_mask(self) -> int: + def _physical_mask(self) -> int: # From kernels 4.18 the physical mask is dynamic: See AMD SME, Intel Multi-Key Total # Memory Encryption and CONFIG_DYNAMIC_PHYSICAL_MASK: 94d49eb30e854c84d1319095b5dd0405a7da9362 physical_mask = (1 << self._maxphyaddr) - 1 @@ -536,42 +536,44 @@ class LinuxMixin(Intel): # Note that within the Intel class it's a class method. However, since it uses # complement operations and we are working in Python, it would be more careful to # limit it to the architecture's pointer size. - return ~(self.page_size - 1) & self.register_mask + return ~(self.page_size - 1) & self._register_mask @functools.cached_property - def physical_page_mask(self) -> int: - return self.page_mask & self.physical_mask + def _physical_page_mask(self) -> int: + return self.page_mask & self._physical_mask @functools.cached_property - def pte_pfn_mask(self) -> int: - return self.physical_page_mask + def _pte_pfn_mask(self) -> int: + return self._physical_page_mask @functools.cached_property - def pte_flags_mask(self) -> int: - return ~self.pte_pfn_mask & self.register_mask + def _pte_flags_mask(self) -> int: + return ~self._pte_pfn_mask & self._register_mask - def pte_flags(self, pte) -> int: - return pte & self.pte_flags_mask + def _pte_flags(self, pte) -> int: + return pte & self._pte_flags_mask - def is_pte_present(self, entry: int) -> bool: - return (self.pte_flags(entry) & (self._PAGE_PRESENT | self._PAGE_PROTNONE)) != 0 + def _is_pte_present(self, entry: int) -> bool: + return ( + self._pte_flags(entry) & (self._PAGE_PRESENT | self._PAGE_PROTNONE) + ) != 0 def _page_is_valid(self, entry: int) -> bool: # Overrides the Intel static method with the Linux-specific implementation - return self.is_pte_present(entry) + return self._is_pte_present(entry) - def pte_needs_invert(self, entry) -> bool: + def _pte_needs_invert(self, entry) -> bool: # Entries that were set to PROT_NONE (PAGE_PRESENT/PAGE_GLOBAL) are inverted return not (entry & self._PAGE_PRESENT) - def protnone_mask(self, entry: int) -> int: + def _protnone_mask(self, entry: int) -> int: """Gets a mask to XOR with the page table entry to get the correct PFN""" - return ~0 & self.register_mask if self.pte_needs_invert(entry) else 0 + return ~0 & self._register_mask if self._pte_needs_invert(entry) else 0 - def pte_pfn(self, entry: int) -> int: + def _pte_pfn(self, entry: int) -> int: """Extracts the page frame number from the page table entry""" - pfn = entry ^ self.protnone_mask(entry) - return (pfn & self.pte_pfn_mask) >> self.page_shift + pfn = entry ^ self._protnone_mask(entry) + return (pfn & self._pte_pfn_mask) >> self.page_shift class LinuxIntel(LinuxMixin, Intel): From 5ab97564ac025978ab3baebe143a259111d6fbd3 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 14 Nov 2024 16:37:05 +1100 Subject: [PATCH 0062/1352] linux: intel VMCoreInfo: Move to its own stacker... Maximize use of VMCOREINFO data without reliance on ISF symbols: - Obtain the DTB - Utilize OSRELEASE (the same as UTS_RELEASE used in the Linux banner and init_uts_ns/new_utsname) to prefilter the list of Linux banners, reducing search time for linux_banner in memory. - Find the correct layer using the VMCOREINFO data (including 32bit PAE). --- volatility3/framework/automagic/linux.py | 302 ++++++++++++++++------- 1 file changed, 212 insertions(+), 90 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 248bbf04d..f877d1cd0 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -122,7 +122,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): return None @classmethod - def find_aslr_classic( + def find_aslr( cls, context: interfaces.context.ContextInterface, symbol_table: str, @@ -198,101 +198,14 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): vollog.debug("Scanners could not determine any ASLR shifts, using 0 for both") return 0, 0 - @classmethod - def find_aslr_vmcoreinfo( - cls, - context: interfaces.context.ContextInterface, - layer_name: str, - progress_callback: constants.ProgressCallback = None, - ) -> Optional[Tuple[int, int]]: - """Determines the ASLR offsets using the VMCOREINFO ELF note - - Args: - context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The layer within the context in which the module exists - progress_callback: A function that takes a percentage (and an optional description) that will be called periodically - - Returns: - kaslr_shirt and aslr_shift - """ - - for ( - _vmcoreinfo_offset, - vmcoreinfo, - ) in linux.VMCoreInfo.search_vmcoreinfo_elf_note( - context=context, - layer_name=layer_name, - progress_callback=progress_callback, - ): - - phys_base_str = vmcoreinfo.get("NUMBER(phys_base)") - if phys_base_str is None: - # We are in kernel (x86) < 4.10 401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe where it was SYMBOL(phys_base) - # It's the symbol address instead of the value itself, which is useless for calculating the physical address. - continue - - kerneloffset_str = vmcoreinfo.get("KERNELOFFSET") - if kerneloffset_str is None: - # KERNELOFFSET: (x86) kernels < 3.13 b6085a865762236bb84934161273cdac6dd11c2d - continue - - aslr_shift = int(kerneloffset_str, 16) - kaslr_shift = int(phys_base_str) + aslr_shift - - vollog.debug( - "Linux ASLR shift values found in VMCOREINFO ELF note: physical 0x%x virtual 0x%x", - kaslr_shift, - aslr_shift, - ) - - return kaslr_shift, aslr_shift - - vollog.debug("The vmcoreinfo scanner could not determine any ASLR shifts") - return None - - @classmethod - def virtual_to_physical_address(cls, addr: int) -> int: + @staticmethod + def virtual_to_physical_address(addr: int) -> int: """Converts a virtual linux address to a physical one (does not account of ASLR)""" if addr > 0xFFFFFFFF80000000: return addr - 0xFFFFFFFF80000000 return addr - 0xC0000000 - @classmethod - def find_aslr( - cls, - context: interfaces.context.ContextInterface, - symbol_table: str, - layer_name: str, - progress_callback: constants.ProgressCallback = None, - ) -> Tuple[int, int]: - """Determines the offset of the actual DTB in physical space and its - symbol offset. - Args: - context: The context to retrieve required elements (layers, symbol tables) from - symbol_table: The name of the kernel module on which to operate - layer_name: The layer within the context in which the module exists - progress_callback: A function that takes a percentage (and an optional description) that will be called periodically - - Returns: - kaslr_shirt and aslr_shift - """ - - aslr_shifts = cls.find_aslr_vmcoreinfo( - context, layer_name, progress_callback=progress_callback - ) - if aslr_shifts: - kaslr_shift, aslr_shift = aslr_shifts - else: - # Fallback to the traditional scanner method - kaslr_shift, aslr_shift = cls.find_aslr_classic( - context, - symbol_table, - layer_name, - progress_callback=progress_callback, - ) - return kaslr_shift, aslr_shift - class LinuxSymbolFinder(symbol_finder.SymbolFinder): """Linux symbol loader based on uname signature strings.""" @@ -302,3 +215,212 @@ class LinuxSymbolFinder(symbol_finder.SymbolFinder): symbol_class = "volatility3.framework.symbols.linux.LinuxKernelIntermedSymbols" find_aslr = lambda cls, *args: LinuxIntelStacker.find_aslr(*args)[1] exclusion_list = ["mac", "windows"] + + +class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): + stack_order = 34 + exclusion_list = ["mac", "windows"] + + @staticmethod + def _check_versions() -> bool: + """Verify the versions of the required modules""" + + # Check SQlite cache version + sqlitecache_version_required = (1, 0, 0) + if not requirements.VersionRequirement.matches_required( + sqlitecache_version_required, symbol_cache.SqliteCache.version + ): + vollog.info( + "SQLiteCache version not suitable: required %s found %s", + sqlitecache_version_required, + symbol_cache.SqliteCache.version, + ) + return False + + # Check VMCOREINFO API version + vmcoreinfo_version_required = (1, 0, 0) + if not requirements.VersionRequirement.matches_required( + vmcoreinfo_version_required, linux.VMCoreInfo._version + ): + vollog.info( + "VMCOREINFO version not suitable: required %s found %s", + vmcoreinfo_version_required, + linux.VMCoreInfo._version, + ) + return False + + return True + + @classmethod + def stack( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + progress_callback: constants.ProgressCallback = None, + ) -> Optional[interfaces.layers.DataLayerInterface]: + """Attempts to identify linux within this layer.""" + + # Verify the versions of the required modules + if not cls._check_versions(): + return None + + # Bail out by default unless we can stack properly + layer = context.layers[layer_name] + + # Never stack on top of an intel layer + # FIXME: Find a way to improve this check + if isinstance(layer, intel.Intel): + return None + + identifiers_path = os.path.join( + constants.CACHE_PATH, constants.IDENTIFIERS_FILENAME + ) + sqlite_cache = symbol_cache.SqliteCache(identifiers_path) + linux_banners = sqlite_cache.get_identifier_dictionary(operating_system="linux") + if not linux_banners: + # If we have no banners, don't bother scanning + vollog.info( + "No Linux banners found - if this is a linux plugin, please check your " + "symbol files location" + ) + return None + + vmcoreinfo_elf_notes_iter = linux.VMCoreInfo.search_vmcoreinfo_elf_note( + context=context, + layer_name=layer_name, + progress_callback=progress_callback, + ) + + # Iterate through each VMCOREINFO ELF note found, using the first one that is valid. + for _vmcoreinfo_offset, vmcoreinfo in vmcoreinfo_elf_notes_iter: + shifts = cls._vmcoreinfo_find_aslr(vmcoreinfo) + if not shifts: + # Let's try the next vmcoreinfo, in case this one isn't correct. + continue + + kaslr_shift, aslr_shift = shifts + + dtb = cls._vmcoreinfo_get_dtb(vmcoreinfo, aslr_shift, kaslr_shift) + + is_32bit, is_pae = cls._vmcoreinfo_is_32bit(vmcoreinfo) + if is_32bit: + layer_class = intel.IntelPAE if is_pae else intel.Intel + else: + layer_class = intel.Intel32e + + uts_release = vmcoreinfo["OSRELEASE"] + + # See how linux_banner constant is built in the linux kernel + linux_version_prefix = f"Linux version {uts_release} (".encode() + valid_banners = [ + x for x in linux_banners if x and x.startswith(linux_version_prefix) + ] + if not valid_banners: + # There's no banner matching this VMCOREINFO, keep trying with the next one + continue + + join = interfaces.configuration.path_join + mss = scanners.MultiStringScanner(valid_banners) + for _, banner in layer.scan( + context=context, scanner=mss, progress_callback=progress_callback + ): + isf_path = linux_banners.get(banner, None) + if not isf_path: + vollog.warning( + "Identified banner %r, but no matching ISF is available.", + banner, + ) + continue + + vollog.debug("Identified banner: %r", banner) + table_name = context.symbol_space.free_table_name("LintelStacker") + table = linux.LinuxKernelIntermedSymbols( + context, + f"temporary.{table_name}", + name=table_name, + isf_url=isf_path, + ) + context.symbol_space.append(table) + + # Build the new layer + new_layer_name = context.layers.free_layer_name("IntelLayer") + config_path = join("IntelHelper", new_layer_name) + kernel_banner = LinuxSymbolFinder.banner_config_key + banner_str = banner.decode(encoding="latin-1") + context.config[join(config_path, "memory_layer")] = layer_name + context.config[join(config_path, "page_map_offset")] = dtb + context.config[join(config_path, kernel_banner)] = banner_str + layer = layer_class( + context, + config_path=config_path, + name=new_layer_name, + metadata={"os": "Linux"}, + ) + layer.config["kernel_virtual_offset"] = aslr_shift + + if layer and dtb: + vollog.debug( + "Values found in VMCOREINFO: KASLR=0x%x, ASLR=0x%x, DTB=0x%x", + kaslr_shift, + aslr_shift, + dtb, + ) + + return layer + + vollog.debug("No suitable linux banner could be matched") + return None + + @staticmethod + def _vmcoreinfo_find_aslr(vmcoreinfo) -> Tuple[int, int]: + phys_base_str = vmcoreinfo.get("NUMBER(phys_base)") + if phys_base_str is None: + # In kernel < 4.10, there may be a SYMBOL(phys_base), but as noted in the + # c401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe commit comment, this value + # isn't useful for calculating the physical address. + # There's nothing we can do here, so let's try with the next VMCOREINFO or + # the next Stacker. + return None + + # kernels 3.14 (b6085a865762236bb84934161273cdac6dd11c2d) KERNELOFFSET was added + kerneloffset_str = vmcoreinfo.get("KERNELOFFSET") + if kerneloffset_str is None: + # kernels < 3.14 if KERNELOFFSET is missing, KASLR might not be implemented. + # Oddly, NUMBER(phys_base) is present without it. To be safe, proceed only + # if both are present. + return None + + aslr_shift = int(kerneloffset_str, 16) + kaslr_shift = int(phys_base_str) + aslr_shift + + return kaslr_shift, aslr_shift + + @staticmethod + def _vmcoreinfo_get_dtb(vmcoreinfo, aslr_shift, kaslr_shift) -> int: + """Returns the page global directory address physical (a.k.a DTB or PGD)""" + # In x86-64, since kernels 2.5.22 swapper_pg_dir is a macro to the respective pgd. + # First, in e3ebadd95cb621e2c7436f3d3646447ac9d5c16d to init_level4_pgt, and later + # in kernels 4.13 in 65ade2f872b474fa8a04c2d397783350326634e6) to init_top_pgt. + # In x86-32, the pgd is swapper_pg_dir. So, in any case, for VMCOREINFO + # SYMBOL(swapper_pg_dir) will always have the right value. + dtb_vaddr = int(vmcoreinfo["SYMBOL(swapper_pg_dir)"], 16) + dtb_paddr = ( + LinuxIntelStacker.virtual_to_physical_address(dtb_vaddr) + - aslr_shift + + kaslr_shift + ) + + return dtb_paddr + + @staticmethod + def _vmcoreinfo_is_32bit(vmcoreinfo) -> Tuple[bool, bool]: + """Returns a tuple of booleans with is_32bit and is_pae values""" + is_pae = vmcoreinfo.get("CONFIG_X86_PAE", "n") == "y" + if is_pae: + is_32bit = True + else: + # Check the swapper_pg_dir virtual address size + dtb_vaddr = int(vmcoreinfo["SYMBOL(swapper_pg_dir)"], 16) + is_32bit = dtb_vaddr <= 2**32 + + return is_32bit, is_pae From 00b528aafe4205946e2b1ce11b4a203eaf467ec2 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 14 Nov 2024 18:57:26 +1100 Subject: [PATCH 0063/1352] linux: intel VMCoreInfo: Fix docstring typo --- volatility3/framework/automagic/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index f877d1cd0..556a02c1f 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -397,7 +397,7 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): @staticmethod def _vmcoreinfo_get_dtb(vmcoreinfo, aslr_shift, kaslr_shift) -> int: - """Returns the page global directory address physical (a.k.a DTB or PGD)""" + """Returns the page global directory physical address (a.k.a DTB or PGD)""" # In x86-64, since kernels 2.5.22 swapper_pg_dir is a macro to the respective pgd. # First, in e3ebadd95cb621e2c7436f3d3646447ac9d5c16d to init_level4_pgt, and later # in kernels 4.13 in 65ade2f872b474fa8a04c2d397783350326634e6) to init_top_pgt. From 41a93473e987bb43bca8e8095dddd890a1a1b351 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 14 Nov 2024 19:35:47 +1100 Subject: [PATCH 0064/1352] linux: intel VMCoreInfo: Improve layer config code --- volatility3/framework/automagic/linux.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 556a02c1f..c92fa05c4 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -347,16 +347,16 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): config_path = join("IntelHelper", new_layer_name) kernel_banner = LinuxSymbolFinder.banner_config_key banner_str = banner.decode(encoding="latin-1") + context.config[join(config_path, kernel_banner)] = banner_str context.config[join(config_path, "memory_layer")] = layer_name context.config[join(config_path, "page_map_offset")] = dtb - context.config[join(config_path, kernel_banner)] = banner_str + context.config[join(config_path, "kernel_virtual_offset")] = aslr_shift layer = layer_class( context, config_path=config_path, name=new_layer_name, metadata={"os": "Linux"}, ) - layer.config["kernel_virtual_offset"] = aslr_shift if layer and dtb: vollog.debug( From b802b16c62ff5a50ea2dbc659450dc6d1fd5e83e Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 15 Nov 2024 13:03:36 +0000 Subject: [PATCH 0065/1352] Add first version of regex scanning plugins --- .../framework/plugins/linux/vmaregexscan.py | 127 +++++++++++++++++ volatility3/framework/plugins/regexscan.py | 77 +++++++++++ .../framework/plugins/windows/vadregexscan.py | 128 ++++++++++++++++++ 3 files changed, 332 insertions(+) create mode 100644 volatility3/framework/plugins/linux/vmaregexscan.py create mode 100644 volatility3/framework/plugins/regexscan.py create mode 100644 volatility3/framework/plugins/windows/vadregexscan.py diff --git a/volatility3/framework/plugins/linux/vmaregexscan.py b/volatility3/framework/plugins/linux/vmaregexscan.py new file mode 100644 index 000000000..83df5458f --- /dev/null +++ b/volatility3/framework/plugins/linux/vmaregexscan.py @@ -0,0 +1,127 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +import re + +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist + +vollog = logging.getLogger(__name__) + + +class VmaRegExScan(plugins.PluginInterface): + """Scans all virtual memory areas for tasks using RegEx.""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + MAXSIZE_DEFAULT = 128 + + @classmethod + def get_requirements(cls): + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + ), + requirements.ListRequirement( + name="pid", + description="Filter on specific process IDs", + element_type=int, + optional=True, + ), + requirements.StringRequirement( + name="pattern", description="RegEx pattern", optional=False + ), + requirements.IntRequirement( + name="maxsize", + description="Maximum size in bytes for displayed context", + default=cls.MAXSIZE_DEFAULT, + optional=True, + ), + ] + + def _generator(self, regex_pattern, tasks): + regex_pattern = bytes(regex_pattern, "UTF-8") + vollog.debug(f"RegEx Pattern: {regex_pattern}") + + for task in tasks: + + if not task.mm: + continue + name = utility.array_to_string(task.comm) + + # attempt to create a process layer for each task and skip those + # that cannot (e.g. kernel threads) + proc_layer_name = task.add_process_layer() + if not proc_layer_name: + continue + + # get the proc_layer object from the context + proc_layer = self.context.layers[proc_layer_name] + + # get process sections for scanning + sections = [ + (start, size) for (start, size) in task.get_process_memory_sections() + ] + + for offset in proc_layer.scan( + context=self.context, + scanner=scanners.RegExScanner(regex_pattern), + sections=sections, + progress_callback=self._progress_callback, + ): + result_data = proc_layer.read(offset, self.MAXSIZE_DEFAULT, pad=True) + + # reapply the regex in order to extact just the match + regex_result = re.match(regex_pattern, result_data) + + if regex_result: + # the match is within the results_data (e.g. it fits within MAXSIZE_DEFAULT) + # extract just the match itself + regex_match = regex_result.group(0) + text_result = str(regex_match, encoding="UTF-8", errors="replace") + bytes_result = regex_match + else: + # the match is not with the results_data (e.g. it doesn't fit within MAXSIZE_DEFAULT) + text_result = str(result_data, encoding="UTF-8", errors="replace") + bytes_result = result_data + + user_pid = task.tgid + yield 0, ( + user_pid, + name, + format_hints.Hex(offset), + text_result, + bytes_result, + ) + + def run(self): + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Offset", format_hints.Hex), + ("Text", str), + ("Hex", bytes), + ], + self._generator( + self.config.get("pattern"), + pslist.PsList.list_tasks( + self.context, self.config["kernel"], filter_func=filter_func + ), + ), + ) diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py new file mode 100644 index 000000000..d47a16407 --- /dev/null +++ b/volatility3/framework/plugins/regexscan.py @@ -0,0 +1,77 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +import re + +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints + +vollog = logging.getLogger(__name__) + + +class RegExScan(plugins.PluginInterface): + """Scans kernel memory using RegEx patterns.""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + MAXSIZE_DEFAULT = 128 + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.TranslationLayerRequirement( + name="primary", + description="Memory layer for the kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.StringRequirement( + name="pattern", description="RegEx pattern", optional=False + ), + requirements.IntRequirement( + name="maxsize", + description="Maximum size in bytes for displayed context", + default=cls.MAXSIZE_DEFAULT, + optional=True, + ), + ] + + def _generator(self, regex_pattern): + regex_pattern = bytes(regex_pattern, "UTF-8") + vollog.debug(f"RegEx Pattern: {regex_pattern}") + + layer = self.context.layers[self.config["primary"]] + for offset in layer.scan( + context=self.context, scanner=scanners.RegExScanner(regex_pattern) + ): + result_data = layer.read(offset, self.MAXSIZE_DEFAULT, pad=True) + + # reapply the regex in order to extact just the match + regex_result = re.match(regex_pattern, result_data) + + if regex_result: + # the match is within the results_data (e.g. it fits within MAXSIZE_DEFAULT) + # extract just the match itself + regex_match = regex_result.group(0) + text_result = str(regex_match, encoding="UTF-8", errors="replace") + bytes_result = regex_match + else: + # the match is not with the results_data (e.g. it doesn't fit within MAXSIZE_DEFAULT) + text_result = str(result_data, encoding="UTF-8", errors="replace") + bytes_result = result_data + + yield 0, (format_hints.Hex(offset), text_result, bytes_result) + + def run(self): + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Text", str), + ("Hex", bytes), + ], + self._generator(self.config.get("pattern")), + ) diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py new file mode 100644 index 000000000..742b00ace --- /dev/null +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -0,0 +1,128 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +import re + +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.layers import scanners +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist, vadyarascan + +vollog = logging.getLogger(__name__) + + +class VadRegExScan(plugins.PluginInterface): + """Scans all virtual memory areas for tasks using RegEx.""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + MAXSIZE_DEFAULT = 128 + + @classmethod + def get_requirements(cls): + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + ), + requirements.PluginRequirement( + name="vadyarascan", plugin=vadyarascan.VadYaraScan, version=(1, 0, 0) + ), + requirements.ListRequirement( + name="pid", + description="Filter on specific process IDs", + element_type=int, + optional=True, + ), + requirements.StringRequirement( + name="pattern", description="RegEx pattern", optional=False + ), + requirements.IntRequirement( + name="maxsize", + description="Maximum size in bytes for displayed context", + default=cls.MAXSIZE_DEFAULT, + optional=True, + ), + ] + + def _generator(self, regex_pattern, procs): + regex_pattern = bytes(regex_pattern, "UTF-8") + vollog.debug(f"RegEx Pattern: {regex_pattern}") + + for proc in procs: + + # attempt to create a process layer for each proc + proc_layer_name = proc.add_process_layer() + if not proc_layer_name: + continue + + # get the proc_layer object from the context + proc_layer = self.context.layers[proc_layer_name] + + # get process sections for scanning + sections = sections = vadyarascan.VadYaraScan.get_vad_maps(proc) + + for offset in proc_layer.scan( + context=self.context, + scanner=scanners.RegExScanner(regex_pattern), + sections=sections, + progress_callback=self._progress_callback, + ): + result_data = proc_layer.read(offset, self.MAXSIZE_DEFAULT, pad=True) + + # reapply the regex in order to extact just the match + regex_result = re.match(regex_pattern, result_data) + + if regex_result: + # the match is within the results_data (e.g. it fits within MAXSIZE_DEFAULT) + # extract just the match itself + regex_match = regex_result.group(0) + text_result = str(regex_match, encoding="UTF-8", errors="replace") + bytes_result = regex_match + else: + # the match is not with the results_data (e.g. it doesn't fit within MAXSIZE_DEFAULT) + text_result = str(result_data, encoding="UTF-8", errors="replace") + bytes_result = result_data + + proc_id = proc.UniqueProcessId + process_name = proc.ImageFileName.cast( + "string", + max_length=proc.ImageFileName.vol.count, + errors="replace", + ) + yield 0, ( + proc_id, + process_name, + format_hints.Hex(offset), + text_result, + bytes_result, + ) + + def run(self): + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + kernel = self.context.modules[self.config["kernel"]] + procs = pslist.PsList.list_processes( + self.context, + kernel.layer_name, + kernel.symbol_table_name, + filter_func=filter_func, + ) + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Offset", format_hints.Hex), + ("Text", str), + ("Hex", bytes), + ], + self._generator(self.config.get("pattern"), procs), + ) From c2058e744b9a0f1e213857f4712ba1d9fdf85964 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 15 Nov 2024 13:12:03 +0000 Subject: [PATCH 0066/1352] Fix missing type imports for regex plugins --- volatility3/framework/plugins/linux/vmaregexscan.py | 5 +++-- volatility3/framework/plugins/regexscan.py | 1 + volatility3/framework/plugins/windows/vadregexscan.py | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmaregexscan.py b/volatility3/framework/plugins/linux/vmaregexscan.py index 83df5458f..77ab29814 100644 --- a/volatility3/framework/plugins/linux/vmaregexscan.py +++ b/volatility3/framework/plugins/linux/vmaregexscan.py @@ -4,8 +4,9 @@ import logging import re +from typing import List -from volatility3.framework import renderers +from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import scanners @@ -24,7 +25,7 @@ class VmaRegExScan(plugins.PluginInterface): MAXSIZE_DEFAULT = 128 @classmethod - def get_requirements(cls): + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement( diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index d47a16407..c526b1697 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -4,6 +4,7 @@ import logging import re +from typing import List from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 742b00ace..141508283 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -4,6 +4,7 @@ import logging import re +from typing import List from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements @@ -23,7 +24,7 @@ class VadRegExScan(plugins.PluginInterface): MAXSIZE_DEFAULT = 128 @classmethod - def get_requirements(cls): + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement( From aa93b57f0dde01b97bc94025447b242afa4c36b2 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 15 Nov 2024 13:15:40 +0000 Subject: [PATCH 0067/1352] Fix windows.vadregexscan sections --- volatility3/framework/plugins/windows/vadregexscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 141508283..8d17c469c 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -70,7 +70,7 @@ class VadRegExScan(plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] # get process sections for scanning - sections = sections = vadyarascan.VadYaraScan.get_vad_maps(proc) + sections = vadyarascan.VadYaraScan.get_vad_maps(proc) for offset in proc_layer.scan( context=self.context, From 9f145ddcf0ddb84cf7ae45585ce7e9da0d204a17 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 15 Nov 2024 17:04:33 +0100 Subject: [PATCH 0068/1352] pillow dependency --- requirements.txt | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/requirements.txt b/requirements.txt index e0d366391..21c8f9a76 100644 --- a/requirements.txt +++ b/requirements.txt @@ -21,3 +21,9 @@ leechcorepyc>=2.4.0; sys_platform != 'darwin' # This is required for memory analysis on a Amazon/MinIO S3 and Google Cloud object storage gcsfs>=2023.1.0 s3fs>=2023.1.0 + +# This is required by plugins that manipulate pixels and images. +# https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst +# 10.0.0 dropped support for Python3.7 +# 11.0.0 dropped support for Python3.8, which is still supported by Volatility3 +pillow>=10.0.0,<11.0.0 \ No newline at end of file From 36a18f405b8ba7605ca957ca47d540a5b7c520d7 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 15 Nov 2024 17:05:23 +0100 Subject: [PATCH 0069/1352] fourcc code converter helper --- volatility3/framework/symbols/linux/__init__.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 3289775b6..573bc66d8 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -483,6 +483,22 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return kernel + @classmethod + def convert_fourcc_code(cls, code: int) -> str: + """Convert a fourcc integer back to its fourcc string representation. + + Args: + code: the numerical representation of the fourcc + + Returns: + The fourcc code string. + """ + + code_bytes_length = (code.bit_length() + 7) // 8 + return "".join( + [chr((code >> (i * 8)) & 0xFF) for i in range(code_bytes_length)] + ) + class IDStorage(ABC): """Abstraction to support both XArray and RadixTree""" From a7620cd6f659dfa685a445536a240182225a778c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 15 Nov 2024 17:09:21 +0100 Subject: [PATCH 0070/1352] linux fbdev subsystem api plugin --- .../framework/plugins/linux/graphics/fbdev.py | 314 ++++++++++++++++++ 1 file changed, 314 insertions(+) create mode 100644 volatility3/framework/plugins/linux/graphics/fbdev.py diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py new file mode 100644 index 000000000..4bde6f62f --- /dev/null +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -0,0 +1,314 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import io + +# Image manipulation functions are kept in the plugin, +# to prevent a general exit on missing PIL (pillow) dependency. +from PIL import Image +from dataclasses import dataclass +from typing import Type, List, Dict, Tuple +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue +from volatility3.framework.objects import utility +from volatility3.framework.constants import architectures +from volatility3.framework.symbols import linux + +vollog = logging.getLogger(__name__) + + +@dataclass +class Framebuffer: + """Framebuffer object internal representation. This is useful to unify an framebuffer with precalculated + properties and pass it through functions conveniently.""" + + id: str + xres_virtual: int + yres_virtual: int + line_length: int + bpp: int + """Bits Per Pixel""" + size: int + color_fields: Dict[str, Tuple[int, int, int]] + fb_info: interfaces.objects.ObjectInterface + + +class Fbdev(interfaces.plugins.PluginInterface): + """Extract framebuffers from the fbdev graphics subsystem""" + + _version = (1, 0, 0) + _required_framework_version = (2, 11, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.BooleanRequirement( + name="dump", + description="Dump framebuffers", + default=False, + optional=True, + ), + ] + + @classmethod + def parse_fb_pixel_bitfields( + cls, fb_var_screeninfo: interfaces.objects.ObjectInterface + ) -> Dict[str, Tuple[int, int, int]]: + """Organize a framebuffer pixel format into a dictionary. + This is needed to know the position and bitlength of a color inside + a pixel. + + Args: + fb_var_screeninfo: a fb_var_screeninfo kernel object instance + + Returns: + The color fields mappings + + Documentation: + include/uapi/linux/fb.h: + struct fb_bitfield { + __u32 offset; /* beginning of bitfield */ + __u32 length; /* length of bitfield */ + __u32 msb_right; /* != 0 : Most significant bit is right */ + }; + """ + # Naturally order by RGBA + color_mappings = [ + ("R", fb_var_screeninfo.red), + ("G", fb_var_screeninfo.green), + ("B", fb_var_screeninfo.blue), + ("A", fb_var_screeninfo.transp), + ] + color_fields = {} + for color_code, fb_bitfield in color_mappings: + color_fields[color_code] = ( + int(fb_bitfield.offset), + int(fb_bitfield.length), + int(fb_bitfield.msb_right), + ) + return color_fields + + @classmethod + def convert_fb_raw_buffer_to_image( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + fb: Framebuffer, + ) -> Image.Image: + """Convert raw framebuffer pixels to an image. + + Args: + fb: the relevant Framebuffer object + + Returns: + A PIL Image object + + Documentation: + include/uapi/linux/fb.h: + /* Interpretation of offset for color fields: All offsets are from the right, + * inside a "pixel" value, which is exactly 'bits_per_pixel' wide (means: you + * can use the offset as right argument to <<). A pixel afterwards is a bit + * stream and is written to video memory as that unmodified. + """ + kernel = context.modules[kernel_name] + kernel_layer = context.layers[kernel.layer_name] + + raw_pixels = io.BytesIO(kernel_layer.read(fb.fb_info.screen_base, fb.size)) + bytes_per_pixel = fb.bpp // 8 + image = Image.new("RGBA", (fb.xres_virtual, fb.yres_virtual)) + + # This is not designed to be extremely fast (numpy isn't available), + # but convenient and dynamic for any color field layout. + for y in range(fb.yres_virtual): + for x in range(fb.xres_virtual): + raw_pixel = int.from_bytes(raw_pixels.read(bytes_per_pixel), "little") + pixel = [0, 0, 0, 255] + # The framebuffer is expected to have been correctly constructed, + # especially by parse_fb_pixel_bitfields, to get the needed RGBA mappings. + for i, color_code in enumerate(["R", "G", "B", "A"]): + offset, length, msb_right = fb.color_fields[color_code] + if length == 0: + continue + color_value = (raw_pixel >> offset) & (2**length - 1) + if msb_right: + # Reverse bit order + color_value = int( + "{:0{length}b}".format(color_value, length=length)[::-1], 2 + ) + pixel[i] = color_value + image.putpixel((x, y), tuple(pixel)) + + return image + + @classmethod + def dump_fb( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + open_method: Type[interfaces.plugins.FileHandlerInterface], + fb: Framebuffer, + convert_to_image: bool, + image_format: str = "PNG", + ) -> str: + """Dump a Framebuffer raw buffer to disk. + + Args: + fb: the relevant Framebuffer object + convert_to_image: a boolean specifying if the buffer should be converted to an image + image_format: the target PIL image format (defaults to PNG) + + Returns: + The filename of the dumped buffer. + """ + kernel = context.modules[kernel_name] + kernel_layer = context.layers[kernel.layer_name] + base_filename = f"{fb.id}_{fb.xres_virtual}x{fb.yres_virtual}_{fb.bpp}bpp" + if convert_to_image: + image = cls.convert_fb_raw_buffer_to_image(context, kernel_name, fb) + output = io.BytesIO() + image.save(output, image_format) + file_handle = open_method(f"{base_filename}.{image_format.lower()}") + file_handle.write(output.getvalue()) + else: + raw_pixels = kernel_layer.read(fb.fb_info.screen_base, fb.size) + file_handle = open_method(f"{base_filename}.raw") + file_handle.write(raw_pixels) + + file_handle.close() + return file_handle.preferred_filename + + @classmethod + def parse_fb_info( + cls, + fb_info: interfaces.objects.ObjectInterface, + ) -> Framebuffer: + """Parse an fb_info struct + Args: + fb_info: an fb_info kernel object live instance + + Returns: + A Framebuffer object + + Documentation: + https://docs.kernel.org/fb/api.html: + - struct fb_fix_screeninfo stores device independent unchangeable information about the frame buffer device and the current format. + Those information can't be directly modified by applications, but can be changed by the driver when an application modifies the format. + - struct fb_var_screeninfo stores device independent changeable information about a frame buffer device, its current format and video mode, + as well as other miscellaneous parameters. + """ + # NotAvailableValue() messes with the filename output on disk + id = utility.array_to_string(fb_info.fix.id) or "N-A" + color_fields = None + + # 0 = color, 1 = grayscale, >1 = FOURCC + if fb_info.var.grayscale in [0, 1]: + color_fields = cls.parse_fb_pixel_bitfields(fb_info.var) + + # There a lot of tricky pixel formats used by drivers and vendors in include/uapi/linux/videodev2.h. + # As Volatility3 is not a video format converter, it is best to play it safe and let the user parse + # the raw data manually (with ffmpeg for example). + elif fb_info.var.grayscale > 1: + fourcc = linux.LinuxUtilities.convert_fourcc_code(fb_info.var.grayscale) + warn_msg = f"""Framebuffer "{id}" uses a FOURCC pixel format "{fourcc}" that isn't natively supported. +You can try using ffmpeg to decode the raw buffer. Example usage: +"ffmpeg -pix_fmts" to list supported formats, then +"ffmpeg -f rawvideo -video_size {fb_info.var.xres_virtual}x{fb_info.var.yres_virtual} -i .raw -pix_fmt output.png".""" + vollog.warning(warn_msg) + + # Prefer using the virtual resolution, instead of the visible one. + # This prevents missing non-visible data stored in the framebuffer. + fb = Framebuffer( + id, + xres_virtual=fb_info.var.xres_virtual, + yres_virtual=fb_info.var.yres_virtual, + line_length=fb_info.fix.line_length, + bpp=fb_info.var.bits_per_pixel, + size=fb_info.var.yres_virtual * fb_info.fix.line_length, + color_fields=color_fields, + fb_info=fb_info, + ) + + return fb + + def _generator(self): + kernel_name = self.config["kernel"] + kernel = self.context.modules[kernel_name] + + if not kernel.has_symbol("num_registered_fb"): + raise exceptions.SymbolError( + "num_registered_fb", + kernel.symbol_table_name, + "The provided symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt.", + ) + + num_registered_fb = kernel.object_from_symbol("num_registered_fb") + if num_registered_fb < 1: + vollog.info("No registered framebuffer in the fbdev API.") + return None + + registered_fb = kernel.object_from_symbol("registered_fb") + fb_info_list = utility.array_of_pointers( + registered_fb, + num_registered_fb, + kernel.symbol_table_name + constants.BANG + "fb_info", + self.context, + ) + + for fb_info in fb_info_list: + fb = self.parse_fb_info(fb_info) + file_output = "Disabled" + if self.config["dump"]: + try: + file_output = self.dump_fb( + self.context, kernel_name, self.open, fb, bool(fb.color_fields) + ) + except exceptions.InvalidAddressException as excp: + vollog.error( + f'Layer {excp.layer_name} failed to read address {hex(excp.invalid_address)} when dumping framebuffer "{fb.id}".' + ) + file_output = "Error" + + try: + fb_device_name = utility.pointer_to_string( + fb.fb_info.dev.kobj.name, 256 + ) + except exceptions.InvalidAddressException: + fb_device_name = NotAvailableValue() + + yield ( + 0, + ( + format_hints.Hex(fb.fb_info.screen_base), + fb_device_name, + fb.id, + fb.size, + f"{fb.xres_virtual}x{fb.yres_virtual}", + fb.bpp, + "RUNNING" if fb.fb_info.state == 0 else "SUSPENDED", + str(file_output), + ), + ) + + def run(self): + columns = [ + ("Address", format_hints.Hex), + ("Device", str), + ("ID", str), + ("Size", int), + ("Virtual resolution", str), + ("BPP", int), + ("State", str), + ("Filename", str), + ] + + return TreeGrid( + columns, + self._generator(), + ) From f192437a944f56ec3b8eae186d61f3049e691e80 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 15 Nov 2024 17:11:11 +0100 Subject: [PATCH 0071/1352] typo --- volatility3/framework/plugins/linux/graphics/fbdev.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 4bde6f62f..60e00d033 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) @dataclass class Framebuffer: - """Framebuffer object internal representation. This is useful to unify an framebuffer with precalculated + """Framebuffer object internal representation. This is useful to unify a framebuffer with precalculated properties and pass it through functions conveniently.""" id: str From 4c0ddca7962ade96747e16b7c2db3bd126e1af6a Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 18 Nov 2024 15:20:38 +1100 Subject: [PATCH 0072/1352] linux: intel VMCoreInfo: BugFix. Return layer if both values are present --- volatility3/framework/automagic/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index c92fa05c4..adecc36d0 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -366,7 +366,7 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): dtb, ) - return layer + return layer vollog.debug("No suitable linux banner could be matched") return None From 4a88a7450b8fb33b29c7bdf1ee2a9703c67b5446 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 18 Nov 2024 16:47:45 +1100 Subject: [PATCH 0073/1352] linux: VMCoreInfo API: Integrate support for value parsing within the VMCoreInfo API --- volatility3/framework/automagic/linux.py | 20 +++++++++++-------- .../framework/plugins/linux/vmcoreinfo.py | 5 +++++ .../framework/symbols/linux/__init__.py | 17 ++++++++++++++-- 3 files changed, 32 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index adecc36d0..ff6bbbfe4 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -373,8 +373,8 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): @staticmethod def _vmcoreinfo_find_aslr(vmcoreinfo) -> Tuple[int, int]: - phys_base_str = vmcoreinfo.get("NUMBER(phys_base)") - if phys_base_str is None: + phys_base = vmcoreinfo.get("NUMBER(phys_base)") + if phys_base is None: # In kernel < 4.10, there may be a SYMBOL(phys_base), but as noted in the # c401721ecd1dcb0a428aa5d6832ee05ffbdbffbbe commit comment, this value # isn't useful for calculating the physical address. @@ -383,15 +383,15 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): return None # kernels 3.14 (b6085a865762236bb84934161273cdac6dd11c2d) KERNELOFFSET was added - kerneloffset_str = vmcoreinfo.get("KERNELOFFSET") - if kerneloffset_str is None: + kerneloffset = vmcoreinfo.get("KERNELOFFSET") + if kerneloffset is None: # kernels < 3.14 if KERNELOFFSET is missing, KASLR might not be implemented. # Oddly, NUMBER(phys_base) is present without it. To be safe, proceed only # if both are present. return None - aslr_shift = int(kerneloffset_str, 16) - kaslr_shift = int(phys_base_str) + aslr_shift + aslr_shift = kerneloffset + kaslr_shift = phys_base + aslr_shift return kaslr_shift, aslr_shift @@ -403,7 +403,11 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): # in kernels 4.13 in 65ade2f872b474fa8a04c2d397783350326634e6) to init_top_pgt. # In x86-32, the pgd is swapper_pg_dir. So, in any case, for VMCOREINFO # SYMBOL(swapper_pg_dir) will always have the right value. - dtb_vaddr = int(vmcoreinfo["SYMBOL(swapper_pg_dir)"], 16) + dtb_vaddr = vmcoreinfo.get("SYMBOL(swapper_pg_dir)") + if dtb_vaddr is None: + # Abort, it should be present + return None + dtb_paddr = ( LinuxIntelStacker.virtual_to_physical_address(dtb_vaddr) - aslr_shift @@ -420,7 +424,7 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): is_32bit = True else: # Check the swapper_pg_dir virtual address size - dtb_vaddr = int(vmcoreinfo["SYMBOL(swapper_pg_dir)"], 16) + dtb_vaddr = vmcoreinfo["SYMBOL(swapper_pg_dir)"] is_32bit = dtb_vaddr <= 2**32 return is_32bit, is_pae diff --git a/volatility3/framework/plugins/linux/vmcoreinfo.py b/volatility3/framework/plugins/linux/vmcoreinfo.py index ea30520e3..0f07f8589 100644 --- a/volatility3/framework/plugins/linux/vmcoreinfo.py +++ b/volatility3/framework/plugins/linux/vmcoreinfo.py @@ -38,6 +38,11 @@ class VMCoreInfo(plugins.PluginInterface): layer_name=layer_name, ): for key, value in vmcoreinfo.items(): + if key.startswith("SYMBOL(") or key == "KERNELOFFSET": + value = f"0x{value:x}" + else: + value = str(value) + yield 0, (format_hints.Hex(vmcoreinfo_offset), key, value) def run(self): diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index b0b6b7325..b8a2056d5 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -842,8 +842,9 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface): _version = (1, 0, 0) - @staticmethod + @classmethod def _vmcoreinfo_data_to_dict( + cls, vmcoreinfo_data, ) -> Optional[Dict[str, str]]: """Converts the input VMCoreInfo data buffer into a dictionary""" @@ -859,10 +860,22 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface): break key, value = line.split("=", 1) - vmcoreinfo_dict[key] = value + vmcoreinfo_dict[key] = cls._parse_value(key, value) return vmcoreinfo_dict + @classmethod + def _parse_value(cls, key, value): + if key.startswith("SYMBOL(") or key == "KERNELOFFSET": + return int(value, 16) + elif key.startswith(("NUMBER(", "LENGTH(", "SIZE(", "OFFSET(")): + return int(value) + elif key == "PAGESIZE": + return int(value) + + # Default, as string + return value + @classmethod def search_vmcoreinfo_elf_note( cls, From f2a2f8aa679e2ec314049bdb721ad13376209514 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 18 Nov 2024 17:00:00 +1100 Subject: [PATCH 0074/1352] linux: intel VMCoreInfo: immediately abort processing the current VMCOREINFO if DTB is not found --- volatility3/framework/automagic/linux.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index ff6bbbfe4..64365bd83 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -295,12 +295,15 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): for _vmcoreinfo_offset, vmcoreinfo in vmcoreinfo_elf_notes_iter: shifts = cls._vmcoreinfo_find_aslr(vmcoreinfo) if not shifts: - # Let's try the next vmcoreinfo, in case this one isn't correct. + # Let's try the next VMCOREINFO, in case this one isn't correct. continue kaslr_shift, aslr_shift = shifts dtb = cls._vmcoreinfo_get_dtb(vmcoreinfo, aslr_shift, kaslr_shift) + if dtb is None: + # Discard this VMCOREINFO immediately + continue is_32bit, is_pae = cls._vmcoreinfo_is_32bit(vmcoreinfo) if is_32bit: @@ -358,7 +361,7 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): metadata={"os": "Linux"}, ) - if layer and dtb: + if layer: vollog.debug( "Values found in VMCOREINFO: KASLR=0x%x, ASLR=0x%x, DTB=0x%x", kaslr_shift, From 6d366f16ee84844bec5c49ee94a10655995ea3ed Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 18 Nov 2024 06:38:06 +0000 Subject: [PATCH 0075/1352] Windows.vadregexscan: update imports --- volatility3/framework/plugins/windows/vadyarascan.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index efcc70d07..fd76bbc48 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -5,7 +5,8 @@ import logging from typing import Iterable, List, Tuple -from volatility3.framework import interfaces, renderers +from volatility3.framework import renderers +from volatility3.framework.interfaces import plugins, configuration, objects from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins import yarascan @@ -14,14 +15,14 @@ from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) -class VadYaraScan(interfaces.plugins.PluginInterface): +class VadYaraScan(plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" _required_framework_version = (2, 4, 0) _version = (1, 1, 1) @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + def get_requirements(cls) -> List[configuration.RequirementInterface]: # create a list of requirements for vadyarascan vadyarascan_requirements = [ requirements.ModuleRequirement( @@ -112,7 +113,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): @staticmethod def get_vad_maps( - task: interfaces.objects.ObjectInterface, + task: objects.ObjectInterface, ) -> Iterable[Tuple[int, int]]: """Creates a map of start/end addresses within a virtual address descriptor tree. From d80ef553255acf29ee16d884e864ec7c546a2be0 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 18 Nov 2024 17:49:30 +1100 Subject: [PATCH 0076/1352] linux: intel VMCoreInfo: Select the fastest scanner for each scenario --- volatility3/framework/automagic/linux.py | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 64365bd83..81f5f5661 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -321,12 +321,20 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): if not valid_banners: # There's no banner matching this VMCOREINFO, keep trying with the next one continue + elif len(valid_banners) == 1: + # Usually, we narrow down the Linux banner list to a single element. + # Using BytesScanner here is slightly faster than MultiStringScanner. + scanner = scanners.BytesScanner(valid_banners[0]) + else: + scanner = scanners.MultiStringScanner(valid_banners) join = interfaces.configuration.path_join - mss = scanners.MultiStringScanner(valid_banners) - for _, banner in layer.scan( - context=context, scanner=mss, progress_callback=progress_callback + for match in layer.scan( + context=context, scanner=scanner, progress_callback=progress_callback ): + # Unfortunately, the scanners do not maintain a consistent interface + banner = match[1] if isinstance(match, Tuple) else valid_banners[0] + isf_path = linux_banners.get(banner, None) if not isf_path: vollog.warning( From 13729ac25f699d72c280b999ddbe0e9d02fcede6 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 18 Nov 2024 18:18:14 +1100 Subject: [PATCH 0077/1352] linux: VMCoreInfo API: AARCH64 uses NUMBER() with hex values. Fortunately, includes the 0x prefix, allowing the parser to still handle these cases correctly --- volatility3/framework/symbols/linux/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index b8a2056d5..cd4d16649 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -869,9 +869,9 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface): if key.startswith("SYMBOL(") or key == "KERNELOFFSET": return int(value, 16) elif key.startswith(("NUMBER(", "LENGTH(", "SIZE(", "OFFSET(")): - return int(value) + return int(value, 0) elif key == "PAGESIZE": - return int(value) + return int(value, 0) # Default, as string return value From 07701fc4cf9385422f9d06b89cf64640e6a76b0d Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 18 Nov 2024 18:32:51 +0000 Subject: [PATCH 0078/1352] windows.vadregexscan: remove dependency on vadyarascan --- volatility3/framework/plugins/windows/vadregexscan.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 8d17c469c..206c9faae 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -11,7 +11,7 @@ from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import scanners from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import pslist, vadyarascan +from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -35,9 +35,6 @@ class VadRegExScan(plugins.PluginInterface): requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="vadyarascan", plugin=vadyarascan.VadYaraScan, version=(1, 0, 0) - ), requirements.ListRequirement( name="pid", description="Filter on specific process IDs", @@ -70,7 +67,11 @@ class VadRegExScan(plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] # get process sections for scanning - sections = vadyarascan.VadYaraScan.get_vad_maps(proc) + sections = [] + for vad in proc.get_vad_root().traverse(): + base = vad.get_start() + if vad.get_size(): + sections.append((base, vad.get_size())) for offset in proc_layer.scan( context=self.context, From e374ca96472279944bd5c0922f64e87f0b30e7e3 Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 18 Nov 2024 21:15:06 +0000 Subject: [PATCH 0079/1352] Windows.vadregexscan: update imports, revert vadyarascan changes --- volatility3/framework/plugins/windows/vadregexscan.py | 6 +++--- volatility3/framework/plugins/windows/vadyarascan.py | 9 ++++----- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 206c9faae..0d35cd658 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -6,9 +6,9 @@ import logging import re from typing import List -from volatility3.framework import interfaces, renderers +from volatility3.framework import renderers from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins +from volatility3.framework.interfaces import plugins, configuration from volatility3.framework.layers import scanners from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import pslist @@ -24,7 +24,7 @@ class VadRegExScan(plugins.PluginInterface): MAXSIZE_DEFAULT = 128 @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + def get_requirements(cls) -> List[configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.ModuleRequirement( diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index fd76bbc48..efcc70d07 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -5,8 +5,7 @@ import logging from typing import Iterable, List, Tuple -from volatility3.framework import renderers -from volatility3.framework.interfaces import plugins, configuration, objects +from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins import yarascan @@ -15,14 +14,14 @@ from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) -class VadYaraScan(plugins.PluginInterface): +class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" _required_framework_version = (2, 4, 0) _version = (1, 1, 1) @classmethod - def get_requirements(cls) -> List[configuration.RequirementInterface]: + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # create a list of requirements for vadyarascan vadyarascan_requirements = [ requirements.ModuleRequirement( @@ -113,7 +112,7 @@ class VadYaraScan(plugins.PluginInterface): @staticmethod def get_vad_maps( - task: objects.ObjectInterface, + task: interfaces.objects.ObjectInterface, ) -> Iterable[Tuple[int, int]]: """Creates a map of start/end addresses within a virtual address descriptor tree. From 96f5fdae2f48b6a87f735daa3fc56e7aa2902c61 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 19 Nov 2024 11:25:52 +1100 Subject: [PATCH 0080/1352] linux: intel VMCoreInfo: Add the vmcoreinfo to the layer metadata --- volatility3/framework/automagic/linux.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 81f5f5661..2b7cdf4cc 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -2,8 +2,9 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import logging import os +import logging +import collections from typing import Optional, Tuple, Type from volatility3.framework import constants, interfaces @@ -107,11 +108,13 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): join(config_path, LinuxSymbolFinder.banner_config_key) ] = str(banner, "latin-1") + # Set an empty vmcoreinfo entry to prevent using the wrong one in the layer stack. + layer_metadata = dict(os="Linux", vmcoreinfo={}) layer = layer_class( context, config_path=config_path, name=new_layer_name, - metadata={"os": "Linux"}, + metadata=layer_metadata, ) layer.config["kernel_virtual_offset"] = aslr_shift @@ -376,6 +379,10 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): aslr_shift, dtb, ) + # Add the vmcoreinfo dict to the layer metadata + layer._direct_metadata = collections.ChainMap( + {"vmcoreinfo": vmcoreinfo}, layer._direct_metadata + ) return layer From 9f6d1949800981e7d5cc6416b661880fe8041a38 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 19 Nov 2024 12:47:56 +1100 Subject: [PATCH 0081/1352] linux: intel VMCoreInfo: The _direct_metadata class attribute needs to be modified; otherwise, it will only exist within the instance namespace. --- volatility3/framework/automagic/linux.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 2b7cdf4cc..8c4ccd8e3 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -379,8 +379,8 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): aslr_shift, dtb, ) - # Add the vmcoreinfo dict to the layer metadata - layer._direct_metadata = collections.ChainMap( + # Add the vmcoreinfo dict to the layer class metadata + layer.__class__._direct_metadata = collections.ChainMap( {"vmcoreinfo": vmcoreinfo}, layer._direct_metadata ) From 41d2e924d147aed9adfa2181aa6191e26fa90568 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 20 Nov 2024 11:47:37 +1100 Subject: [PATCH 0082/1352] linux: intel VMCoreInfo: Revert changes associated with adding vmcoreinfo dict to the layer metadata --- volatility3/framework/automagic/linux.py | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 8c4ccd8e3..b8ed47220 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -4,7 +4,6 @@ import os import logging -import collections from typing import Optional, Tuple, Type from volatility3.framework import constants, interfaces @@ -108,13 +107,11 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): join(config_path, LinuxSymbolFinder.banner_config_key) ] = str(banner, "latin-1") - # Set an empty vmcoreinfo entry to prevent using the wrong one in the layer stack. - layer_metadata = dict(os="Linux", vmcoreinfo={}) layer = layer_class( context, config_path=config_path, name=new_layer_name, - metadata=layer_metadata, + metadata={os: "Linux"}, ) layer.config["kernel_virtual_offset"] = aslr_shift @@ -379,10 +376,6 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): aslr_shift, dtb, ) - # Add the vmcoreinfo dict to the layer class metadata - layer.__class__._direct_metadata = collections.ChainMap( - {"vmcoreinfo": vmcoreinfo}, layer._direct_metadata - ) return layer From 1abb4cc881d052b4f76df1e52bc4d0d9521c8c0c Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 11:13:21 +0100 Subject: [PATCH 0083/1352] comply with xdg base directory spec by using XDG_CACHE_HOME if its set --- volatility3/framework/constants/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 27fae4ba1..84c9c22ce 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -6,6 +6,7 @@ Stores all the constant values that are generally fixed throughout volatility This includes default scanning block sizes, etc. """ + import enum import os.path import sys @@ -65,7 +66,10 @@ LOGLEVEL_VVV = 7 LOGLEVEL_VVVV = 6 """Logging level for four levels of detail: -vvvvvv""" -CACHE_PATH = os.path.join(os.path.expanduser("~"), ".cache", "volatility3") + +CACHE_PATH = os.path.join( + os.environ.get("XDG_CACHE_HOME") or os.path.expanduser("~/.cache"), "volatility3" +) """Default path to store cached data""" SQLITE_CACHE_PERIOD = "-3 days" From b93d5b7c13298ed2c1a24a951569a8e93f444c26 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 11:23:53 +0100 Subject: [PATCH 0084/1352] update docs --- doc/source/symbol-tables.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/symbol-tables.rst b/doc/source/symbol-tables.rst index b7c26e046..722f9e468 100644 --- a/doc/source/symbol-tables.rst +++ b/doc/source/symbol-tables.rst @@ -9,7 +9,7 @@ How Volatility finds symbol tables All files are stored as JSON data, they can be in pure JSON files as ``.json``, or compressed as ``.json.gz`` or ``.json.xz``. Volatility will automatically decompress them on use. It will also cache their contents (compressed) when used, located -under the user's home directory, in :file:`.cache/volatility3`, along with other useful data. The cache directory currently +under the user's home directory, in :file:`.cache/volatility3` or when `XDG_CACHE_HOME` is set in :file:`${XDG_CACHE_HOME}/volatility3`, along with other useful data. The cache directory currently cannot be altered. Symbol table JSON files live, by default, under the :file:`volatility3/symbols` directory. The symbols directory is From a2b96c0dc0b2989e87e4eb4a9c2a274ef4ed6e7f Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 11:46:59 +0100 Subject: [PATCH 0085/1352] fix: dont use `/` for compat --- volatility3/framework/constants/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 84c9c22ce..8bdf84730 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -68,7 +68,8 @@ LOGLEVEL_VVVV = 6 CACHE_PATH = os.path.join( - os.environ.get("XDG_CACHE_HOME") or os.path.expanduser("~/.cache"), "volatility3" + os.environ.get("XDG_CACHE_HOME") or os.path.join(os.path.expanduser("~"), ".cache"), + "volatility3", ) """Default path to store cached data""" From bbd2f9bc3770d798c7e225586f5f78e22400970d Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 22 Nov 2024 22:40:53 +1100 Subject: [PATCH 0086/1352] linux: intel VMCoreInfo: Fix bug introduced in last commit reverting the layer metadata dict --- volatility3/framework/automagic/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index b8ed47220..90384b50d 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -111,7 +111,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): context, config_path=config_path, name=new_layer_name, - metadata={os: "Linux"}, + metadata={"os": "Linux"}, ) layer.config["kernel_virtual_offset"] = aslr_shift From 76ecfc08830e4b7def60520ab423a8d439e8fdbe Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 22 Nov 2024 12:16:14 +0000 Subject: [PATCH 0087/1352] Core: Add in generic cache-manager chooser function --- volatility3/framework/automagic/linux.py | 17 ++--------------- volatility3/framework/automagic/mac.py | 17 ++--------------- volatility3/framework/automagic/symbol_cache.py | 15 +++++++++++++++ 3 files changed, 19 insertions(+), 30 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 52a73f45a..6fe18a4a9 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -27,16 +27,6 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): progress_callback: constants.ProgressCallback = None, ) -> Optional[interfaces.layers.DataLayerInterface]: """Attempts to identify linux within this layer.""" - # Version check the SQlite cache - required = (1, 0, 0) - if not requirements.VersionRequirement.matches_required( - required, symbol_cache.SqliteCache.version - ): - vollog.info( - f"SQLiteCache version not suitable: required {required} found {symbol_cache.SqliteCache.version}" - ) - return None - # Bail out by default unless we can stack properly layer = context.layers[layer_name] join = interfaces.configuration.path_join @@ -46,12 +36,9 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): if isinstance(layer, intel.Intel): return None - identifiers_path = os.path.join( - constants.CACHE_PATH, constants.IDENTIFIERS_FILENAME + linux_banners = symbol_cache.load_cache_manager().get_identifier_dictionary( + operating_system="linux" ) - linux_banners = symbol_cache.SqliteCache( - identifiers_path - ).get_identifier_dictionary(operating_system="linux") # If we have no banners, don't bother scanning if not linux_banners: vollog.info( diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py index e51753139..7c478b521 100644 --- a/volatility3/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -28,16 +28,6 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): progress_callback: constants.ProgressCallback = None, ) -> Optional[interfaces.layers.DataLayerInterface]: """Attempts to identify mac within this layer.""" - # Version check the SQlite cache - required = (1, 0, 0) - if not requirements.VersionRequirement.matches_required( - required, symbol_cache.SqliteCache.version - ): - vollog.info( - f"SQLiteCache version not suitable: required {required} found {symbol_cache.SqliteCache.version}" - ) - return None - # Bail out by default unless we can stack properly layer = context.layers[layer_name] new_layer = None @@ -48,12 +38,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): if isinstance(layer, intel.Intel): return None - identifiers_path = os.path.join( - constants.CACHE_PATH, constants.IDENTIFIERS_FILENAME + mac_banners = symbol_cache.load_cache_manager().get_identifier_dictionary( + operating_system="mac" ) - mac_banners = symbol_cache.SqliteCache( - identifiers_path - ).get_identifier_dictionary(operating_system="mac") # If we have no banners, don't bother scanning if not mac_banners: vollog.info( diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index 22f1c94f3..e38771f79 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -492,6 +492,21 @@ class SqliteCache(CacheManagerInterface): return output +def load_cache_manager(cache_file: Optional[str] = None) -> CacheManagerInterface: + """Loads a cache manager based on a specific cache file""" + if cache_file is None: + cache_file = os.path.join(constants.CACHE_PATH, constants.IDENTIFIERS_FILENAME) + # Different implementations of cache + if not os.path.exists(cache_file): + raise ValueError("Non-existant cache file provided") + with open(cache_file, "rb") as fp: + header = fp.read(4) + if header not in [b"SQLi"]: + raise ValueError("Identifier file not in recognized format") + # Currently only one choice, so use that + return SqliteCache(cache_file) + + ### Automagic From 4bc6e1001df8b60586309e56abb4ed7892b98c5d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 22 Nov 2024 19:45:15 +0000 Subject: [PATCH 0088/1352] Windows: Improve logging of slowscan to show possible PDB entries --- volatility3/framework/automagic/pdbscan.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 7f38a23e1..1d5bf55ea 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -270,6 +270,10 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): progress_callback=progress_callback, ) for kernel in kernels: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1)} with MZ offset at {kernel.get('mz_offset', -1)}", + ) valid_kernel = test_kernel(physical_layer_name, virtual_layer_name, kernel) if valid_kernel is not None: break From 1a0d1a238da02db679c0bc5dfa10191abe25b6b7 Mon Sep 17 00:00:00 2001 From: lesander <4174509+lesander@users.noreply.github.com> Date: Sun, 24 Nov 2024 09:28:41 +0000 Subject: [PATCH 0089/1352] CLI: Partial changes by @lesander contributed in #1343 --- .github/workflows/test.yaml | 4 ++-- volatility3/cli/__init__.py | 5 +++-- volatility3/cli/volshell/__init__.py | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 6358dd45d..73bf342b6 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -41,8 +41,8 @@ jobs: - name: Testing... run: | - py.test ./test/test_volatility.py --volatility=vol.py --image win-xp-laptop-2005-06-25.img -k test_windows -v - py.test ./test/test_volatility.py --volatility=vol.py --image linux-sample-1.bin -k test_linux -v + pytest ./test/test_volatility.py --volatility=vol.py --image win-xp-laptop-2005-06-25.img -k test_windows -v + pytest ./test/test_volatility.py --volatility=vol.py --image linux-sample-1.bin -k test_linux -v - name: Clean up post-test run: | diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 75b62abf6..5b2aa2838 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -88,7 +88,7 @@ class MuteProgress(PrintedProgress): class CommandLine: """Constructs a command-line interface object for users to run plugins.""" - CLI_NAME = "volatility" + CLI_NAME = os.path.basename(sys.argv[0]) # vol or volatility def __init__(self): self.setup_logging() @@ -364,6 +364,7 @@ class CommandLine: self.CLI_NAME ), action=volargparse.HelpfulSubparserAction, + metavar="PLUGIN", ) for plugin in sorted(plugin_list): plugin_parser = subparser.add_parser( @@ -385,7 +386,7 @@ class CommandLine: argcomplete.autocomplete(parser) args = parser.parse_args() if args.plugin is None: - parser.error("Please select a plugin to run") + parser.error(f"Please select a plugin to run (see '{self.CLI_NAME} --help' for options") vollog.log( constants.LOGLEVEL_VVV, f"Cache directory used: {constants.CACHE_PATH}" diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py index 5172c5363..559adc12b 100644 --- a/volatility3/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -49,7 +49,7 @@ class VolShell(cli.CommandLine): python terminal with all the volatility support calls available. """ - CLI_NAME = "volshell" + CLI_NAME = os.path.basename(sys.argv[0]) # volshell def __init__(self): super().__init__() From 523a6e92fc75a972fe5d9a73c6dc65d4322a7f46 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 24 Nov 2024 09:33:30 +0000 Subject: [PATCH 0090/1352] CLI: Apply black to recent changes --- volatility3/cli/__init__.py | 6 ++++-- volatility3/cli/volshell/__init__.py | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 5b2aa2838..901f299a8 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -88,7 +88,7 @@ class MuteProgress(PrintedProgress): class CommandLine: """Constructs a command-line interface object for users to run plugins.""" - CLI_NAME = os.path.basename(sys.argv[0]) # vol or volatility + CLI_NAME = os.path.basename(sys.argv[0]) # vol or volatility def __init__(self): self.setup_logging() @@ -386,7 +386,9 @@ class CommandLine: argcomplete.autocomplete(parser) args = parser.parse_args() if args.plugin is None: - parser.error(f"Please select a plugin to run (see '{self.CLI_NAME} --help' for options") + parser.error( + f"Please select a plugin to run (see '{self.CLI_NAME} --help' for options" + ) vollog.log( constants.LOGLEVEL_VVV, f"Cache directory used: {constants.CACHE_PATH}" diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py index 559adc12b..e9d3fda08 100644 --- a/volatility3/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -49,7 +49,7 @@ class VolShell(cli.CommandLine): python terminal with all the volatility support calls available. """ - CLI_NAME = os.path.basename(sys.argv[0]) # volshell + CLI_NAME = os.path.basename(sys.argv[0]) # volshell def __init__(self): super().__init__() From 641e008caf34b93b3c12360115066e1e291500ca Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 27 Nov 2024 15:06:33 +1100 Subject: [PATCH 0091/1352] Linux: intel: The non-present mapping shouldn't be inverted --- volatility3/framework/layers/intel.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index dc88c20bf..6d0aa6746 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -563,8 +563,9 @@ class LinuxMixin(Intel): return self._is_pte_present(entry) def _pte_needs_invert(self, entry) -> bool: - # Entries that were set to PROT_NONE (PAGE_PRESENT/PAGE_GLOBAL) are inverted - return not (entry & self._PAGE_PRESENT) + # Entries that were set to PROT_NONE (PAGE_PRESENT) are inverted + # A clear PTE shouldn't be inverted. See f19f5c4 + return entry and not (entry & self._PAGE_PRESENT) def _protnone_mask(self, entry: int) -> int: """Gets a mask to XOR with the page table entry to get the correct PFN""" From eff2a529c8e2e264553aca0550a5cd9ce3c9c298 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 27 Nov 2024 18:10:14 +1100 Subject: [PATCH 0092/1352] Linux: intel: Remove the bitwise zero complement to simplify the protnone mask calculation --- volatility3/framework/layers/intel.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 6d0aa6746..d762b41a8 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -569,7 +569,7 @@ class LinuxMixin(Intel): def _protnone_mask(self, entry: int) -> int: """Gets a mask to XOR with the page table entry to get the correct PFN""" - return ~0 & self._register_mask if self._pte_needs_invert(entry) else 0 + return self._register_mask if self._pte_needs_invert(entry) else 0 def _pte_pfn(self, entry: int) -> int: """Extracts the page frame number from the page table entry""" From 7c559c53f4bad23557056fec14a633628e1d5fe2 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 12:11:14 +1100 Subject: [PATCH 0093/1352] test_cases: underscore unused variables --- test/test_volatility.py | 91 ++++++++++++++++++++++------------------- 1 file changed, 50 insertions(+), 41 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 847be88d9..2f3ba3c63 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -61,7 +61,7 @@ def runvol_plugin(plugin, img, volatility, python, pluginargs=[], globalargs=[]) def test_windows_pslist(image, volatility, python): - rc, out, err = runvol_plugin("windows.pslist.PsList", image, volatility, python) + rc, out, _err = runvol_plugin("windows.pslist.PsList", image, volatility, python) out = out.lower() assert out.find(b"system") != -1 assert out.find(b"csrss.exe") != -1 @@ -69,7 +69,7 @@ def test_windows_pslist(image, volatility, python): assert out.count(b"\n") > 10 assert rc == 0 - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "windows.pslist.PsList", image, volatility, python, pluginargs=["--pid", "4"] ) out = out.lower() @@ -79,7 +79,7 @@ def test_windows_pslist(image, volatility, python): def test_windows_psscan(image, volatility, python): - rc, out, err = runvol_plugin("windows.psscan.PsScan", image, volatility, python) + rc, out, _err = runvol_plugin("windows.psscan.PsScan", image, volatility, python) out = out.lower() assert out.find(b"system") != -1 assert out.find(b"csrss.exe") != -1 @@ -89,21 +89,21 @@ def test_windows_psscan(image, volatility, python): def test_windows_dlllist(image, volatility, python): - rc, out, err = runvol_plugin("windows.dlllist.DllList", image, volatility, python) + rc, out, _err = runvol_plugin("windows.dlllist.DllList", image, volatility, python) out = out.lower() assert out.count(b"\n") > 10 assert rc == 0 def test_windows_modules(image, volatility, python): - rc, out, err = runvol_plugin("windows.modules.Modules", image, volatility, python) + rc, out, _err = runvol_plugin("windows.modules.Modules", image, volatility, python) out = out.lower() assert out.count(b"\n") > 10 assert rc == 0 def test_windows_hivelist(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "windows.registry.hivelist.HiveList", image, volatility, python ) out = out.lower() @@ -136,7 +136,7 @@ def test_windows_dumpfiles(image, volatility, python): path = tempfile.mkdtemp() - rc, out, err = runvol_plugin( + rc, _out, _err = runvol_plugin( "windows.dumpfiles.DumpFiles", image, volatility, @@ -166,7 +166,7 @@ def test_windows_dumpfiles(image, volatility, python): def test_windows_handles(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "windows.handles.Handles", image, volatility, python, pluginargs=["--pid", "4"] ) @@ -183,7 +183,7 @@ def test_windows_handles(image, volatility, python): def test_windows_svcscan(image, volatility, python): - rc, out, err = runvol_plugin("windows.svcscan.SvcScan", image, volatility, python) + rc, out, _err = runvol_plugin("windows.svcscan.SvcScan", image, volatility, python) assert out.find(b"Microsoft ACPI Driver") != -1 assert out.count(b"\n") > 250 @@ -191,17 +191,19 @@ def test_windows_svcscan(image, volatility, python): def test_windows_thrdscan(image, volatility, python): - rc, out, err = runvol_plugin("windows.thrdscan.ThrdScan", image, volatility, python) + rc, out, _err = runvol_plugin( + "windows.thrdscan.ThrdScan", image, volatility, python + ) # find pid 4 (of system process) which starts with lowest tids assert out.find(b"\t4\t8") != -1 assert out.find(b"\t4\t12") != -1 assert out.find(b"\t4\t16") != -1 - #assert out.find(b"this raieses AssertionError") != -1 + # assert out.find(b"this raieses AssertionError") != -1 assert rc == 0 def test_windows_privileges(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "windows.privileges.Privs", image, volatility, python, pluginargs=["--pid", "4"] ) @@ -213,7 +215,7 @@ def test_windows_privileges(image, volatility, python): def test_windows_getsids(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "windows.getsids.GetSIDs", image, volatility, python, pluginargs=["--pid", "4"] ) @@ -225,7 +227,7 @@ def test_windows_getsids(image, volatility, python): def test_windows_envars(image, volatility, python): - rc, out, err = runvol_plugin("windows.envars.Envars", image, volatility, python) + rc, out, _err = runvol_plugin("windows.envars.Envars", image, volatility, python) assert out.find(b"PATH") != -1 assert out.find(b"PROCESSOR_ARCHITECTURE") != -1 @@ -237,7 +239,7 @@ def test_windows_envars(image, volatility, python): def test_windows_callbacks(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "windows.callbacks.Callbacks", image, volatility, python ) @@ -249,7 +251,7 @@ def test_windows_callbacks(image, volatility, python): def test_windows_vadwalk(image, volatility, python): - rc, out, err = runvol_plugin("windows.vadwalk.VadWalk", image, volatility, python) + rc, out, _err = runvol_plugin("windows.vadwalk.VadWalk", image, volatility, python) assert out.find(b"Vad") != -1 assert out.find(b"VadS") != -1 @@ -260,7 +262,7 @@ def test_windows_vadwalk(image, volatility, python): def test_windows_devicetree(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "windows.devicetree.DeviceTree", image, volatility, python ) @@ -277,7 +279,7 @@ def test_windows_devicetree(image, volatility, python): def test_linux_pslist(image, volatility, python): - rc, out, err = runvol_plugin("linux.pslist.PsList", image, volatility, python) + rc, out, _err = runvol_plugin("linux.pslist.PsList", image, volatility, python) out = out.lower() assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) @@ -287,7 +289,9 @@ def test_linux_pslist(image, volatility, python): def test_linux_check_idt(image, volatility, python): - rc, out, err = runvol_plugin("linux.check_idt.Check_idt", image, volatility, python) + rc, out, _err = runvol_plugin( + "linux.check_idt.Check_idt", image, volatility, python + ) out = out.lower() assert out.count(b"__kernel__") >= 10 @@ -296,7 +300,7 @@ def test_linux_check_idt(image, volatility, python): def test_linux_check_syscall(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "linux.check_syscall.Check_syscall", image, volatility, python ) out = out.lower() @@ -308,7 +312,7 @@ def test_linux_check_syscall(image, volatility, python): def test_linux_lsmod(image, volatility, python): - rc, out, err = runvol_plugin("linux.lsmod.Lsmod", image, volatility, python) + rc, out, _err = runvol_plugin("linux.lsmod.Lsmod", image, volatility, python) out = out.lower() assert out.count(b"\n") > 10 @@ -316,7 +320,7 @@ def test_linux_lsmod(image, volatility, python): def test_linux_lsof(image, volatility, python): - rc, out, err = runvol_plugin("linux.lsof.Lsof", image, volatility, python) + rc, out, _err = runvol_plugin("linux.lsof.Lsof", image, volatility, python) out = out.lower() assert out.count(b"socket:") >= 10 @@ -325,7 +329,7 @@ def test_linux_lsof(image, volatility, python): def test_linux_proc_maps(image, volatility, python): - rc, out, err = runvol_plugin("linux.proc.Maps", image, volatility, python) + rc, out, _err = runvol_plugin("linux.proc.Maps", image, volatility, python) out = out.lower() assert out.count(b"anonymous mapping") >= 10 @@ -334,15 +338,18 @@ def test_linux_proc_maps(image, volatility, python): def test_linux_tty_check(image, volatility, python): - rc, out, err = runvol_plugin("linux.tty_check.tty_check", image, volatility, python) + rc, out, _err = runvol_plugin( + "linux.tty_check.tty_check", image, volatility, python + ) out = out.lower() assert out.find(b"__kernel__") != -1 assert out.count(b"\n") >= 5 assert rc == 0 + def test_linux_sockstat(image, volatility, python): - rc, out, err = runvol_plugin("linux.sockstat.Sockstat", image, volatility, python) + rc, out, _err = runvol_plugin("linux.sockstat.Sockstat", image, volatility, python) assert out.count(b"AF_UNIX") >= 354 assert out.count(b"AF_BLUETOOTH") >= 5 @@ -354,7 +361,7 @@ def test_linux_sockstat(image, volatility, python): def test_linux_library_list(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "linux.library_list.LibraryList", image, volatility, python ) @@ -383,7 +390,7 @@ def test_linux_library_list(image, volatility, python): def test_mac_pslist(image, volatility, python): - rc, out, err = runvol_plugin("mac.pslist.PsList", image, volatility, python) + rc, out, _err = runvol_plugin("mac.pslist.PsList", image, volatility, python) out = out.lower() assert (out.find(b"kernel_task") != -1) or (out.find(b"launchd") != -1) @@ -392,7 +399,7 @@ def test_mac_pslist(image, volatility, python): def test_mac_check_syscall(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "mac.check_syscall.Check_syscall", image, volatility, python ) out = out.lower() @@ -405,7 +412,7 @@ def test_mac_check_syscall(image, volatility, python): def test_mac_check_sysctl(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "mac.check_sysctl.Check_sysctl", image, volatility, python ) out = out.lower() @@ -416,7 +423,7 @@ def test_mac_check_sysctl(image, volatility, python): def test_mac_check_trap_table(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "mac.check_trap_table.Check_trap_table", image, volatility, python ) out = out.lower() @@ -427,7 +434,7 @@ def test_mac_check_trap_table(image, volatility, python): def test_mac_ifconfig(image, volatility, python): - rc, out, err = runvol_plugin("mac.ifconfig.Ifconfig", image, volatility, python) + rc, out, _err = runvol_plugin("mac.ifconfig.Ifconfig", image, volatility, python) out = out.lower() assert out.find(b"127.0.0.1") != -1 @@ -437,7 +444,7 @@ def test_mac_ifconfig(image, volatility, python): def test_mac_lsmod(image, volatility, python): - rc, out, err = runvol_plugin("mac.lsmod.Lsmod", image, volatility, python) + rc, out, _err = runvol_plugin("mac.lsmod.Lsmod", image, volatility, python) out = out.lower() assert out.find(b"com.apple") != -1 @@ -446,7 +453,7 @@ def test_mac_lsmod(image, volatility, python): def test_mac_lsof(image, volatility, python): - rc, out, err = runvol_plugin("mac.lsof.Lsof", image, volatility, python) + rc, out, _err = runvol_plugin("mac.lsof.Lsof", image, volatility, python) out = out.lower() assert out.count(b"\n") > 50 @@ -454,7 +461,7 @@ def test_mac_lsof(image, volatility, python): def test_mac_malfind(image, volatility, python): - rc, out, err = runvol_plugin("mac.malfind.Malfind", image, volatility, python) + rc, out, _err = runvol_plugin("mac.malfind.Malfind", image, volatility, python) out = out.lower() assert out.count(b"\n") > 20 @@ -462,7 +469,7 @@ def test_mac_malfind(image, volatility, python): def test_mac_mount(image, volatility, python): - rc, out, err = runvol_plugin("mac.mount.Mount", image, volatility, python) + rc, out, _err = runvol_plugin("mac.mount.Mount", image, volatility, python) out = out.lower() assert out.find(b"/dev") != -1 @@ -471,7 +478,7 @@ def test_mac_mount(image, volatility, python): def test_mac_netstat(image, volatility, python): - rc, out, err = runvol_plugin("mac.netstat.Netstat", image, volatility, python) + rc, out, _err = runvol_plugin("mac.netstat.Netstat", image, volatility, python) assert out.find(b"TCP") != -1 assert out.find(b"UDP") != -1 @@ -481,7 +488,7 @@ def test_mac_netstat(image, volatility, python): def test_mac_proc_maps(image, volatility, python): - rc, out, err = runvol_plugin("mac.proc_maps.Maps", image, volatility, python) + rc, out, _err = runvol_plugin("mac.proc_maps.Maps", image, volatility, python) out = out.lower() assert out.find(b"[heap]") != -1 @@ -490,7 +497,7 @@ def test_mac_proc_maps(image, volatility, python): def test_mac_psaux(image, volatility, python): - rc, out, err = runvol_plugin("mac.psaux.Psaux", image, volatility, python) + rc, out, _err = runvol_plugin("mac.psaux.Psaux", image, volatility, python) out = out.lower() assert out.find(b"executable_path") != -1 @@ -499,7 +506,7 @@ def test_mac_psaux(image, volatility, python): def test_mac_socket_filters(image, volatility, python): - rc, out, err = runvol_plugin( + rc, out, _err = runvol_plugin( "mac.socket_filters.Socket_filters", image, volatility, python ) out = out.lower() @@ -509,7 +516,7 @@ def test_mac_socket_filters(image, volatility, python): def test_mac_timers(image, volatility, python): - rc, out, err = runvol_plugin("mac.timers.Timers", image, volatility, python) + rc, out, _err = runvol_plugin("mac.timers.Timers", image, volatility, python) out = out.lower() assert out.count(b"\n") > 6 @@ -517,7 +524,9 @@ def test_mac_timers(image, volatility, python): def test_mac_trustedbsd(image, volatility, python): - rc, out, err = runvol_plugin("mac.trustedbsd.Trustedbsd", image, volatility, python) + rc, out, _err = runvol_plugin( + "mac.trustedbsd.Trustedbsd", image, volatility, python + ) out = out.lower() assert out.count(b"\n") > 10 From 97534f02de61202475c5c3aa9418488d886f744c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 12:19:56 +1100 Subject: [PATCH 0094/1352] linux: sockstat: It should import and verify the pslist version directly, instead of relying on lsof --- volatility3/framework/plugins/linux/sockstat.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 0ddd3e26d..e5cf48d16 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -12,6 +12,7 @@ from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.symbols import linux from volatility3.plugins.linux import lsof +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) @@ -21,7 +22,6 @@ class SockHandlers(interfaces.configuration.VersionableInterface): """Handles several socket families extracting the sockets information.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) def __init__(self, vmlinux, task, *args, **kwargs): @@ -438,8 +438,7 @@ class Sockstat(plugins.PluginInterface): """Lists all network connections for all processes.""" _required_framework_version = (2, 0, 0) - - _version = (3, 0, 0) + _version = (3, 0, 1) @classmethod def get_requirements(cls): @@ -455,6 +454,9 @@ class Sockstat(plugins.PluginInterface): requirements.PluginRequirement( name="lsof", plugin=lsof.Lsof, version=(2, 0, 0) ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), @@ -591,7 +593,7 @@ class Sockstat(plugins.PluginInterface): tasks: String with a list of tasks and FDs using a socket. It can also have extended information such as socket filters, bpf info, etc. """ - filter_func = lsof.pslist.PsList.create_pid_filter(pids) + filter_func = pslist.PsList.create_pid_filter(pids) socket_generator = self.list_sockets( self.context, symbol_table, filter_func=filter_func ) From fa060646352d41cf6d818e6cb8c40deaa91e7e7f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 13:16:33 +1100 Subject: [PATCH 0095/1352] linux plugins: Update pslist major version and its 18 dependent plugins --- volatility3/framework/plugins/linux/bash.py | 3 ++- volatility3/framework/plugins/linux/boottime.py | 4 ++-- .../framework/plugins/linux/capabilities.py | 7 +++---- .../framework/plugins/linux/check_creds.py | 5 ++--- volatility3/framework/plugins/linux/elfs.py | 4 ++-- volatility3/framework/plugins/linux/envars.py | 3 ++- volatility3/framework/plugins/linux/kthreads.py | 5 ++--- .../framework/plugins/linux/library_list.py | 5 ++--- volatility3/framework/plugins/linux/lsof.py | 4 ++-- volatility3/framework/plugins/linux/malfind.py | 5 +++-- volatility3/framework/plugins/linux/mountinfo.py | 5 ++--- .../framework/plugins/linux/pidhashtable.py | 9 ++++----- volatility3/framework/plugins/linux/proc.py | 5 +++-- volatility3/framework/plugins/linux/psaux.py | 3 ++- volatility3/framework/plugins/linux/pslist.py | 3 +-- volatility3/framework/plugins/linux/pstree.py | 15 +++++++-------- volatility3/framework/plugins/linux/ptrace.py | 4 ++-- .../framework/plugins/linux/vmaregexscan.py | 5 +++-- .../framework/plugins/linux/vmayarascan.py | 4 ++-- 19 files changed, 48 insertions(+), 50 deletions(-) diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index ce4567ca6..77a433a3b 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -22,6 +22,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -32,7 +33,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/boottime.py b/volatility3/framework/plugins/linux/boottime.py index 8f63ee7f8..3df5cb3ac 100644 --- a/volatility3/framework/plugins/linux/boottime.py +++ b/volatility3/framework/plugins/linux/boottime.py @@ -16,7 +16,7 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) _required_framework_version = (2, 11, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -27,7 +27,7 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 3, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index bfdb69aba..a8a8fb1fa 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -50,8 +50,7 @@ class Capabilities(plugins.PluginInterface): """Lists process capabilities""" _required_framework_version = (2, 0, 0) - - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -62,7 +61,7 @@ class Capabilities(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pids", @@ -87,7 +86,7 @@ class Capabilities(plugins.PluginInterface): try: kernel_cap_last_cap = vmlinux.object_from_symbol(symbol_name="cap_last_cap") except exceptions.SymbolError: - # It should be a kernel < 3.2 + # It should be a kernel < 3.2 See 73efc0394e148d0e15583e13712637831f926720 return None vol2_last_cap = extensions.kernel_cap_struct.get_last_cap_value() diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index b7f73c3eb..0857576d5 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -12,8 +12,7 @@ class Check_creds(interfaces.plugins.PluginInterface): """Checks if any processes are sharing credential structures""" _required_framework_version = (2, 0, 0) - - _version = (2, 0, 0) + _version = (2, 0, 1) @classmethod def get_requirements(cls): @@ -24,7 +23,7 @@ class Check_creds(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index 22e39d127..9f3bd274b 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -25,7 +25,7 @@ class Elfs(plugins.PluginInterface): """Lists all memory mapped ELF files for all processes.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + _version = (2, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -36,7 +36,7 @@ class Elfs(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index 5cbf0f502..22aba6408 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -17,6 +17,7 @@ class Envars(plugins.PluginInterface): """Lists processes with their environment variables""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -28,7 +29,7 @@ class Envars(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index 2e51b4688..b9ced73f3 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -20,8 +20,7 @@ class Kthreads(plugins.PluginInterface): """Enumerates kthread functions""" _required_framework_version = (2, 11, 0) - - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -35,7 +34,7 @@ class Kthreads(plugins.PluginInterface): name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 3, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/library_list.py b/volatility3/framework/plugins/linux/library_list.py index 062ed078e..7ec1f7f7f 100644 --- a/volatility3/framework/plugins/linux/library_list.py +++ b/volatility3/framework/plugins/linux/library_list.py @@ -21,8 +21,7 @@ class LibraryList(interfaces.plugins.PluginInterface): """Enumerate libraries loaded into processes""" _required_framework_version = (2, 0, 0) - - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -33,7 +32,7 @@ class LibraryList(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 2, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pids", diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 42b447dfb..802954f43 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -110,7 +110,7 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists open files for each processes.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -121,7 +121,7 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 18f3dcd56..0b10e60c6 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -4,7 +4,7 @@ from typing import List import logging -from volatility3.framework import constants, interfaces +from volatility3.framework import interfaces from volatility3.framework import renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility @@ -18,6 +18,7 @@ class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -28,7 +29,7 @@ class Malfind(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index 2499f009e..65775c4aa 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -36,8 +36,7 @@ class MountInfo(plugins.PluginInterface): """Lists mount points on processes mount namespaces""" _required_framework_version = (2, 2, 0) - - _version = (1, 2, 1) + _version = (1, 2, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -48,7 +47,7 @@ class MountInfo(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) diff --git a/volatility3/framework/plugins/linux/pidhashtable.py b/volatility3/framework/plugins/linux/pidhashtable.py index edafe97e0..2d210c233 100644 --- a/volatility3/framework/plugins/linux/pidhashtable.py +++ b/volatility3/framework/plugins/linux/pidhashtable.py @@ -19,8 +19,7 @@ class PIDHashTable(plugins.PluginInterface): """Enumerates processes through the PID hash table""" _required_framework_version = (2, 0, 0) - - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -31,7 +30,7 @@ class PIDHashTable(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) @@ -236,8 +235,8 @@ class PIDHashTable(plugins.PluginInterface): self, decorate_comm: bool = False ) -> interfaces.objects.ObjectInterface: for task in self.get_tasks(): - offset, pid, tid, ppid, name = pslist.PsList.get_task_fields( - task, decorate_comm + offset, pid, tid, ppid, name, _creation_time = ( + pslist.PsList.get_task_fields(task, decorate_comm) ) fields = format_hints.Hex(offset), pid, tid, ppid, name yield 0, fields diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index e7d38b107..00832140a 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -21,7 +21,8 @@ class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) + MAXSIZE_DEFAULT = 1024 * 1024 * 1024 # 1 Gb @classmethod @@ -34,7 +35,7 @@ class Maps(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/psaux.py b/volatility3/framework/plugins/linux/psaux.py index a4a23498f..5467c3b4c 100644 --- a/volatility3/framework/plugins/linux/psaux.py +++ b/volatility3/framework/plugins/linux/psaux.py @@ -15,6 +15,7 @@ class PsAux(plugins.PluginInterface): """Lists processes with their command line arguments""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -26,7 +27,7 @@ class PsAux(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index b05d69c7a..6460462a7 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -18,8 +18,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular linux memory image.""" _required_framework_version = (2, 0, 0) - - _version = (2, 3, 0) + _version = (3, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index efe5223df..9dc5ea3cc 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -13,6 +13,7 @@ class PsTree(interfaces.plugins.PluginInterface): ID.""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -24,7 +25,7 @@ class PsTree(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 2, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -100,13 +101,11 @@ class PsTree(interfaces.plugins.PluginInterface): def yield_processes(pid): task = self._tasks[pid] - row = pslist.PsList.get_task_fields(task, decorate_comm) - # update the first element, the offset, in the row tuple to use format_hints.Hex - # as a simple int is returned from get_task_fields. - row = (format_hints.Hex(row[0]),) + row[1:] - - tid = task.pid - yield (self._levels[tid] - 1, row) + offset, pid, tid, ppid, name, _creation_time = ( + pslist.PsList.get_task_fields(task, decorate_comm) + ) + fields = format_hints.Hex(offset), pid, tid, ppid, name + yield (self._levels[tid] - 1, fields) for child_pid in sorted(self._children.get(tid, [])): yield from yield_processes(child_pid) diff --git a/volatility3/framework/plugins/linux/ptrace.py b/volatility3/framework/plugins/linux/ptrace.py index e467ee644..271c0e75e 100644 --- a/volatility3/framework/plugins/linux/ptrace.py +++ b/volatility3/framework/plugins/linux/ptrace.py @@ -19,7 +19,7 @@ class Ptrace(plugins.PluginInterface): """Enumerates ptrace's tracer and tracee tasks""" _required_framework_version = (2, 10, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -30,7 +30,7 @@ class Ptrace(plugins.PluginInterface): architectures=architectures.LINUX_ARCHS, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 2, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/vmaregexscan.py b/volatility3/framework/plugins/linux/vmaregexscan.py index 77ab29814..4446fc550 100644 --- a/volatility3/framework/plugins/linux/vmaregexscan.py +++ b/volatility3/framework/plugins/linux/vmaregexscan.py @@ -21,7 +21,8 @@ class VmaRegExScan(plugins.PluginInterface): """Scans all virtual memory areas for tasks using RegEx.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) + MAXSIZE_DEFAULT = 128 @classmethod @@ -34,7 +35,7 @@ class VmaRegExScan(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 9fe06b0c8..38d6cbaac 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -15,7 +15,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): """Scans all virtual memory areas for tasks using yara.""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -28,7 +28,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) From 63ac0abe642b4ba7fe93edfd2be0d6dd32e0483d Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 13:25:08 +1100 Subject: [PATCH 0096/1352] linux: Add 15 new test cases for plugins dependent on pslist --- test/test_volatility.py | 165 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 165 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index 2f3ba3c63..4e948a2bd 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -386,6 +386,171 @@ def test_linux_library_list(image, volatility, python): assert rc == 0 +def test_linux_pstree(image, volatility, python): + rc, out, _err = runvol_plugin("linux.pstree.PsTree", image, volatility, python) + out = out.lower() + + assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_pidhashtable(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.pidhashtable.PIDHashTable", image, volatility, python + ) + out = out.lower() + + assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_bash(image, volatility, python): + rc, out, _err = runvol_plugin("linux.bash.Bash", image, volatility, python) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_boottime(image, volatility, python): + rc, out, _err = runvol_plugin("linux.boottime.Boottime", image, volatility, python) + out = out.lower() + + assert out.count(b"utc") >= 1 + assert rc == 0 + + +def test_linux_capabilities(image, volatility, python): + rc, out, err = runvol_plugin( + "linux.capabilities.Capabilities", + image, + volatility, + python, + globalargs=["-vvv"], + ) + if rc != 0 and err.count(b"Unsupported kernel capabilities implementation") > 0: + # The linux-sample-1.bin kernel implementation isn't supported. + # However, we can still check that the plugin requirements are met. + return None + + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_check_creds(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.check_creds.Check_creds", image, volatility, python + ) + out = out.lower() + + # linux-sample-1.bin has no processes sharing credentials. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + + +def test_linux_elfs(image, volatility, python): + rc, out, _err = runvol_plugin("linux.elfs.Elfs", image, volatility, python) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_envars(image, volatility, python): + rc, out, _err = runvol_plugin("linux.envars.Envars", image, volatility, python) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_kthreads(image, volatility, python): + rc, out, err = runvol_plugin( + "linux.kthreads.Kthreads", + image, + volatility, + python, + globalargs=["-vvv"], + ) + out = out.lower() + + if rc != 0 and err.count(b"Unsupported kthread implementation") > 0: + # The linux-sample-1.bin kernel implementation isn't supported. + # However, we can still check that the plugin requirements are met. + return None + + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_malfind(image, volatility, python): + rc, out, _err = runvol_plugin("linux.malfind.Malfind", image, volatility, python) + out = out.lower() + + # linux-sample-1.bin has no process memory ranges with potential injected code. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + + +def test_linux_mountinfo(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.mountinfo.MountInfo", image, volatility, python + ) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_psaux(image, volatility, python): + rc, out, _err = runvol_plugin("linux.psaux.PsAux", image, volatility, python) + out = out.lower() + + assert out.count(b"\n") > 50 + assert rc == 0 + + +def test_linux_ptrace(image, volatility, python): + rc, out, _err = runvol_plugin("linux.ptrace.Ptrace", image, volatility, python) + out = out.lower() + + # linux-sample-1.bin has no processes being ptreaced. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + + +def test_linux_vmaregexscan(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.vmaregexscan.VmaRegExScan", + image, + volatility, + python, + pluginargs=["--pid", "1", "--pattern", "\\x7fELF"], + ) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + +def test_linux_vmayarascan(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.vmayarascan.VmaYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "1", "--yara-string", "ELF"], + ) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + # MAC From fb4ab9d4778b61e3a7af7761acac29f3bfe17ffd Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 13:45:26 +1100 Subject: [PATCH 0097/1352] linux: test cases: remove unused variables --- test/test_volatility.py | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 4e948a2bd..c0cc11cd3 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -442,10 +442,9 @@ def test_linux_capabilities(image, volatility, python): def test_linux_check_creds(image, volatility, python): - rc, out, _err = runvol_plugin( + rc, _out, _err = runvol_plugin( "linux.check_creds.Check_creds", image, volatility, python ) - out = out.lower() # linux-sample-1.bin has no processes sharing credentials. # This validates that plugin requirements are met and exceptions are not raised. @@ -488,8 +487,7 @@ def test_linux_kthreads(image, volatility, python): def test_linux_malfind(image, volatility, python): - rc, out, _err = runvol_plugin("linux.malfind.Malfind", image, volatility, python) - out = out.lower() + rc, _out, _err = runvol_plugin("linux.malfind.Malfind", image, volatility, python) # linux-sample-1.bin has no process memory ranges with potential injected code. # This validates that plugin requirements are met and exceptions are not raised. @@ -515,8 +513,7 @@ def test_linux_psaux(image, volatility, python): def test_linux_ptrace(image, volatility, python): - rc, out, _err = runvol_plugin("linux.ptrace.Ptrace", image, volatility, python) - out = out.lower() + rc, _out, _err = runvol_plugin("linux.ptrace.Ptrace", image, volatility, python) # linux-sample-1.bin has no processes being ptreaced. # This validates that plugin requirements are met and exceptions are not raised. From 9048cd1ab8683edac7d2ccfeb7fdcbee13d447df Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 13:47:03 +1100 Subject: [PATCH 0098/1352] linux: boottime: Minor, removed unnecessary blank line --- volatility3/framework/plugins/linux/boottime.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/boottime.py b/volatility3/framework/plugins/linux/boottime.py index 3df5cb3ac..56de52883 100644 --- a/volatility3/framework/plugins/linux/boottime.py +++ b/volatility3/framework/plugins/linux/boottime.py @@ -15,7 +15,6 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) """Shows the time the system was started""" _required_framework_version = (2, 11, 0) - _version = (1, 0, 1) @classmethod From aaeec80fdf4650be6a9b1f6c25ef5ba4aea03e29 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 13:53:11 +1100 Subject: [PATCH 0099/1352] linux: library_list testcase: Optimize testing performance by limiting the number of processes to just one. This change will reduce execution time and speed up the test --- test/test_volatility.py | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index c0cc11cd3..eb365ccf3 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -362,27 +362,19 @@ def test_linux_sockstat(image, volatility, python): def test_linux_library_list(image, volatility, python): rc, out, _err = runvol_plugin( - "linux.library_list.LibraryList", image, volatility, python + "linux.library_list.LibraryList", + image, + volatility, + python, + pluginargs=["--pids", "2363"], ) assert re.search( rb"NetworkManager\s2363\s0x7f52cdda0000\s/lib/x86_64-linux-gnu/libnss_files.so.2", out, ) - assert re.search( - rb"gnome-settings-\s3807\s0x7f7e660b5000\s/lib/x86_64-linux-gnu/libbz2.so.1.0", - out, - ) - assert re.search( - rb"gdu-notificatio\s3878\s0x7f25ce33e000\s/usr/lib/x86_64-linux-gnu/libXau.so.6", - out, - ) - assert re.search( - rb"bash\s8600\s0x7fe78a85f000\s/lib/x86_64-linux-gnu/libnss_files.so.2", - out, - ) - assert out.count(b"\n") >= 2677 + assert out.count(b"\n") > 10 assert rc == 0 From 8ecd7e2ddddb018164d3ef734899b91a93899d09 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 28 Nov 2024 15:17:22 +1100 Subject: [PATCH 0100/1352] Linux/Mac: Log producer information --- .../framework/automagic/symbol_finder.py | 31 ++++++++++++++++--- volatility3/framework/symbols/intermed.py | 15 ++++++--- volatility3/framework/symbols/metadata.py | 13 +++++++- 3 files changed, 49 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 21e594549..55e2ad6f5 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -142,11 +142,11 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): ) for _, banner in banner_list: - vollog.debug(f"Identified banner: {repr(banner)}") - symbol_files = self.banners.get(banner, None) - if symbol_files: - isf_path = symbol_files - vollog.debug(f"Using symbol library: {symbol_files}") + vollog.debug(f"Identified banner: {banner!r}") + symbols_file = self.banners.get(banner, None) + if symbols_file: + isf_path = symbols_file + vollog.debug(f"Using symbol library: {symbols_file}") clazz = self.symbol_class # Set the discovered options path_join = interfaces.configuration.path_join @@ -160,8 +160,29 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): path_join(config_path, requirement.name, "symbol_mask") ] = layer.address_mask + # Keep track of the existing table names so we know which ones were added + old_table_names = set(context.symbol_space._dict) + # Construct the appropriate symbol table requirement.construct(context, config_path) + + new_table_names = context.symbol_space._dict.keys() - old_table_names + # It should add only one symbol table. Ignore the next steps if it doesn't + if len(new_table_names) == 1: + new_table_name = new_table_names.pop() + symbol_table = context.symbol_space._dict[new_table_name] + producer = symbol_table.producer + vollog.debug( + f"producer_name: {producer.name}, producer_version: {producer.version_string}" + ) + for category in symbol_table.metadata._json_data: + vollog.debug(f"{category}:") + for subkey in symbol_table.metadata._json_data[category]: + subkey_item = ", ".join( + f"{key}: '{value}'" for key, value in subkey.items() + ) + vollog.debug(f"\t{subkey_item}") + break else: vollog.debug(f"Symbol library path not found for: {banner}") diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 751f88e39..5f558bf12 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -738,10 +738,17 @@ class Version6Format(Version5Format): @property def metadata(self) -> Optional[interfaces.symbols.MetadataInterface]: """Returns a MetadataInterface object.""" - if self._json_object.get("metadata", {}).get("windows"): - return metadata.WindowsMetadata(self._json_object["metadata"]["windows"]) - if self._json_object.get("metadata", {}).get("linux"): - return metadata.LinuxMetadata(self._json_object["metadata"]["linux"]) + if "metadata" not in self._json_object: + return None + + json_metadata = self._json_object["metadata"] + if "windows" in json_metadata: + return metadata.WindowsMetadata(json_metadata["windows"]) + if "linux" in json_metadata: + return metadata.LinuxMetadata(json_metadata["linux"]) + if "mac" in json_metadata: + return metadata.MacMetadata(json_metadata["mac"]) + return None diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 95f542f07..39ddd6544 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -18,10 +18,17 @@ class ProducerMetadata(interfaces.symbols.MetadataInterface): def name(self) -> Optional[str]: return self._json_data.get("name", None) + @property + def version_string(self) -> str: + """Returns the ISF file producer's version as a string. + If no version is present, an empty string is returned. + """ + return self._json_data.get("version", "") + @property def version(self) -> Optional[Tuple[int]]: """Returns the version of the ISF file producer""" - version = self._json_data.get("version", None) + version = self.version_string() if not version: return None if all(x in "0123456789." for x in version): @@ -81,3 +88,7 @@ class WindowsMetadata(interfaces.symbols.MetadataInterface): class LinuxMetadata(interfaces.symbols.MetadataInterface): """Class to handle the metadata from a Linux symbol table.""" + + +class MacMetadata(interfaces.symbols.MetadataInterface): + """Class to handle the metadata from a Mac symbol table.""" From 3748cb89b8e2493fd8792315a9b3419d9a26dfb3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 28 Nov 2024 10:22:45 +0000 Subject: [PATCH 0101/1352] Windows: Improve debugging output for pdbscan --- volatility3/framework/automagic/pdbscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 1d5bf55ea..3751b383e 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -272,7 +272,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): for kernel in kernels: vollog.log( constants.LOGLEVEL_VVVV, - f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1)} with MZ offset at {kernel.get('mz_offset', -1)}", + f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1):x} with MZ offset at {kernel.get('mz_offset', -1):x}", ) valid_kernel = test_kernel(physical_layer_name, virtual_layer_name, kernel) if valid_kernel is not None: From bec6bc659475b7fc016f1b05093e7783ca70d904 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 28 Nov 2024 16:59:52 +0000 Subject: [PATCH 0102/1352] Fix up vmayarascan and vadyarascan to use yarascan properly --- .../framework/plugins/linux/vmayarascan.py | 58 +++++++++------ .../framework/plugins/windows/vadyarascan.py | 71 ++++++++----------- 2 files changed, 64 insertions(+), 65 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 9fe06b0c8..3d8eb603b 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging from typing import Iterable, List, Tuple from volatility3.framework import interfaces, renderers @@ -10,6 +11,8 @@ from volatility3.framework.renderers import format_hints from volatility3.plugins import yarascan from volatility3.plugins.linux import pslist +vollog = logging.getLogger(__name__) + class VmaYaraScan(interfaces.plugins.PluginInterface): """Scans all virtual memory areas for tasks using yara.""" @@ -50,6 +53,8 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): # use yarascan to parse the yara options provided and create the rules rules = yarascan.YaraScan.process_yara_options(dict(self.config)) + sanity_check = 1024 * 1024 * 1024 # 1 GB + # filter based on the pid option if provided filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for task in pslist.PsList.list_tasks( @@ -66,29 +71,36 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): # get the proc_layer object from the context proc_layer = self.context.layers[proc_layer_name] - for start, end in self.get_vma_maps(task): - for match in rules.match( - data=proc_layer.read(start, end - start, True) - ): - if yarascan.YaraScan.yara_returns_instances(): - for match_string in match.strings: - for instance in match_string.instances: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - match.rule, - match_string.identifier, - instance.matched_data, - ) - else: - for offset, name, value in match.strings: - yield 0, ( - format_hints.Hex(offset + start), - task.tgid, - match.rule, - name, - value, - ) + vma_maps = list(self.get_vma_maps(task)) + insane_vma_maps = [ + start for (start, size) in vma_maps if size > sanity_check + ] + for start in insane_vma_maps: + vollog.debug(f"VMA at 0x{start:x} over sanity-check size, not scanning") + + if not vma_maps: + vollog.warning(f"No VMAs were found for task {task.pid}, aborting") + continue + + max_vma_size: int = max( + [size for (start, size) in vma_maps if size <= sanity_check] + ) + scanner = yarascan.YaraScanner(rules=rules) + scanner.chunk_size = max_vma_size + + # scan the process layer with the yarascanner + for offset, rule_name, name, value in proc_layer.scan( + context=self.context, + scanner=scanner, + sections=vma_maps, + ): + yield 0, ( + format_hints.Hex(offset), + task.tgid, + rule_name, + name, + value, + ) @staticmethod def get_vma_maps( diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index efcc70d07..65006bdc2 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -32,6 +32,9 @@ class VadYaraScan(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) + ), requirements.PluginRequirement( name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) ), @@ -66,49 +69,33 @@ class VadYaraScan(interfaces.plugins.PluginInterface): ): layer_name = task.add_process_layer() layer = self.context.layers[layer_name] - for start, size in self.get_vad_maps(task): - if size > sanity_check: - vollog.debug( - f"VAD at 0x{start:x} over sanity-check size, not scanning" - ) - continue - data = layer.read(start, size, True) - if not yarascan.YaraScan._yara_x: - for match in rules.match(data=data): - if yarascan.YaraScan.yara_returns_instances(): - for match_string in match.strings: - for instance in match_string.instances: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - match.rule, - match_string.identifier, - instance.matched_data, - ) - else: - for offset, name, value in match.strings: - yield 0, ( - format_hints.Hex(offset + start), - task.UniqueProcessId, - match.rule, - name, - value, - ) - else: - for match in rules.scan(data).matching_rules: - for match_string in match.patterns: - for instance in match_string.matches: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - f"{match.namespace}.{match.identifier}", - match_string.identifier, - data[ - instance.offset : instance.offset - + instance.length - ], - ) + vad_maps = list(self.get_vad_maps(task)) + insane_vad_maps = [ + start for (start, size) in vad_maps if size > sanity_check + ] + for start in insane_vad_maps: + vollog.debug(f"VAD at 0x{start:x} over sanity-check size, not scanning") + + max_vad_size: int = max( + [size for (start, size) in vad_maps if size <= sanity_check] + ) + scanner = yarascan.YaraScanner(rules=rules) + scanner.chunk_size = max_vad_size + + # scan the process layer with the yarascanner + for offset, rule_name, name, value in layer.scan( + context=self.context, + scanner=scanner, + sections=vad_maps, + ): + yield 0, ( + format_hints.Hex(offset), + task.UniqueProcessId, + rule_name, + name, + value, + ) @staticmethod def get_vad_maps( From b8023f0c97ae97253ab9b8eae99e1dc4cba1eb79 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 29 Nov 2024 19:05:27 +1100 Subject: [PATCH 0103/1352] Linux/Mac: Address code review suggestions - Add getters for Linux/Mac ISF sources - Avoid using internal attributes - Use the dict repr instead of walking the dict to simplify code --- .../framework/automagic/symbol_finder.py | 26 ++++++++++--------- volatility3/framework/symbols/metadata.py | 19 +++++++++++--- 2 files changed, 29 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 55e2ad6f5..6d689e194 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -161,27 +161,29 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): ] = layer.address_mask # Keep track of the existing table names so we know which ones were added - old_table_names = set(context.symbol_space._dict) + old_table_names = set(context.symbol_space) # Construct the appropriate symbol table requirement.construct(context, config_path) - new_table_names = context.symbol_space._dict.keys() - old_table_names + new_table_names = set(context.symbol_space) - old_table_names # It should add only one symbol table. Ignore the next steps if it doesn't if len(new_table_names) == 1: new_table_name = new_table_names.pop() - symbol_table = context.symbol_space._dict[new_table_name] - producer = symbol_table.producer + symbol_table = context.symbol_space[new_table_name] + producer_metadata = symbol_table.producer vollog.debug( - f"producer_name: {producer.name}, producer_version: {producer.version_string}" + f"producer_name: {producer_metadata.name}, producer_version: {producer_metadata.version_string}" ) - for category in symbol_table.metadata._json_data: - vollog.debug(f"{category}:") - for subkey in symbol_table.metadata._json_data[category]: - subkey_item = ", ".join( - f"{key}: '{value}'" for key, value in subkey.items() - ) - vollog.debug(f"\t{subkey_item}") + + symbol_metadata = symbol_table.metadata + vollog.debug("Types:") + for types_source_dict in symbol_metadata.get_types_sources(): + vollog.debug(f"\t{types_source_dict}") + + vollog.debug("Symbols:") + for symbol_source_dict in symbol_metadata.get_symbols_sources(): + vollog.debug(f"\t{symbol_source_dict}") break else: diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 39ddd6544..02e9cc489 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -4,8 +4,7 @@ import datetime import logging -from typing import Optional, Tuple, Union - +from typing import Optional, Tuple, Union, List, Dict from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) @@ -86,9 +85,21 @@ class WindowsMetadata(interfaces.symbols.MetadataInterface): return self._json_data.get("pdb", {}).get("age", None) -class LinuxMetadata(interfaces.symbols.MetadataInterface): +class DwarfMetadata(interfaces.symbols.MetadataInterface): + """Base class to handle metadata of DWARF-based ISF sources""" + + def get_types_sources(self) -> List[Optional[Dict]]: + """Returns the types sources metadata""" + return self._json_data.get("types", []) + + def get_symbols_sources(self) -> List[Optional[Dict]]: + """Returns the symbols sources metadata""" + return self._json_data.get("symbols", []) + + +class LinuxMetadata(DwarfMetadata): """Class to handle the metadata from a Linux symbol table.""" -class MacMetadata(interfaces.symbols.MetadataInterface): +class MacMetadata(DwarfMetadata): """Class to handle the metadata from a Mac symbol table.""" From 77778ee6f6cfaa9a9af1d73a225c67a8836727c7 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 29 Nov 2024 19:35:18 +1100 Subject: [PATCH 0104/1352] Linux/Mac: ISF metadata: Rename s/DWARF/POSIX/, as I'm not happy with the generic name. BTF source could potentially generate the same keys --- volatility3/framework/symbols/metadata.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 02e9cc489..73ad2cf21 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -85,8 +85,8 @@ class WindowsMetadata(interfaces.symbols.MetadataInterface): return self._json_data.get("pdb", {}).get("age", None) -class DwarfMetadata(interfaces.symbols.MetadataInterface): - """Base class to handle metadata of DWARF-based ISF sources""" +class PosixMetadata(interfaces.symbols.MetadataInterface): + """Base class to handle metadata of Posix-based ISF sources""" def get_types_sources(self) -> List[Optional[Dict]]: """Returns the types sources metadata""" @@ -97,9 +97,9 @@ class DwarfMetadata(interfaces.symbols.MetadataInterface): return self._json_data.get("symbols", []) -class LinuxMetadata(DwarfMetadata): +class LinuxMetadata(PosixMetadata): """Class to handle the metadata from a Linux symbol table.""" -class MacMetadata(DwarfMetadata): +class MacMetadata(PosixMetadata): """Class to handle the metadata from a Mac symbol table.""" From 0030129ff8b440f8f3e43870f87d697b3847baa6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 29 Nov 2024 08:43:04 +0000 Subject: [PATCH 0105/1352] Make suggested fixes to reduce loops and ignore insane sections --- .../framework/plugins/linux/vmayarascan.py | 25 +++++++++-------- .../framework/plugins/windows/vadyarascan.py | 28 ++++++++++++------- 2 files changed, 31 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 3d8eb603b..89210be69 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -71,20 +71,21 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): # get the proc_layer object from the context proc_layer = self.context.layers[proc_layer_name] - vma_maps = list(self.get_vma_maps(task)) - insane_vma_maps = [ - start for (start, size) in vma_maps if size > sanity_check - ] - for start in insane_vma_maps: - vollog.debug(f"VMA at 0x{start:x} over sanity-check size, not scanning") + max_vma_size = 0 + vma_maps_to_scan = [] + for start, size in self.get_vma_maps(task): + if size > sanity_check: + vollog.debug( + f"VMA at 0x{start:x} over sanity-check size, not scanning" + ) + continue + max_vma_size = max(max_vma_size, size) + vma_maps_to_scan.append((start, size)) - if not vma_maps: - vollog.warning(f"No VMAs were found for task {task.pid}, aborting") + if not vma_maps_to_scan: + vollog.warning(f"No VMAs were found for task {task.tgid}, not scanning") continue - max_vma_size: int = max( - [size for (start, size) in vma_maps if size <= sanity_check] - ) scanner = yarascan.YaraScanner(rules=rules) scanner.chunk_size = max_vma_size @@ -92,7 +93,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): for offset, rule_name, name, value in proc_layer.scan( context=self.context, scanner=scanner, - sections=vma_maps, + sections=vma_maps_to_scan, ): yield 0, ( format_hints.Hex(offset), diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 65006bdc2..a67b8dc0b 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -70,16 +70,24 @@ class VadYaraScan(interfaces.plugins.PluginInterface): layer_name = task.add_process_layer() layer = self.context.layers[layer_name] - vad_maps = list(self.get_vad_maps(task)) - insane_vad_maps = [ - start for (start, size) in vad_maps if size > sanity_check - ] - for start in insane_vad_maps: - vollog.debug(f"VAD at 0x{start:x} over sanity-check size, not scanning") + max_vad_size = 0 + vad_maps_to_scan = [] + + for start, size in self.get_vad_maps(task): + if size > sanity_check: + vollog.debug( + f"VAD at 0x{start:x} over sanity-check size, not scanning" + ) + continue + max_vad_size = max(max_vad_size, size) + vad_maps_to_scan.append((start, size)) + + if not vad_maps_to_scan: + vollog.warning( + f"No VADs were found for task {task.UniqueProcessID}, not scanning" + ) + continue - max_vad_size: int = max( - [size for (start, size) in vad_maps if size <= sanity_check] - ) scanner = yarascan.YaraScanner(rules=rules) scanner.chunk_size = max_vad_size @@ -87,7 +95,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): for offset, rule_name, name, value in layer.scan( context=self.context, scanner=scanner, - sections=vad_maps, + sections=vad_maps_to_scan, ): yield 0, ( format_hints.Hex(offset), From 393db1050f7df14d39c6f71bc0782e5422ed3188 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 29 Nov 2024 08:51:06 +0000 Subject: [PATCH 0106/1352] Windows: protect again mz_offsets being None --- volatility3/framework/automagic/pdbscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 3751b383e..0b4f6c73a 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -272,7 +272,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): for kernel in kernels: vollog.log( constants.LOGLEVEL_VVVV, - f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1):x} with MZ offset at {kernel.get('mz_offset', -1):x}", + f"Testing potential kernel for {kernel.get('pdb_name', 'Unknown')} at {kernel.get('signature_offset', -1):x} with MZ offset at {(kernel.get('mz_offset', -1) or -1):x}", ) valid_kernel = test_kernel(physical_layer_name, virtual_layer_name, kernel) if valid_kernel is not None: From 3df385369cbd2489f8e057b616e98a83b79cf397 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Nov 2024 11:28:09 +0000 Subject: [PATCH 0107/1352] Ensure the VAD/VMA gets scanned in a single block --- .../framework/plugins/linux/vmayarascan.py | 28 ++++++++++--------- .../framework/plugins/windows/vadyarascan.py | 25 ++++++++--------- 2 files changed, 27 insertions(+), 26 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 89210be69..8dd64404d 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -36,6 +36,9 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) + ), requirements.ModuleRequirement( name="kernel", description="Linux kernel", @@ -89,19 +92,18 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): scanner = yarascan.YaraScanner(rules=rules) scanner.chunk_size = max_vma_size - # scan the process layer with the yarascanner - for offset, rule_name, name, value in proc_layer.scan( - context=self.context, - scanner=scanner, - sections=vma_maps_to_scan, - ): - yield 0, ( - format_hints.Hex(offset), - task.tgid, - rule_name, - name, - value, - ) + # scan the VMA data (in one contiguous block) with the yarascanner + for start, size in vma_maps_to_scan: + for offset, rule_name, name, value in scanner( + proc_layer.read(start, size, pad=True), start + ): + yield 0, ( + format_hints.Hex(offset), + task.tgid, + rule_name, + name, + value, + ) @staticmethod def get_vma_maps( diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index a67b8dc0b..2e9cc44ea 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -91,19 +91,18 @@ class VadYaraScan(interfaces.plugins.PluginInterface): scanner = yarascan.YaraScanner(rules=rules) scanner.chunk_size = max_vad_size - # scan the process layer with the yarascanner - for offset, rule_name, name, value in layer.scan( - context=self.context, - scanner=scanner, - sections=vad_maps_to_scan, - ): - yield 0, ( - format_hints.Hex(offset), - task.UniqueProcessId, - rule_name, - name, - value, - ) + # scan the VAD data (in one contiguous block) with the yarascanner + for start, size in vad_maps_to_scan: + for offset, rule_name, name, value in scanner( + layer.read(start, size, pad=True), start + ): + yield 0, ( + format_hints.Hex(offset), + task.UniqueProcessId, + rule_name, + name, + value, + ) @staticmethod def get_vad_maps( From 56f6ef0add6d73ecebeb41837a69627f960e8b0d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Nov 2024 11:52:16 +0000 Subject: [PATCH 0108/1352] Include a test developed by @gcmoreira and @eve-mem --- test/test_volatility.py | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index 847be88d9..ea9ad8211 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -14,6 +14,7 @@ import tempfile import hashlib import ntpath import json +import contextlib # # HELPER FUNCTIONS @@ -378,6 +379,42 @@ def test_linux_library_list(image, volatility, python): assert out.count(b"\n") >= 2677 assert rc == 0 +def test_linux_vmayarascan_yara_rule(image, volatility, python): + yara_rule_01 = r""" + rule fullvmayarascan + { + strings: + $s1 = "_nss_files_parse_grent" + $s2 = "/lib64/ld-linux-x86-64.so.2" + $s3 = "(bufferend - (char *) 0) % sizeof (char *) == 0" + condition: + all of them + } + """ + + # FIXME: When the minimum Python version includes 3.12, replace the following with: + # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... + fd, filename = tempfile.mkstemp(suffix=".yar") + try: + with os.fdopen(fd, "w") as f: + f.write(yara_rule_01) + + rc, out, _err = runvol_plugin( + "linux.vmayarascan.VmaYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "8600", "--yara-file", filename], + ) + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(filename) + + out = out.lower() + assert out.count(b"\n") > 4 + assert rc == 0 + + # MAC From 2dc168628936ffcc334c1de37c024dc3d0fd7ff6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 30 Nov 2024 13:36:14 +0000 Subject: [PATCH 0109/1352] Windows: Protect the SERICE_RECORD is_valid function a little more The request to .Order could fail depending on where the structure lies in memory. --- .../symbols/windows/extensions/services.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/services.py b/volatility3/framework/symbols/windows/extensions/services.py index e14de761d..0a2194e07 100644 --- a/volatility3/framework/symbols/windows/extensions/services.py +++ b/volatility3/framework/symbols/windows/extensions/services.py @@ -14,13 +14,16 @@ class SERVICE_RECORD(objects.StructType): def is_valid(self) -> bool: """Determine if the structure is valid.""" - if self.Order < 0 or self.Order > 0xFFFF: - return False - try: - _ = self.State.description - _ = self.Start.description - except ValueError: + if self.Order < 0 or self.Order > 0xFFFF: + return False + + try: + _ = self.State.description + _ = self.Start.description + except ValueError: + return False + except exceptions.InvalidAddressException: return False return True From d404747de5ce622ac1907199ed48b4f9905f2bbc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 1 Dec 2024 00:04:46 +0000 Subject: [PATCH 0110/1352] Tests: Add in vadyarascan tests --- test/test_volatility.py | 58 +++++++++++++++++++++++++++++++++++++++-- 1 file changed, 56 insertions(+), 2 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index ea9ad8211..371dd281c 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -197,7 +197,7 @@ def test_windows_thrdscan(image, volatility, python): assert out.find(b"\t4\t8") != -1 assert out.find(b"\t4\t12") != -1 assert out.find(b"\t4\t16") != -1 - #assert out.find(b"this raieses AssertionError") != -1 + # assert out.find(b"this raieses AssertionError") != -1 assert rc == 0 @@ -274,6 +274,59 @@ def test_windows_devicetree(image, volatility, python): assert rc == 0 +def test_windows_vadyarascan_yara_rule(image, volatility, python): + yara_rule_01 = r""" + rule fullvadyarascan + { + strings: + $s1 = "!This program cannot be run in DOS mode." + $s2 = "Qw))Pw" + $s3 = "W_wD)Pw" + $s4 = "1Xw+2Xw" + $s5 = "xd`wh``w" + $s6 = "0g`w0g`w8g`w8g`w@g`w@g`wHg`wHg`wPg`wPg`wXg`wXg`w`g`w`g`whg`whg`wpg`wpg`wxg`wxg`w" + condition: + all of them + } + """ + + # FIXME: When the minimum Python version includes 3.12, replace the following with: + # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... + fd, filename = tempfile.mkstemp(suffix=".yar") + try: + with os.fdopen(fd, "w") as f: + f.write(yara_rule_01) + + rc, out, _err = runvol_plugin( + "windows.vadyarascan.VadYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "4012", "--yara-file", filename], + ) + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(filename) + + out = out.lower() + assert out.count(b"\n") > 4 + assert rc == 0 + + +def test_windows_vadyarascan(image, volatility, python): + rc, out, _err = runvol_plugin( + "windows.vadyarascan.VadYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "4012", "--yara-string", "MZ"], + ) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + # LINUX @@ -342,6 +395,7 @@ def test_linux_tty_check(image, volatility, python): assert out.count(b"\n") >= 5 assert rc == 0 + def test_linux_sockstat(image, volatility, python): rc, out, err = runvol_plugin("linux.sockstat.Sockstat", image, volatility, python) @@ -379,6 +433,7 @@ def test_linux_library_list(image, volatility, python): assert out.count(b"\n") >= 2677 assert rc == 0 + def test_linux_vmayarascan_yara_rule(image, volatility, python): yara_rule_01 = r""" rule fullvmayarascan @@ -415,7 +470,6 @@ def test_linux_vmayarascan_yara_rule(image, volatility, python): assert rc == 0 - # MAC From 3c20e46902a3cc11ed00fcdf122f375ed1ca4b6c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sun, 1 Dec 2024 12:36:35 +1100 Subject: [PATCH 0111/1352] renderers: Fix HexBytes formatter to apply padding also at the end of the string, ensuring proper output alignment when the pretty renderer justifies each line to the right --- volatility3/cli/text_renderer.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 96970d3ce..31307f67e 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -51,8 +51,10 @@ def hex_bytes_as_text(value: bytes, width: int = 16) -> str: # Handle leftovers when the lenght is not mutiple of width if printables: - output += " " * (width - len(printables)) + padding = width - len(printables) + output += " " * (padding) output += printables + output += " " * (padding) return output From c19a54cbd982fc29c7d937d90c830c1dda3bfd03 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sun, 1 Dec 2024 14:08:53 +1100 Subject: [PATCH 0112/1352] testcases: Minor cleanup: Renaming and reordering functions to align with the Linux/Windows test cases --- test/test_volatility.py | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 97098d1ca..f7cb23e93 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -315,7 +315,7 @@ def test_windows_vadyarascan_yara_rule(image, volatility, python): assert rc == 0 -def test_windows_vadyarascan(image, volatility, python): +def test_windows_vadyarascan_yara_string(image, volatility, python): rc, out, _err = runvol_plugin( "windows.vadyarascan.VadYaraScan", image, @@ -476,6 +476,7 @@ def test_linux_capabilities(image, volatility, python): python, globalargs=["-vvv"], ) + if rc != 0 and err.count(b"Unsupported kernel capabilities implementation") > 0: # The linux-sample-1.bin kernel implementation isn't supported. # However, we can still check that the plugin requirements are met. @@ -521,13 +522,14 @@ def test_linux_kthreads(image, volatility, python): python, globalargs=["-vvv"], ) - out = out.lower() if rc != 0 and err.count(b"Unsupported kthread implementation") > 0: # The linux-sample-1.bin kernel implementation isn't supported. # However, we can still check that the plugin requirements are met. return None + out = out.lower() + assert out.count(b"\n") > 10 assert rc == 0 @@ -580,20 +582,6 @@ def test_linux_vmaregexscan(image, volatility, python): assert rc == 0 -def test_linux_vmayarascan(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.vmayarascan.VmaYaraScan", - image, - volatility, - python, - pluginargs=["--pid", "1", "--yara-string", "ELF"], - ) - out = out.lower() - - assert out.count(b"\n") > 10 - assert rc == 0 - - def test_linux_vmayarascan_yara_rule(image, volatility, python): yara_rule_01 = r""" rule fullvmayarascan @@ -630,6 +618,20 @@ def test_linux_vmayarascan_yara_rule(image, volatility, python): assert rc == 0 +def test_linux_vmayarascan_yara_string(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.vmayarascan.VmaYaraScan", + image, + volatility, + python, + pluginargs=["--pid", "1", "--yara-string", "ELF"], + ) + out = out.lower() + + assert out.count(b"\n") > 10 + assert rc == 0 + + # MAC From 535ce3a22a575c14100ca30627f3d2889fd86c9c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sun, 1 Dec 2024 19:34:35 +1100 Subject: [PATCH 0113/1352] testing: Enable automatic selection of the OS image based on the test and filename prefix, addressing an issue in the development environment. For example, when using VSCode with pytest, test autodiscovery triggers pytest_generate_tests(), adding all images to each test case. This causes issues, as Linux tests end up being executed with Windows and Mac images, and vice versa. --- .github/workflows/test.yaml | 10 ++++++---- test/conftest.py | 33 ++++++++++++++++++++++++++++----- 2 files changed, 34 insertions(+), 9 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 084cce295..dfc42499d 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -25,10 +25,13 @@ jobs: - name: Download images run: | + mkdir test_images + cd test_images curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/linux-sample-1.bin.gz" gunzip linux-sample-1.bin.gz curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz" gunzip win-xp-laptop-2005-06-25.img.gz + cd - - name: Download and Extract symbols run: | @@ -39,13 +42,12 @@ jobs: - name: Testing... run: | - pytest ./test/test_volatility.py --volatility=vol.py --image win-xp-laptop-2005-06-25.img -k test_windows -v - pytest ./test/test_volatility.py --volatility=vol.py --image linux-sample-1.bin -k test_linux -v + pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_windows -v + pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_linux -v - name: Clean up post-test run: | - rm -rf *.bin - rm -rf *.img + rm -rf test_images cd volatility3/symbols rm -rf linux rm -rf linux.zip diff --git a/test/conftest.py b/test/conftest.py index 4ad63065b..0115fade9 100644 --- a/test/conftest.py +++ b/test/conftest.py @@ -35,16 +35,39 @@ def pytest_addoption(parser): def pytest_generate_tests(metafunc): """Parameterize tests based on image names""" - images = metafunc.config.getoption("image") + images = metafunc.config.getoption("image").copy() for image_dir in metafunc.config.getoption("image_dir"): - images = images + [ - os.path.join(image_dir, dir) for dir in os.listdir(image_dir) + images += [ + os.path.join(image_dir, dir_name) for dir_name in os.listdir(image_dir) ] - # tests with "image" parameter are run against images + # tests with "image" parameter are run against image if "image" in metafunc.fixturenames: + filtered_images = [] + ids = [] + for image in images: + image_base = os.path.basename(image) + test_name = metafunc.definition.originalname + if test_name.startswith("test_windows_") and not image_base.startswith( + "win-" + ): + continue + elif test_name.startswith("test_linux_") and not image_base.startswith( + "linux-" + ): + continue + elif test_name.startswith("test_mac_") and not image_base.startswith( + "mac-" + ): + continue + + filtered_images.append(image) + ids.append(image_base) + metafunc.parametrize( - "image", images, ids=[os.path.basename(image) for image in images] + "image", + filtered_images, + ids=ids, ) From 20f15d3591a5e6340ecd2d3628406c01aef71924 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 2 Dec 2024 11:34:49 +0100 Subject: [PATCH 0114/1352] modular physical_layer access --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index e5a074a49..2d77b8562 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2511,6 +2511,10 @@ class scatterlist(objects.StructType): Returns: An iterator of bytes """ - physical_layer = self._context.layers["memory_layer"] + # Either "physical" is layer-1 because this is a module layer, either "physical" is the current layer + physical_layer_name = self._context.layers[self.vol.layer_name].config.get( + "memory_layer", self.vol.layer_name + ) + physical_layer = self._context.layers[physical_layer_name] for sg in self.for_each_sg(): yield from physical_layer.read(sg.dma_address, sg._sg_dma_len()) From 3ff304ceed2501df6d9291259f9bc6b3c587c303 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 3 Dec 2024 19:58:19 +0000 Subject: [PATCH 0115/1352] Layers: Fix intel bug introduced in commit 73d4f2f The patch failed to mask the incoming address to the maximum physical address. This allowed non-canonical addresses (potentially within the page table) to be looked up incorrectly. Fixes #1374. Thanks to @the-rectifier for quickly identifying the issue! --- volatility3/framework/layers/intel.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index d762b41a8..c30ae48a8 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -182,7 +182,7 @@ class Intel(linear.LinearlyMappedLayer): def _pte_pfn(self, entry: int) -> int: """Extracts the page frame number (PFN) from the page table entry (PTE) entry""" - return entry >> self.page_shift + return self._mask(entry, self._maxphyaddr - 1, 0) >> self.page_shift def _translate_entry(self, offset: int) -> Tuple[int, int]: """Translates a specific offset based on paging tables. From 5acf8858d95e413d32b7342fe5f388a68597201e Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 5 Dec 2024 18:31:04 +0000 Subject: [PATCH 0116/1352] =?UTF-8?q?PEP=20488=20=E2=80=93=20Elimination?= =?UTF-8?q?=20of=20PYO=20files?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Python 3.5 implememted PEP 488, eliminating .pyo files. --- volatility3/framework/__init__.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 51310bfa2..4c09b4dae 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -164,7 +164,6 @@ def _filter_files(filename: str): return ( filename.endswith(".py") or filename.endswith(".pyc") - or filename.endswith(".pyo") ) and not filename.startswith("__") From f11ef06c27bbaaeb25cb83c3eadfba192531b52b Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 5 Dec 2024 21:30:20 +0000 Subject: [PATCH 0117/1352] =?UTF-8?q?PEP=20488=20=E2=80=93=20Elimination?= =?UTF-8?q?=20of=20PYO=20files?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Python 3.5 implememted PEP 488, eliminating .pyo files. --- volatility3/framework/__init__.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 4c09b4dae..23ea745de 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -162,8 +162,7 @@ def import_files(base_module, ignore_errors: bool = False) -> List[str]: def _filter_files(filename: str): """Ensures that a filename traversed is an importable python file""" return ( - filename.endswith(".py") - or filename.endswith(".pyc") + filename.endswith(".py") or filename.endswith(".pyc") ) and not filename.startswith("__") From 846403115a8f14a5b6c47ee6fb53bb20f4d6dc78 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Fri, 6 Dec 2024 16:00:03 +0000 Subject: [PATCH 0118/1352] Small documention changes --- doc/source/basics.rst | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/doc/source/basics.rst b/doc/source/basics.rst index 1b8e64780..91a45fbbf 100644 --- a/doc/source/basics.rst +++ b/doc/source/basics.rst @@ -14,7 +14,7 @@ Memory layers ------------- A memory layer is a body of data that can be accessed by requesting data at a specific address. At its lowest level -this data is stored on a phyiscal medium (RAM) and very early computers addresses locations in memory directly. However, +this data is stored on a phyiscal medium (RAM) and very early computers addressed locations in memory directly. However, as the size of memory increased and it became more difficult to manage memory most architectures moved to a "paged" model of memory, where the available memory is cut into specific fixed-sized pages. To help further, programs can ask for any address and the processor will look up their (virtual) address in a map, to find out where the (physical) address that it lives at is, @@ -25,8 +25,8 @@ address `9`). The automagic that runs at the start of every volatility session a kernel virtual layer, which allows for kernel addresses to be looked up and the correct data returned. There can, however, be several maps, and in general there is a different map for each process (although a portion of the operating system's memory is usually mapped to the same location across all processes). The maps may take the same address but point to a different part of -physical memory. It also means that two processes could theoretically share memory, but having an virtual address mapped to the -same physical address as another process. See the worked example below for more information. +physical memory. It also means that two processes could theoretically share memory, both having a virtual address mapped to the +same physical address. See the worked example below for more information. To translate an address on a layer, call :py:meth:`layer.mapping(offset, length, ignore_errors) ` and it will return a list of chunks without overlap, in order, for the requested range. If a portion cannot be mapped, an exception will be thrown unless `ignore_errors` is true. Each @@ -61,7 +61,7 @@ mean they each see something different: 4 -> 2 16 - Free In this example, part of the operating system is visible across all processes (although not all processes can write to the memory, there -is a permissions model for intel addressing which is not discussed further here).) +is a permissions model for Intel addressing which is not discussed further here). In Volatility 3 mappings are represented by a directed graph of layers, whose end nodes are :py:class:`DataLayers ` and whose internal nodes are :py:class:`TranslationLayers `. @@ -69,13 +69,13 @@ In this way, a raw memory image in the LiME file format and a page file can be c memory layer. When requesting addresses from the Intel layer, it will use the Intel memory mapping algorithm, along with the address of the directory table base or page table map, to translate that address into a physical address, which will then either be directed towards the swap layer or the LiME layer. Should it -be directed towards the LiME layer, the LiME file format algorithm will be translate the new address to determine where +be directed towards the LiME layer, the LiME file format algorithm will translate the new address to determine where within the file the data is stored. When the :py:meth:`layer.read() ` method is called, the translation is done automatically and the correct data gathered and combined. .. note:: Volatility 2 had a similar concept, called address spaces, but these could only stack linearly one on top of another. -The list of layers supported by volatility can be determined by running the `frameworkinfo` plugin. +The list of layers supported by Volatility can be determined by running the `frameworkinfo` plugin. Templates and Objects --------------------- From 93a47e811b94c4683db119f81ab4496c9e008736 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Fri, 6 Dec 2024 21:52:51 +0000 Subject: [PATCH 0119/1352] Small documentation changes --- doc/source/basics.rst | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/doc/source/basics.rst b/doc/source/basics.rst index 91a45fbbf..278ef4d73 100644 --- a/doc/source/basics.rst +++ b/doc/source/basics.rst @@ -167,8 +167,7 @@ There are certain setup tasks that establish the context in a way favorable to a several tasks that are repetitive and also easy to get wrong. These are called :py:class:`Automagic `, since they do things like magically taking a raw memory image and automatically providing the plugin with an appropriate Intel translation layer and an -accurate symbol table without either the plugin or the calling program having to specify all the necessary details. +accurate symbol table without either the plugin or the calling program having to specify all the necessary details. Automagics are a core component which consumers of the library can call or not at their discretion. .. note:: Volatility 2 used to do this as well, but it wasn't a particularly modular mechanism, and was used only for stacking address spaces (rather than identifying profiles), and it couldn't really be disabled/configured easily. - Automagics in Volatility 3 are a core component which consumers of the library can call or not at their discretion. From d29c23e922d22b5ccce0f4bc2ac439acd695a31c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 7 Dec 2024 15:51:35 +0000 Subject: [PATCH 0120/1352] Windows: Protect against missing _MM_SESSION_SPACE symbol --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index ecfc2f163..793e506c3 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -825,6 +825,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): constants.LOGLEVEL_VVV, f"Cannot access _EPROCESS.Session.SessionId at {self.vol.offset:#x}", ) + except exceptions.SymbolError: + vollog.log( + constants.LOGLEVEL_VVV, + "Could not lookup _MM_SESSION_SPACE in symbol table", + ) return renderers.UnreadableValue() From 9ebc0bd90d544faeec98ab4d4dd46723aa0c3ed2 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 7 Dec 2024 16:20:45 +0000 Subject: [PATCH 0121/1352] Cosmetic changes to documentation --- doc/source/symbol-tables.rst | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/doc/source/symbol-tables.rst b/doc/source/symbol-tables.rst index 722f9e468..7f0b4153d 100644 --- a/doc/source/symbol-tables.rst +++ b/doc/source/symbol-tables.rst @@ -25,9 +25,9 @@ as long as the symbol files stay in the same location. Windows symbol tables --------------------- -For Windows systems, Volatility accepts a string made up of the GUID and Age of the required PDB file. It then +For Windows systems, Volatility accepts a string made up of the GUID and age of the required PDB file. It then searches all files under the configured symbol directories under the windows subdirectory. Any that contain metadata -which matches the pdb name and GUID/age (or any compressed variant) will be used. If such a symbol table cannot be found, then +which matches the PDB name and GUID/age (or any compressed variant) will be used. If such a symbol table cannot be found, then the associated PDB file will be downloaded from Microsoft's Symbol Server and converted into the appropriate JSON format, and will be saved in the correct location. @@ -35,7 +35,7 @@ Windows symbol tables can be manually constructed from an appropriate PDB file. is built into Volatility 3, called :file:`pdbconv.py`. It can be run from the top-level Volatility path, using the following command: -:command:`PYTHONPATH="." python volatility3/framework/symbols/windows/pdbconv.py` +:command:`PYTHONPATH="."; python volatility3/framework/symbols/windows/pdbconv.py` The :envvar:`PYTHONPATH` environment variable is not required if the Volatility library is installed in the system's library path or a virtual environment. @@ -54,8 +54,8 @@ most Volatility plugins. Note that in most linux distributions, the standard ke and the kernel with debugging information is stored in a package that must be acquired separately. A generic table isn't guaranteed to produce accurate results, and would reduce the number of structures -that all plugins could rely on. As such, and because linux kernels with different configurations can produce different structures, -volatility 3 requires that the banners in the JSON file match the banners found in the image *exactly*, not just the version +that all plugins could rely on. As such, and because Linux kernels with different configurations can produce different structures, +Volatility 3 requires that the banners in the JSON file match the banners found in the image *exactly*, not just the version number. This can include elements such as the compilation time and even the version of gcc used for the compilation. The exact match is required to ensure that the results volatility returns are accurate, therefore there is no simple means provided to get the wrong JSON ISF file to easily match. @@ -63,8 +63,8 @@ provided to get the wrong JSON ISF file to easily match. To determine the string for a particular memory image, use the `banners` plugin. Once the specific banner is known, try to locate that exact kernel debugging package for the operating system. Unfortunately each distribution provides its debugging packages under different package names and there are so many that the distribution may not keep all old -versions of the debugging symbols, and therefore **it may not be possible to find the right symbols to analyze a linux -memory image with volatility**. With Macs there are far fewer kernels and only one distribution, making it easier to +versions of the debugging symbols, and therefore **it may not be possible to find the right symbols to analyze a Linux +memory image with Volatility**. With Macs there are far fewer kernels and only one distribution, making it easier to ensure that the right symbols can be found. Once a kernel with debugging symbols/appropriate DWARF file has been located, `dwarf2json `_ will convert it into an @@ -75,7 +75,7 @@ symbol offsets within the DWARF data, which dwarf2json can extract into the JSON The banners available for volatility to use can be found using the `isfinfo` plugin, but this will potentially take a long time to run depending on the number of JSON files available. This will list all the JSON (ISF) files that -volatility3 is aware of, and for linux/mac systems what banner string they search for. For volatility to use the JSON +Volatility 3 is aware of, and for linux/mac systems what banner string they search for. For volatility to use the JSON file, the banners must match exactly (down to the compilation date). .. note:: From 97698cc5edc4a4d699e452353307c624ccb58a88 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 7 Dec 2024 16:29:58 +0000 Subject: [PATCH 0122/1352] Cosmetic changes to documentation --- doc/source/vol2to3.rst | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/doc/source/vol2to3.rst b/doc/source/vol2to3.rst index e768df0c2..2520562a6 100644 --- a/doc/source/vol2to3.rst +++ b/doc/source/vol2to3.rst @@ -27,7 +27,7 @@ The object model has changed as well, objects now inherit directly from their Py object is actually a Python integer (and has all the associated methods, and can be used wherever a normal int could). In Volatility 2, a complex proxy object was constructed which tried to emulate all the methods of the host object, but ultimately it was a different type and could not be used in the same places (critically, it could make the ordering of -operations important, since a + b might not work, but b + a might work fine). +operations important, since x + y might not work, but y + x might work fine). Volatility 3 has also had significant speed improvements, where Volatility 2 was designed to allow access to live memory images and situations in which the underlying data could change during the run of the plugin, in Volatility 3 the data @@ -56,15 +56,14 @@ Volatility 2 were strictly limited to a stack, one on top of one other. In Vola Automagic --------- -In Volatility 2, we often tried to make this simpler for both users and developers. This resulted in something was -referred to as automagic, in that it was magic that happened automatically. We've now codified that more, so that the +In Volatility 2, we often tried to make this simpler for both users and developers. This resulted in something referred to as automagic, in that it was magic that happened automatically. We've now codified that more, so that the automagic processes are clearly defined and can be enabled or disabled as necessary for any particular run. We also included a stacker automagic to emulate the most common feature of Volatility 2, automatically stacking address spaces (now translation layers) on top of each other. -By default the automagic chosen to be run are determined based on the plugin requested, so that linux plugins get linux -specific automagic and windows plugins get windows specific automagic. This should reduce unnecessarily searching for -linux kernels in a windows image, for example. At the moment this is not user configurableS. +By default the automagic chosen to be run are determined based on the plugin requested, so that Linux plugins get Linux +specific automagic and Windows plugins get Windows specific automagic. This should reduce unnecessarily searching for +Linux kernels in a Windows image, for example. At the moment this is not user configurable. Searching and Scanning ---------------------- From 04d25544428c4a890c7cc88ebe4f80908a101464 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 7 Dec 2024 16:36:18 +0000 Subject: [PATCH 0123/1352] Cosmetic changes to documentation --- doc/source/volshell.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/source/volshell.rst b/doc/source/volshell.rst index 5a4b21ade..3c4f4ce5d 100644 --- a/doc/source/volshell.rst +++ b/doc/source/volshell.rst @@ -144,12 +144,12 @@ We can provide arguments via the `dpo` method call: 356 4 smss.exe 0x8c0bccf8d040 3 - N/A False 2021-03-13 17:25:33.000000 N/A Disabled ... -Here's we've provided the kernel name that was requested by the volshell plugin itself (the generic volshell does not +Here we've provided the kernel name that was requested by the volshell plugin itself (the generic volshell does not load a kernel module, and instead only has a TranslationLayerRequirement). A different module could be created and provided instead. The context used by the `dpo` method is always `context`. -Instead of print the results directly to screen, they can be gathered into a TreeGrid objects for direct access by +Instead of printing the results directly to screen, they can be gathered into a TreeGrid objects for direct access by using the `generate_treegrid` or `gt` command. :: From e165c78ba70de9961749f1d347fac2bcf6bca13d Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 7 Dec 2024 16:37:39 +0000 Subject: [PATCH 0124/1352] Cosmetic changes to documentation --- doc/source/vol2to3.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/source/vol2to3.rst b/doc/source/vol2to3.rst index 2520562a6..9b5a739f8 100644 --- a/doc/source/vol2to3.rst +++ b/doc/source/vol2to3.rst @@ -36,11 +36,11 @@ This was because live memory analysis was barely ever used, and this feature cou re-read many times over for no benefit (particularly since each re-read could result in many additional image reads from following page table translations). -Finally, in order to provide Volatility specific information without impact on the ability for structures to have members +Further, in order to provide Volatility specific information without impact on the ability for structures to have members with arbitrary names, all the metadata about the object (such as its layer or offset) have been moved to a read-only :py:meth:`~volatility3.framework.interfaces.objects.ObjectInterface.vol` dictionary. -Further the distinction between a :py:class:`~volatility3.framework.interfaces.objects.Template` (the thing that +Finally, the distinction between a :py:class:`~volatility3.framework.interfaces.objects.Template` (the thing that constructs an object) and the :py:class:`Object ` itself has been made more explicit. In Volatility 2, some information (such as size) could only be determined from a constructed object, leading to instantiating a template on an empty buffer, just to determine the size. In Volatility 3, templates contain From 45f9064623cedf0ac0ceb9b95a5f2729904ba12b Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 7 Dec 2024 17:11:49 +0000 Subject: [PATCH 0125/1352] Cosmetic changes to documentation --- doc/source/symbol-tables.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/symbol-tables.rst b/doc/source/symbol-tables.rst index 7f0b4153d..59c1febcc 100644 --- a/doc/source/symbol-tables.rst +++ b/doc/source/symbol-tables.rst @@ -35,7 +35,7 @@ Windows symbol tables can be manually constructed from an appropriate PDB file. is built into Volatility 3, called :file:`pdbconv.py`. It can be run from the top-level Volatility path, using the following command: -:command:`PYTHONPATH="."; python volatility3/framework/symbols/windows/pdbconv.py` +:command:`PYTHONPATH="." python volatility3/framework/symbols/windows/pdbconv.py` The :envvar:`PYTHONPATH` environment variable is not required if the Volatility library is installed in the system's library path or a virtual environment. From b86e8397188900740e3fce848b6ac3abddf1389c Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 9 Dec 2024 18:30:19 +0000 Subject: [PATCH 0126/1352] Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387 --- volatility3/framework/interfaces/plugins.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py index 697e4cdc3..74902636e 100644 --- a/volatility3/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -59,14 +59,14 @@ class FileHandlerInterface(io.RawIOBase): @staticmethod def sanitize_filename(filename: str) -> str: - """Sanititizes the filename to ensure only a specific whitelist of characters is allowed through""" - allowed = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]{}!$%^:#~?<>,|" + """Sanititizes the filename to ensure only a specific allow list of characters is allowed through""" + allowed = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.- ()[]{}!$%^#~," result = "" for char in filename: if char in allowed: result += char else: - result += "?" + result += "_" # change unwanted chars to an underscore return result def __enter__(self): From 582feccf938a75571d455552c3a3e51c026d3a66 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 9 Dec 2024 12:56:07 -0600 Subject: [PATCH 0127/1352] Address feedback --- .../framework/plugins/windows/mftscan.py | 41 ++++++++++++------- 1 file changed, 27 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 014516b7c..feea78ece 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -5,7 +5,7 @@ import contextlib import datetime import logging -from typing import Generator, Iterable, Dict, Tuple +from typing import Generator, Iterable, Dict, Tuple, Callable from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -42,7 +42,15 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): context: interfaces.context.ContextInterface, config_path: str, primary_layer_name: str, - attr_callback, + attr_callback: Callable[ + [ + Dict[int, Tuple[str, int, int]], + interfaces.objects.ObjectInterface, + interfaces.objects.ObjectInterface, + str, + ], + Generator, + ], ) -> interfaces.objects.ObjectInterface: try: primary = context.layers[primary_layer_name] @@ -121,7 +129,12 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) @staticmethod - def parse_mft_records(record_map, mft_record, attr, symbol_table): + def parse_mft_records( + record_map: Dict[int, Tuple[str, int, int]], + mft_record: interfaces.objects.ObjectInterface, + attr: interfaces.objects.ObjectInterface, + symbol_table_name: str, + ): # MFT Flags determine the file type or dir # If we don't have a valid enum, coerce to hex so we can keep the record try: @@ -131,7 +144,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Standard Information Attribute if attr.Attr_Header.AttrType.lookup() == "STANDARD_INFORMATION": - si_object = symbol_table + constants.BANG + "STANDARD_INFORMATION_ENTRY" + si_object = ( + symbol_table_name + constants.BANG + "STANDARD_INFORMATION_ENTRY" + ) attr_data = attr.Attr_Data.cast(si_object) yield 0, ( format_hints.Hex(attr_data.vol.offset), @@ -150,7 +165,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # File Name Attribute elif attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" + fn_object = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" attr_data = attr.Attr_Data.cast(fn_object) file_name = attr_data.get_full_name() @@ -201,9 +216,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): else: # past the first $DATA record, attempt to get the ADS name # NotAvailableValue = > 1st Data, but name was not parsable - ads_name = attr.get_resident_filename() - if not ads_name: - ads_name = renderers.NotAvailableValue() + ads_name = attr.get_resident_filename() or renderers.NotAvailableValue() content = attr.get_resident_filecontent() if content: @@ -227,7 +240,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, - symbol_table, + symbol_table_name: str, return_first_record: bool, ) -> Generator[Iterable, None, None]: """ @@ -240,7 +253,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # file name, DATA count, offset record_map[mft_record.vol.offset] = [renderers.NotAvailableValue(), 0, None] if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - fn_object = symbol_table + constants.BANG + "FILE_NAME_ENTRY" + fn_object = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" attr_data = attr.Attr_Data.cast(fn_object) rec_name = attr_data.get_full_name() record_map[mft_record.vol.offset][0] = rec_name @@ -337,10 +350,10 @@ class ADS(interfaces.plugins.PluginInterface): record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, - symbol_table, + symbol_table_name: str, ): return MFTScan.parse_data_records( - record_map, mft_record, attr, symbol_table, False + record_map, mft_record, attr, symbol_table_name, False ) def _generator(self): @@ -406,10 +419,10 @@ class ResidentData(interfaces.plugins.PluginInterface): record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, - symbol_table, + symbol_table_name: str, ): return MFTScan.parse_data_records( - record_map, mft_record, attr, symbol_table, True + record_map, mft_record, attr, symbol_table_name, True ) def _generator(self): From e66a3e929b3c1253255f762db5677efd6c0510ec Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 12 Sep 2024 18:51:47 -0500 Subject: [PATCH 0128/1352] Add detection of direct and indirect system calls --- .../plugins/windows/direct_system_calls.py | 450 ++++++++++++++++++ .../plugins/windows/indirect_system_calls.py | 124 +++++ 2 files changed, 574 insertions(+) create mode 100644 volatility3/framework/plugins/windows/direct_system_calls.py create mode 100644 volatility3/framework/plugins/windows/indirect_system_calls.py diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py new file mode 100644 index 000000000..409f24750 --- /dev/null +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -0,0 +1,450 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +import capstone +from collections import namedtuple +from typing import List, Tuple, Optional, Generator, Callable + +from volatility3.framework.objects import utility +from volatility3.framework import interfaces, renderers, symbols, exceptions +from volatility3.framework.configuration import requirements +from volatility3.plugins import yarascan +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist + +vollog = logging.getLogger(__name__) + + +# Full details on the techniques used in these plugins to detect EDR-evading malware +# can be found in our 20 page whitepaper submitted to DEFCON along with the presentation +# https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf + +syscall_finder_type = namedtuple( + "syscall_finder_type", + [ + "get_syscall_target_address", + "wants_syscall_inst", + "rule_str", + "invalid_ops", + "termination_ops", + ], +) + +syscall_finder_type.__doc__ = """ +This type to used to specify how malicious system call invocations should be found. + +`get_syscall_target_address` is optionally used to extract the address containing the malicious 'syscall' instruction +`wants_syscall_inst` whether or not this method expects the 'syscall' instrunction directly within the malicious code block +`rule` the opcode string to search for the malicious syscall instructions +`invalid_ops` instructions that only appear in invalid code blocks. Stops processing of the code block when encountered. +`termination_ops` instructions that are expected to be present in the code block and that stop processing +""" + + +class DirectSystemCalls(interfaces.plugins.PluginInterface): + """Detects the Direct System Call technique used to bypass EDRs""" + + _required_framework_version = (2, 4, 0) + _version = (1, 0, 0) + + valid_syscall_handlers = ("ntdll.dll", "win32u.dll") + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + + self.syscall_finder = syscall_finder_type( + # for direct system calls, we find the `syscall` instruction directly, so we already know the address + None, + # yes, we want the syscall instruction present as it is what this technique looks for + True, + # regex to find "\x0f\x05" (syscall) followed later by "\xc3" (ret) + # we allow spacing in between to break naive anti-analysis forms (e.g., TarTarus Gate) + # Standard techniques, such as HellsGate, look like: + # mov r10, rcx + # mov eax, + # syscall + # ret + "/\\x0f\\x05[^\\xc3]{,24}\\xc3/", + # any of these will not be in a workable, malicious direct system call block + ["jmp", "call", "leave", "int3"], + # the expected form is to end with a "ret" back to the calling code + ["ret"], + ) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # create a list of requirements for vadyarascan + vadyarascan_requirements = [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) + ), + requirements.PluginRequirement( + name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) + ), + ] + + # get base yarascan requirements for command line options + yarascan_requirements = yarascan.YaraScan.get_yarascan_option_requirements() + + # return the combined requirements + return yarascan_requirements + vadyarascan_requirements + + @staticmethod + def _is_syscall_block( + disasm_func: Callable, + syscall_finder: syscall_finder_type, + data: bytes, + address: int, + ) -> Optional[Tuple[str, capstone._cs_insn]]: + """ + Determines if the bytes starting at `data` represent a valid syscall instrunction invocation block + + To maliciously invoke the system call instruction, malware must do each of the following: + + 1) update RAX to the system call number + 2) update R10 to the first parameter + 3) hit the 'termination' instrunction set in `syscall_finder_type` + + We also track whether the 'syscall' instruction was encountered while parsing + + This function is reusable for every technique we found and studied during the DEFCON research timeframe + + Args: + disasm_func: capstone disassembly function gathered from `get_disasm_function` + syscall_finder: the method and constraints on the malicious system call blocks that the calling plugin knows how to find + data: the bytes from memory to search for malicious syscall invocations + address: the address from where `data` came from in the particular process + Returns: + Optional[Tuple[str, capstone._cs_insn]]: For valid blocks, the disassembled bytes in string from and the last (termination) instruction + """ + found_movr10 = False + found_movreax = False + found_syscall = False + found_end = False + end_inst = None + + disasm_bytes = "" + + for inst in disasm_func(data, address): + disasm_bytes += f"{inst.address:#x}: {inst.mnemonic} {inst.op_str}; " + + # an instruction of all 0x00 opcodes + if inst.opcode.count(0) == len(inst.opcode): + break + + op = inst.mnemonic + + # invalid op, bail + if op in syscall_finder.invalid_ops: + break + + # found the end instruction wanted by the caller + elif op in syscall_finder.termination_ops: + found_end = True + end_inst = inst + break + + # track this no matter what to make code more re-usable + elif op == "syscall": + found_syscall = True + + # if we hit a 'syscall' but RAX or R10 haven't been touched + # then we are in an invalid path, so bail + if not syscall_finder.wants_syscall_inst or ( + not (found_movr10 and found_movreax) + ): + break + + else: + # attempt to see if any other instruction type wrote to registers + try: + _, regs_written = inst.regs_access() + except capstone.CsError: + continue + + if regs_written: + for r in regs_written: + # track writes to eax/rax or R10 + reg = inst.reg_name(r) + if reg in ["eax", "rax"]: + found_movreax = True + + elif reg == "r10": + found_movr10 = True + + # if any of these are missing, the block is invalid regardless of + # the technique we are trying to detect now or in the future + if not (found_movr10 and found_movreax and found_end): + return None + + # if the finder requires a 'syscall' instruction then bail now if we didn't find one + if syscall_finder.wants_syscall_inst and not found_syscall: + return None + + return disasm_bytes, end_inst + + @staticmethod + def get_disasm_function(architecture: str) -> Callable: + """ + Returns the disassembly handler for the given architecture + .detail is used to get full instruction information + + Args: + architecture: the name of the architecture for the process being disassembled + Returns: + The disasm function from capstone for the given architecture + """ + disasm_types = { + "intel": capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32), + "intel64": capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64), + } + + disasm_type = disasm_types[architecture] + disasm_type.detail = True + return disasm_type.disasm + + @classmethod + def _is_valid_syscall( + cls, + syscall_finder: syscall_finder_type, + proc_layer: interfaces.layers.DataLayerInterface, + architecture: str, + vads: List[Tuple[int, int, str]], + address: int, + ) -> Optional[Tuple[int, str]]: + """ + Args: + syscall_finder: + proc_layer: the memory layer of the process being scanned + architecture: the name of the architecture for the process being disassembled + vads: the ranges of this process under 10MB + address: the starting address to check for malicious syscall code blocks + + Returns: + Optional[Tuple[int, str]]: For valid code blocks, the starting address of the block and the disassembly string + """ + # the number bytes behind the yara rule hit to scan + behind = 32 + + address = address - behind + + try: + data = proc_layer.read(address, behind * 2) + except exceptions.InvalidAddressException: + return None + + disasm_func = cls.get_disasm_function(architecture) + + # since Intel does not have fixed-size instructions, we have to scan + # each byte offset and re-disassemble the remaining block + for offset in range(behind): + # if this looks like a system call back (r10, rax, ret/jmp) + syscall_info = cls._is_syscall_block( + disasm_func, syscall_finder, data[offset:], address + offset + ) + if syscall_info: + disasm_bytes, end_inst = syscall_info + + # if we can recover (and require) a target address for this malware technique + if syscall_finder.get_syscall_target_address: + target_address = syscall_finder.get_syscall_target_address( + proc_layer, end_inst + ) + + # could not determine the address -> invalid basic block + if not target_address: + continue + + # we only care about calls to system call DLLs + path = cls._get_range_path(vads, target_address) + if not isinstance(path, str) or not path.lower().endswith( + cls.valid_syscall_handlers + ): + continue + + # return the address and disassembly string if all checks pass + return address + offset, disasm_bytes + + return None + + @staticmethod + def _get_vad_maps( + task: interfaces.objects.ObjectInterface, + ) -> List[Tuple[int, int, str]]: + """Creates a map of start/end addresses within a virtual address + descriptor tree. + + Args: + task: The EPROCESS object of which to traverse the vad tree + + Returns: + An iterable of tuples containing start and end addresses for each descriptor + """ + vads: List[Tuple[int, int, str]] = [] + + # scan regions under 10MB + scan_max = 10 * 1000 * 1000 + + vad_root = task.get_vad_root() + + for vad in vad_root.traverse(): + if vad.get_size() < scan_max: + vads.append((vad.get_start(), vad.get_size(), vad.get_file_name())) + + return vads + + @staticmethod + def _get_range_path(ranges: List[Tuple[int, int, str]], address: int) -> Optional[str]: + """ + Returns the path for the range holding `address`, if found + + Args: + ranges: VADs collected from `_get_vad_maps` + address: the address to find + Returns: + The path holding the address, if any + """ + for start, size, path in ranges: + if start <= address < start + size: + return path + + return None + + @classmethod + def _get_tasks_to_scan( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + symbol_table_name: str, + ) -> Generator[ + Tuple[interfaces.objects.ObjectInterface, str, str, str], None, None + ]: + """ + Gathers active processes with the extra information needed + to detect malicious syscall instructions + + Returns: + Generator of the process object, name, memory layer, and architecture + """ + + # gather active processes + filter_func = pslist.PsList.create_active_process_filter() + + is_32bit_arch = not symbols.symbol_table_is_64bit(context, symbol_table_name) + + for proc in pslist.PsList.list_processes( + context=context, + layer_name=layer_name, + symbol_table=symbol_table_name, + filter_func=filter_func, + ): + proc_name = utility.array_to_string(proc.ImageFileName) + + # skip Defender + if proc_name in ["MsMpEng.exe"]: + continue + + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue + + if is_32bit_arch or proc.get_is_wow64(): + architecture = "intel" + else: + architecture = "intel64" + + yield proc, proc_name, proc_layer_name, architecture + + @classmethod + def _get_rule_hits( + cls, + context: interfaces.objects.ObjectInterface, + proc_layer: interfaces.layers.DataLayerInterface, + vads: List[Tuple[int, int, str]], + pattern: str, + ) -> Generator[Tuple[int, Optional[str]], None, None]: + """ + Runs the given opcode rule through Yara and returns the address and file path of hits + + Args: + context: + proc_layer: the layer to scan + vads: the ranges inside of the process being scanned + pattern: the opcodes rule from the plugin to detect a particular EDR-bypass technique + + Returns: + Generator of the address and file path of hits + """ + sections = [(vad[0], vad[1]) for vad in vads] + + rule = yarascan.YaraScanner.get_rule(pattern) + + for hit in proc_layer.scan( + context=context, + scanner=yarascan.YaraScanner(rules=rule), + sections=sections, + ): + address = hit[0] + + path = cls._get_range_path(vads, address) + + # ignore hits in the system call DLLs + if isinstance(path, str) and path.lower().endswith( + cls.valid_syscall_handlers + ): + continue + + yield address, path + + def _generator(self) -> Generator[Tuple[int, Tuple[str, int, Optional[str], int, str]], None, None]: + kernel = self.context.modules[self.config["kernel"]] + + for proc, proc_name, proc_layer_name, architecture in self._get_tasks_to_scan( + self.context, kernel.layer_name, kernel.symbol_table_name + ): + proc_layer = self.context.layers[proc_layer_name] + + vads = self._get_vad_maps(proc) + + # for each valid process, look for malicious syscall invocations + for address, vad_path in self._get_rule_hits( + self.context, proc_layer, vads, self.syscall_finder.rule_str + ): + syscall_info = self._is_valid_syscall( + self.syscall_finder, proc_layer, architecture, vads, address + ) + if not syscall_info: + continue + + address, disasm_bytes = syscall_info + + yield 0, ( + proc_name, + proc.UniqueProcessId, + vad_path, + format_hints.Hex(address), + disasm_bytes, + ) + + def run(self) -> renderers.TreeGrid: + return renderers.TreeGrid( + [ + ("Process", str), + ("PID", int), + ("Range", str), + ("Address", format_hints.Hex), + ("Disasm", str), + ], + self._generator(), + ) diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py new file mode 100644 index 000000000..417c1b46e --- /dev/null +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -0,0 +1,124 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import struct +import logging +from typing import List, Optional + +import capstone + +from volatility3.framework import interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.plugins import yarascan +from volatility3.plugins.windows import pslist, direct_system_calls + +vollog = logging.getLogger(__name__) + + +class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): + _required_framework_version = (2, 4, 0) + _version = (1, 0, 0) + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + + self.syscall_finder = direct_system_calls.syscall_finder_type( + # gets the target address of a indirect jmp + self._indirect_syscall_block_target, + # we are looking for indirect system calls, so we don't want 'syscall' instructions in our code block + False, + # jmp [address]; ret + "/\\xff\\x25[^\\xc3]{,24}\\xc3/", + # any of these mean we aren't in a malicious indirect call + ["call", "leave", "int3", "ret"], + # stop at jmp, this should reference the system call instruction + ["jmp"], + ) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # create a list of requirements for vadyarascan + vadyarascan_requirements = [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) + ), + requirements.PluginRequirement( + name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) + ), + requirements.PluginRequirement( + name="direct_system_calls", + plugin=direct_system_calls.DirectSystemCalls, + version=(1, 0, 0), + ), + ] + + # get base yarascan requirements for command line options + yarascan_requirements = yarascan.YaraScan.get_yarascan_option_requirements() + + # return the combined requirements + return yarascan_requirements + vadyarascan_requirements + + @staticmethod + def _indirect_syscall_block_target( + proc_layer: interfaces.layers.DataLayerInterface, inst: capstone._cs_insn + ) -> Optional[int]: + """ + This function determines the address of a jmp in the following form: + + jmp [address] + + To determine this, we must: + 1) Pull the 4 byte relative offset of 'address' inside the instruction + 2) Compute the full address of this relative offset + 3) Read from the address as it is being dereferenced + 4) Ensure the target address points to a 'syscall' instruction + + Args: + proc_layer: the layer of the potential syscall block + inst: the terminating instruction of the syscall block check + Returns: + The target address of the jump if it can be computed + """ + + try: + jmp_address_str = proc_layer.read(inst.address, 6) + except exceptions.InvalidAddressException: + return None + + # Should be an jmp... + if jmp_address_str[0:2] != b"\xff\x25": + return None + + # get the address of the 'jmp [address]' instrunction + relative_offset = struct.unpack(" Date: Thu, 12 Sep 2024 18:58:16 -0500 Subject: [PATCH 0129/1352] Fix formatting problem between black versions --- .../framework/plugins/windows/direct_system_calls.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 409f24750..1edc01671 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -304,7 +304,9 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): return vads @staticmethod - def _get_range_path(ranges: List[Tuple[int, int, str]], address: int) -> Optional[str]: + def _get_range_path( + ranges: List[Tuple[int, int, str]], address: int + ) -> Optional[str]: """ Returns the path for the range holding `address`, if found @@ -407,7 +409,9 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): yield address, path - def _generator(self) -> Generator[Tuple[int, Tuple[str, int, Optional[str], int, str]], None, None]: + def _generator( + self, + ) -> Generator[Tuple[int, Tuple[str, int, Optional[str], int, str]], None, None]: kernel = self.context.modules[self.config["kernel"]] for proc, proc_name, proc_layer_name, architecture in self._get_tasks_to_scan( From fce2125a8e4d2742720cc90f9d80e1e2fed9f4c8 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 14 Sep 2024 15:03:51 -0500 Subject: [PATCH 0130/1352] Make VAD API public as intended --- .../plugins/windows/direct_system_calls.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 1edc01671..1999563fd 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -49,6 +49,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): _required_framework_version = (2, 4, 0) _version = (1, 0, 0) + # DLLs that are expected to host system call invocations valid_syscall_handlers = ("ntdll.dll", "win32u.dll") def __init__(self, *args, **kwargs): @@ -266,7 +267,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): continue # we only care about calls to system call DLLs - path = cls._get_range_path(vads, target_address) + path = cls.get_range_path(vads, target_address) if not isinstance(path, str) or not path.lower().endswith( cls.valid_syscall_handlers ): @@ -278,7 +279,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): return None @staticmethod - def _get_vad_maps( + def get_vad_maps( task: interfaces.objects.ObjectInterface, ) -> List[Tuple[int, int, str]]: """Creates a map of start/end addresses within a virtual address @@ -304,14 +305,14 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): return vads @staticmethod - def _get_range_path( + def get_range_path( ranges: List[Tuple[int, int, str]], address: int ) -> Optional[str]: """ Returns the path for the range holding `address`, if found Args: - ranges: VADs collected from `_get_vad_maps` + ranges: VADs collected from `get_vad_maps` address: the address to find Returns: The path holding the address, if any @@ -399,7 +400,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): ): address = hit[0] - path = cls._get_range_path(vads, address) + path = cls.get_range_path(vads, address) # ignore hits in the system call DLLs if isinstance(path, str) and path.lower().endswith( @@ -419,7 +420,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): ): proc_layer = self.context.layers[proc_layer_name] - vads = self._get_vad_maps(proc) + vads = self.get_vad_maps(proc) # for each valid process, look for malicious syscall invocations for address, vad_path in self._get_rule_hits( From 262c7f1aa7e7113508d067afc0e45219643ab943 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 14 Sep 2024 15:22:50 -0500 Subject: [PATCH 0131/1352] Make VAD API public as intended --- volatility3/framework/plugins/windows/direct_system_calls.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 1999563fd..151776e75 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -324,7 +324,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): return None @classmethod - def _get_tasks_to_scan( + def get_tasks_to_scan( cls, context: interfaces.context.ContextInterface, layer_name: str, @@ -415,7 +415,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): ) -> Generator[Tuple[int, Tuple[str, int, Optional[str], int, str]], None, None]: kernel = self.context.modules[self.config["kernel"]] - for proc, proc_name, proc_layer_name, architecture in self._get_tasks_to_scan( + for proc, proc_name, proc_layer_name, architecture in self.get_tasks_to_scan( self.context, kernel.layer_name, kernel.symbol_table_name ): proc_layer = self.context.layers[proc_layer_name] From e7fca5a83f6607a72183d560d4646121d85291e2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 16 Sep 2024 09:38:15 -0500 Subject: [PATCH 0132/1352] Update year --- volatility3/framework/plugins/windows/direct_system_calls.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 151776e75..eac18e8d4 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -1,4 +1,4 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # From af65d7e32daf778488928960e176d8774a2ed1b1 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 18 Oct 2024 11:33:38 -0500 Subject: [PATCH 0133/1352] Address feedback --- .../plugins/windows/direct_system_calls.py | 16 ++++++++++++++-- .../plugins/windows/indirect_system_calls.py | 10 +++++++--- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index eac18e8d4..ec8cd811b 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -3,7 +3,7 @@ # import logging -import capstone + from collections import namedtuple from typing import List, Tuple, Optional, Generator, Callable @@ -16,6 +16,12 @@ from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) +try: + import capstone + + has_capstone = True +except ImportError: + has_capstone = False # Full details on the techniques used in these plugins to detect EDR-evading malware # can be found in our 20 page whitepaper submitted to DEFCON along with the presentation @@ -114,7 +120,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): 1) update RAX to the system call number 2) update R10 to the first parameter - 3) hit the 'termination' instrunction set in `syscall_finder_type` + 3) hit the 'termination' instruction set in `syscall_finder_type` We also track whether the 'syscall' instruction was encountered while parsing @@ -413,6 +419,12 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): def _generator( self, ) -> Generator[Tuple[int, Tuple[str, int, Optional[str], int, str]], None, None]: + if not has_capstone: + vollog.warning( + "capstone is not installed. This plugin requires capstone to operate." + ) + return + kernel = self.context.modules[self.config["kernel"]] for proc, proc_name, proc_layer_name, architecture in self.get_tasks_to_scan( diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index 417c1b46e..b6494645e 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -6,8 +6,6 @@ import struct import logging from typing import List, Optional -import capstone - from volatility3.framework import interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.plugins import yarascan @@ -15,6 +13,12 @@ from volatility3.plugins.windows import pslist, direct_system_calls vollog = logging.getLogger(__name__) +# The generator of DirectSystemCalls will bail with a warning if capstone is not installed +try: + import capstone +except ImportError: + pass + class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): _required_framework_version = (2, 4, 0) @@ -98,7 +102,7 @@ class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): if jmp_address_str[0:2] != b"\xff\x25": return None - # get the address of the 'jmp [address]' instrunction + # get the address of the 'jmp [address]' instruction relative_offset = struct.unpack(" Date: Mon, 9 Dec 2024 13:19:06 -0600 Subject: [PATCH 0134/1352] Add capstone to test system requirements. Allow lazy type checks --- pyproject.toml | 1 + volatility3/framework/plugins/windows/direct_system_calls.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index fc1ab96cb..9b4b8d485 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -37,6 +37,7 @@ dev = [ test = [ "volatility3[dev]", "pytest>=8.3.3,<9", + "capstone>=5.0.3,<6", "yara-x>=0.10.0,<1", ] diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index ec8cd811b..51035b2bc 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -112,7 +112,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): syscall_finder: syscall_finder_type, data: bytes, address: int, - ) -> Optional[Tuple[str, capstone._cs_insn]]: + ) -> Optional[Tuple[str, "capstone._cs_insn"]]: """ Determines if the bytes starting at `data` represent a valid syscall instrunction invocation block From a07ee5a0d53b553b854a8f2ff697ddf7922255a2 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 9 Dec 2024 17:49:22 -0600 Subject: [PATCH 0135/1352] fix(Windows: Handles): Unreliable SAR value on 24H2 Handles are not being decoded in 24H2+ samples. This is because the `Handles._decode_pointer` method grabs the SAR shift value from the disassemble function, but in these samples this value (`0x11`) is incorrect. Adding a fallback to the default SAR value of `0x10` if the obtained pointer is not valid in the kernel address space resolves the issue. --- volatility3/framework/plugins/windows/handles.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 3e5a2fd82..e5cbbf4ca 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -21,11 +21,14 @@ except ImportError: has_capstone = False +DEFAULT_SAR_VALUE = 0x10 # to be used only when decoding fails + + class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 2) + _version = (1, 0, 3) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -118,6 +121,10 @@ class Handles(interfaces.plugins.PluginInterface): ) offset = self._decode_pointer(handle_table_entry.LowValue, magic) + if not self.context.layers[virtual].is_valid(offset): + offset = self._decode_pointer( + handle_table_entry.LowValue, DEFAULT_SAR_VALUE + ) else: if handle_table_entry.InfoTable == 0: return None @@ -142,7 +149,6 @@ class Handles(interfaces.plugins.PluginInterface): pointers in the _HANDLE_TABLE_ENTRY which allows us to find the associated _OBJECT_HEADER. """ - DEFAULT_SAR_VALUE = 0x10 # to be used only when decoding fails if self._sar_value is None: if not has_capstone: From 1cde9ae06ee855e084fe5631eb37f2ffa979ef5c Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 10 Dec 2024 09:46:28 +0000 Subject: [PATCH 0136/1352] Slightly modify volshell.rst --- doc/source/volshell.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/source/volshell.rst b/doc/source/volshell.rst index 3c4f4ce5d..c95456dda 100644 --- a/doc/source/volshell.rst +++ b/doc/source/volshell.rst @@ -36,7 +36,7 @@ operating system mode for volshell, and the current layer available for use. (primary) >>> -Volshell itself in essentially a plugin, but an interactive one. As such, most values are accessed through `self` +Volshell itself is essentially a plugin, but an interactive one. As such, most values are accessed through `self` although there is also a `context` object whenever a context must be provided. The prompt for the tool will indicate the name of the current layer (which can be accessed as `self.current_layer` @@ -92,7 +92,7 @@ It can also be provided with an object and will interpret the data for each in t 0x2e8 : UniqueProcessId symbol_table_name1!pointer 4 ... -These values can be accessed directory as attributes +These values can be accessed directly as attributes :: @@ -180,7 +180,7 @@ used: layer = cc(mynewlayer.MyNewLayer, on_top_of = 'primary', other_parameter = 'important') with open('output.dmp', 'wb') as fp: - for i in range(0, 1073741824, 0x1000): + for i in range(0, 0x4000000, 0x1000): data = layer.read(i, 0x1000, pad = True) fp.write(data) From fdd49d0921a8ca22ea388573dec33ba93a1ef485 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 10 Dec 2024 10:11:26 +0000 Subject: [PATCH 0137/1352] Slightly modify documentation --- doc/source/glossary.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/source/glossary.rst b/doc/source/glossary.rst index 66dabfafe..c4a93f908 100644 --- a/doc/source/glossary.rst +++ b/doc/source/glossary.rst @@ -145,9 +145,9 @@ Struct, Structure Symbol This is used in many different contexts, as a short term for many things. Within Volatility, a symbol is a - construct that usually encompasses a specific type :ref:`type` at a specific :ref:`offset`, + construct that usually encompasses a specific :ref:`type` at a specific :ref:`offset`, representing a particular instance of that type within the memory of a compiled and running program. An example - would be the location in memory of a list of active tcp endpoints maintained by the networking stack + would be the location in memory of a list of active TCP endpoints maintained by the networking stack within an operating system. T From 4bccf116292e6269f0ecc306b8dba0973af55697 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 10 Dec 2024 11:31:16 +0000 Subject: [PATCH 0138/1352] Remove redundant part of if statement Also reorder imports. --- volatility3/cli/volshell/generic.py | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 82c470e1a..534546dcd 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -11,11 +11,6 @@ import sys from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Union from urllib import parse, request -from volatility3.cli import text_renderer, volshell -from volatility3.framework import exceptions, interfaces, objects, plugins, renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.layers import intel, physical, resources, scanners - try: import capstone @@ -23,6 +18,11 @@ try: except ImportError: has_capstone = False +from volatility3.cli import text_renderer, volshell +from volatility3.framework import exceptions, interfaces, objects, plugins, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, physical, resources, scanners + class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" @@ -553,12 +553,11 @@ class Volshell(interfaces.plugins.PluginInterface): if argname in kwargs: del kwargs[argname] - for keyword in kwargs: - val = kwargs[keyword] + for keyword, val in kwargs.items(): if not isinstance( val, interfaces.configuration.BasicTypes ) and not isinstance(val, list): - if not isinstance(val, list) or all( + if all( isinstance(x, interfaces.configuration.BasicTypes) for x in val ): raise TypeError( From faa6cab797da8719305f49e1e824448a159509eb Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 10 Dec 2024 12:16:42 +0000 Subject: [PATCH 0139/1352] Remove redundant part of if statement Also reorder imports. --- volatility3/cli/volshell/generic.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 534546dcd..b1a61fcff 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -555,8 +555,8 @@ class Volshell(interfaces.plugins.PluginInterface): for keyword, val in kwargs.items(): if not isinstance( - val, interfaces.configuration.BasicTypes - ) and not isinstance(val, list): + val, (interfaces.configuration.BasicTypes, list) + ): if all( isinstance(x, interfaces.configuration.BasicTypes) for x in val ): From 0b2f4fdeb772ccb097aaf310ff3169ae37279f13 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 10 Dec 2024 12:26:39 +0000 Subject: [PATCH 0140/1352] Remove redundant part of if statement Also reorder imports. --- volatility3/cli/volshell/generic.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index b1a61fcff..08132608b 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -554,12 +554,8 @@ class Volshell(interfaces.plugins.PluginInterface): del kwargs[argname] for keyword, val in kwargs.items(): - if not isinstance( - val, (interfaces.configuration.BasicTypes, list) - ): - if all( - isinstance(x, interfaces.configuration.BasicTypes) for x in val - ): + if not isinstance(val, (interfaces.configuration.BasicTypes, list)): + if all(isinstance(x, interfaces.configuration.BasicTypes) for x in val): raise TypeError( "Configurable values must be simple types (int, bool, str, bytes)" ) From 39cb75accae827436d8d923592f1d62b34cf9ede Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 10 Dec 2024 17:02:48 +0000 Subject: [PATCH 0141/1352] Slightly modify documentation Include regex_scan, new functionality of volshell. --- doc/source/volshell.rst | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/doc/source/volshell.rst b/doc/source/volshell.rst index c95456dda..73b000763 100644 --- a/doc/source/volshell.rst +++ b/doc/source/volshell.rst @@ -187,8 +187,22 @@ used: As this demonstrates, all of the python is accessible, as are the volshell built in functions (such as `cc` which creates a constructable, like a layer or a symbol table). +User Convenience +---------------- + +There are functions available that make often-done tasks easiers, and generally provide a shell-like experience. These can be listed using `help()` which, as already mentioned, is mentioned when volshell starts. + Loading files -------------- +^^^^^^^^^^^^^ Files can be loaded as physical layers using the `load_file` or `lf` command, which takes a filename or a URI. This will be added to `context.layers` and can be accessed by the name returned by `lf`. + +Regex +^^^^^ + +It is easy to scan for some bytes or a pattern using `regex_scan` or `rx`. + +An optional size can be given for the displayed results as with the other fuctions (db, dw, dd, dq, etc). + +You can of course specify a different layer name as well. From fc33fd912787d0420cd9c4c5effbfba0ea89a933 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 10 Dec 2024 17:14:59 +0000 Subject: [PATCH 0142/1352] Slightly modify documentation Include regex_scan, new functionality of volshell. --- doc/source/volshell.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/volshell.rst b/doc/source/volshell.rst index 73b000763..b46647dc3 100644 --- a/doc/source/volshell.rst +++ b/doc/source/volshell.rst @@ -190,7 +190,7 @@ creates a constructable, like a layer or a symbol table). User Convenience ---------------- -There are functions available that make often-done tasks easiers, and generally provide a shell-like experience. These can be listed using `help()` which, as already mentioned, is mentioned when volshell starts. +There are functions available that make often-done tasks easier, and generally provide a shell-like experience. These can be listed using `help()` which, as already mentioned, is advertised when volshell starts. Loading files ^^^^^^^^^^^^^ From b6717d80d9ac5c820cf84803b53c9aee1e115464 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 10 Dec 2024 23:55:44 +0000 Subject: [PATCH 0143/1352] Windows: Fix up minor typo and CodeQL warning --- volatility3/framework/plugins/windows/direct_system_calls.py | 2 +- volatility3/framework/plugins/windows/indirect_system_calls.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 51035b2bc..b0c162f46 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -39,7 +39,7 @@ syscall_finder_type = namedtuple( ) syscall_finder_type.__doc__ = """ -This type to used to specify how malicious system call invocations should be found. +This type is used to specify how malicious system call invocations should be found. `get_syscall_target_address` is optionally used to extract the address containing the malicious 'syscall' instruction `wants_syscall_inst` whether or not this method expects the 'syscall' instrunction directly within the malicious code block diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index b6494645e..1a5eb317f 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -13,10 +13,10 @@ from volatility3.plugins.windows import pslist, direct_system_calls vollog = logging.getLogger(__name__) -# The generator of DirectSystemCalls will bail with a warning if capstone is not installed try: import capstone except ImportError: + # The generator of DirectSystemCalls will bail with a warning if capstone is not installed pass From 3d260f3829e5f7bd4611db726358169498bb6ae8 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Wed, 11 Dec 2024 12:42:20 +0000 Subject: [PATCH 0144/1352] Slightly modify documentation Include regex_scan, new functionality of volshell. --- doc/source/volshell.rst | 41 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/doc/source/volshell.rst b/doc/source/volshell.rst index b46647dc3..47ea2e905 100644 --- a/doc/source/volshell.rst +++ b/doc/source/volshell.rst @@ -203,6 +203,45 @@ Regex It is easy to scan for some bytes or a pattern using `regex_scan` or `rx`. +:: + + (layer_name) >>> rx(rb"(Linux version|Darwin Kernel Version) [0-9]+\.[0-9]+\.[0-9]+") + 0x880001400070 4c 69 6e 75 78 20 76 65 72 73 69 6f 6e 20 33 2e Linux.version.3. + 0x880001400080 32 2e 30 2d 34 2d 61 6d 64 36 34 20 28 64 65 62 2.0-4-amd64.(deb + 0x880001400090 69 61 6e 2d 6b 65 72 6e 65 6c 40 6c 69 73 74 73 ian-kernel@lists + 0x8800014000a0 2e 64 65 62 69 61 6e 2e 6f 72 67 29 20 28 67 63 .debian.org).(gc + 0x8800014000b0 63 20 76 65 72 73 69 6f 6e 20 34 2e 36 2e 33 20 c.version.4.6.3. + 0x8800014000c0 28 44 65 62 69 61 6e 20 34 2e 36 2e 33 2d 31 34 (Debian.4.6.3-14 + 0x8800014000d0 29 20 29 20 23 31 20 53 4d 50 20 44 65 62 69 61 ).).#1.SMP.Debia + 0x8800014000e0 6e 20 33 2e 32 2e 35 37 2d 33 2b 64 65 62 37 75 n.3.2.57-3+deb7u + + 0x880001769027 4c 69 6e 75 78 20 76 65 72 73 69 6f 6e 20 33 2e Linux.version.3. + 0x880001769037 32 2e 30 2d 34 2d 61 6d 64 36 34 20 28 64 65 62 2.0-4-amd64.(deb + 0x880001769047 69 61 6e 2d 6b 65 72 6e 65 6c 40 6c 69 73 74 73 ian-kernel@lists + 0x880001769057 2e 64 65 62 69 61 6e 2e 6f 72 67 29 20 28 67 63 .debian.org).(gc + 0x880001769067 63 20 76 65 72 73 69 6f 6e 20 34 2e 36 2e 33 20 c.version.4.6.3. + 0x880001769077 28 44 65 62 69 61 6e 20 34 2e 36 2e 33 2d 31 34 (Debian.4.6.3-14 + 0x880001769087 29 20 29 20 23 31 20 53 4d 50 20 44 65 62 69 61 ).).#1.SMP.Debia + 0x880001769097 6e 20 33 2e 32 2e 35 37 2d 33 2b 64 65 62 37 75 n.3.2.57-3+deb7u + + 0xffff81400070 4c 69 6e 75 78 20 76 65 72 73 69 6f 6e 20 33 2e Linux.version.3. + 0xffff81400080 32 2e 30 2d 34 2d 61 6d 64 36 34 20 28 64 65 62 2.0-4-amd64.(deb + 0xffff81400090 69 61 6e 2d 6b 65 72 6e 65 6c 40 6c 69 73 74 73 ian-kernel@lists + 0xffff814000a0 2e 64 65 62 69 61 6e 2e 6f 72 67 29 20 28 67 63 .debian.org).(gc + 0xffff814000b0 63 20 76 65 72 73 69 6f 6e 20 34 2e 36 2e 33 20 c.version.4.6.3. + 0xffff814000c0 28 44 65 62 69 61 6e 20 34 2e 36 2e 33 2d 31 34 (Debian.4.6.3-14 + 0xffff814000d0 29 20 29 20 23 31 20 53 4d 50 20 44 65 62 69 61 ).).#1.SMP.Debia + 0xffff814000e0 6e 20 33 2e 32 2e 35 37 2d 33 2b 64 65 62 37 75 n.3.2.57-3+deb7u + + 0xffff81769027 4c 69 6e 75 78 20 76 65 72 73 69 6f 6e 20 33 2e Linux.version.3. + 0xffff81769037 32 2e 30 2d 34 2d 61 6d 64 36 34 20 28 64 65 62 2.0-4-amd64.(deb + 0xffff81769047 69 61 6e 2d 6b 65 72 6e 65 6c 40 6c 69 73 74 73 ian-kernel@lists + 0xffff81769057 2e 64 65 62 69 61 6e 2e 6f 72 67 29 20 28 67 63 .debian.org).(gc + 0xffff81769067 63 20 76 65 72 73 69 6f 6e 20 34 2e 36 2e 33 20 c.version.4.6.3. + 0xffff81769077 28 44 65 62 69 61 6e 20 34 2e 36 2e 33 2d 31 34 (Debian.4.6.3-14 + 0xffff81769087 29 20 29 20 23 31 20 53 4d 50 20 44 65 62 69 61 ).).#1.SMP.Debia + 0xffff81769097 6e 20 33 2e 32 2e 35 37 2d 33 2b 64 65 62 37 75 n.3.2.57-3+deb7u + An optional size can be given for the displayed results as with the other fuctions (db, dw, dd, dq, etc). -You can of course specify a different layer name as well. +You can, of course, specify a different layer name as well. From 9d0cd4b4c985a568083e20cb4ff13164e6d60963 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 12 Dec 2024 11:17:15 +1100 Subject: [PATCH 0145/1352] Linux: PageCache: Update inode plugin to conform to framework dumping convention --- .../framework/plugins/linux/pagecache.py | 26 ++++++++++++------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 005fc9acc..6d2607ada 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -389,7 +389,7 @@ class InodePages(plugins.PluginInterface): _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -412,9 +412,10 @@ class InodePages(plugins.PluginInterface): description="Inode address", optional=True, ), - requirements.StringRequirement( + requirements.BooleanRequirement( name="dump", - description="Output file path", + description="Extract inode content", + default=False, optional=True, ), ] @@ -436,7 +437,7 @@ class InodePages(plugins.PluginInterface): """ if not inode.is_reg: vollog.error("The inode is not a regular file") - return + return None # By using truncate/seek, provided the filesystem supports it, a sparse file will be # created, saving both disk space and I/O time. @@ -471,7 +472,7 @@ class InodePages(plugins.PluginInterface): if self.config["inode"] and self.config["find"]: vollog.error("Cannot use --inode and --find simultaneously") - return + return None if self.config["find"]: inodes_iter = Files.get_inodes( @@ -487,15 +488,15 @@ class InodePages(plugins.PluginInterface): inode = vmlinux.object("inode", self.config["inode"], absolute=True) else: vollog.error("You must use either --inode or --find") - return + return None if not inode.is_valid(): vollog.error("Invalid inode at 0x%x", inode.vol.offset) - return + return None if not inode.is_reg: vollog.error("The inode is not a regular file") - return + return None inode_size = inode.i_size for page_obj in inode.get_pages(): @@ -520,8 +521,13 @@ class InodePages(plugins.PluginInterface): if self.config["dump"]: filename = self.config["dump"] - vollog.info("[*] Writing inode at 0x%x to '%s'", inode.vol.offset, filename) - self.write_inode_content_to_file(inode, filename, self.open, vmlinux_layer) + open_method = self.open + inode_address = inode.vol.offset + filename = open_method.sanitize_filename(f"inode_0x{inode_address:x}.dmp") + vollog.info("[*] Writing inode at 0x%x to '%s'", inode_address, filename) + self.write_inode_content_to_file( + inode, filename, open_method, vmlinux_layer + ) def run(self): headers = [ From 58a9c3d6dae0759e0dbf590d53e14d7553f30a28 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 12 Dec 2024 07:20:30 +0000 Subject: [PATCH 0146/1352] Slightly modify documentation Include regex_scan, new functionality of volshell. Add Intermediate Symbol File (ISF) to glossary. --- doc/source/glossary.rst | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/doc/source/glossary.rst b/doc/source/glossary.rst index c4a93f908..a9460b1a2 100644 --- a/doc/source/glossary.rst +++ b/doc/source/glossary.rst @@ -23,7 +23,7 @@ Alignment .. _Array: Array - This represents a list of items, which can be access by an index, which is zero-based (meaning the first + This represents a list of items, which can be accessed by an index, which is zero-based (meaning the first element has index 0). Items in arrays are almost always the same size (it is not a generic list, as in python) even if they are :ref:`pointers` to different sized objects. @@ -43,7 +43,14 @@ Dereference .. _Domain: Domain - This the grouping for input values for a mapping or mathematical function. + The set of input values for a mapping or mathematical function. + +I +- +.. _Intermediate Symbol File (ISF): + +Intermediate Symbol File (ISF) + They contain kernel structures and specific offsets formatted as JSON. For macOS and Linux analysis, the kernel needs to be added as an ISF file to the volatility 3 symbols directory. For Windows, the required ISF file can often be generated from PDB files automatically downloaded from Microsoft servers, and therefore does not require manual intervention. M - @@ -55,7 +62,7 @@ Map, mapping attempts to use mathematical functional notation where possible. Within volatility a mapping is most often used to refer to the function for translating addresses from a higher layer (domain) to a lower layer (range). For further information, please see - `Function (mathematics) in wikipedia https://en.wikipedia.org/wiki/Function_(mathematics)` + `https://en.wikipedia.org/wiki/Function_(mathematics)`. .. _Member: @@ -69,7 +76,7 @@ O .. _Object: Object - This has a specific meaning within computer programming (as in Object Oriented Programming), but within the world + This has a specific meaning within computer programming (as in object-oriented programming), but within the world of Volatility it is used to refer to a type that has been associated with a chunk of data, or a specific instance of a type. See also :ref:`Type`. From 6ffef285f4c1ba39816d76726f00086029abdedc Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 12 Dec 2024 17:36:51 +0000 Subject: [PATCH 0147/1352] Tweak the getting started linux tutorial --- doc/source/getting-started-linux-tutorial.rst | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index d4b40d053..a1aad235d 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -27,7 +27,7 @@ To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol Listing plugins --------------- -The following is a sample of the linux plugins available for volatility3, it is not complete and more more plugins may +The following is a sample of the linux plugins available for volatility3, it is not complete and more plugins may be added. For a complete reference, please see the volatility 3 :doc:`list of plugins `. For plugin requests, please create an issue with a description of the requested plugin. @@ -40,7 +40,7 @@ For plugin requests, please create an issue with a description of the requested linux.check_creds.Check_creds linux.check_idt.Check_idt -.. note:: Here the the command is piped to grep and head in-order to provide the start of the list of linux plugins. +.. note:: Here the the command is piped to grep and head to provide the start of the list of linux plugins. Using plugins @@ -80,9 +80,9 @@ Thanks go to `stuxnet `_ for providing this memo The above command helps us to find the memory dump's kernel version and the distribution version. Now using the above banner we can search for the needed ISF file from the ISF server. -If ISF file cannot be found then, follow the instructions on :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux`. After that, place the ISF file under the ``volatility3/symbols/linux`` directory. +If an ISF file cannot be found then, follow the instructions on :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux`. After that, place the ISF file under the ``volatility3/symbols/linux`` directory. -.. tip:: Use the banner text which is most repeated to search from ISF Server. +.. tip:: Use the banner text which is most repeated to search on the ISF Server. linux.pslist ~~~~~~~~~~~~ @@ -157,7 +157,7 @@ linux.pstree ***** 1548 1266 gsd-keyboard ***** 1550 1266 gsd-media-keys -``linux.pstree`` helps us to display the parent child relationships between processes. +``linux.pstree`` helps us to display the parent-child relationships between processes. linux.bash ~~~~~~~~~~ From e31e13f471006f7dcff11f8b7f601b45a9cdf471 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 12 Dec 2024 17:44:01 +0000 Subject: [PATCH 0148/1352] Tweak the getting started mac tutorial --- doc/source/getting-started-mac-tutorial.rst | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/doc/source/getting-started-mac-tutorial.rst b/doc/source/getting-started-mac-tutorial.rst index 42e58c0d5..61af7089b 100644 --- a/doc/source/getting-started-mac-tutorial.rst +++ b/doc/source/getting-started-mac-tutorial.rst @@ -37,7 +37,7 @@ For plugin requests, please create an issue with a description of the requested mac.check_sysctl.Check_sysctl mac.check_trap_table.Check_trap_table -.. note:: Here the the command is piped to grep and head in-order to provide the start of the list of macOS plugins. +.. note:: Here the the command is piped to grep and head to provide the start of the list of macOS plugins. Using plugins @@ -78,7 +78,7 @@ Thanks go to `stuxnet `_ for providing this memo The above command helps us to find the memory dump's Darwin kernel version. Now using the above banner we can search for the needed ISF file. -If ISF file cannot be found then, follow the instructions on :ref:`getting-started-mac-tutorial:Procedure to create symbol tables for macOS`. After that, place the ISF file under the ``volatility3/symbols`` directory. +If an ISF file cannot be found then, follow the instructions on :ref:`getting-started-mac-tutorial:Procedure to create symbol tables for macOS`. After that, place the ISF file under the ``volatility3/symbols`` directory. mac.pslist ~~~~~~~~~~ @@ -125,7 +125,7 @@ mac.pstree 337 1 system_installd * 455 337 update_dyld_shar -``mac.pstree`` helps us to display the parent child relationships between processes. +``mac.pstree`` helps us to display the parent-child relationships between processes. mac.ifconfig ~~~~~~~~~~~~ @@ -150,4 +150,4 @@ mac.ifconfig utun0 False utun0 fe80:5::2a95:bb15:87e3:977c False -we can use the ``mac.ifconfig`` plugin to get information about the configuration of the network interfaces of the host under investigation. +We can use the ``mac.ifconfig`` plugin to get information about the configuration of the network interfaces of the host under investigation. From d77d696e2b017fa7dc8b2355efa9cdde88470d6e Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 12 Dec 2024 17:49:25 +0000 Subject: [PATCH 0149/1352] Tweak the getting started windows tutorial --- doc/source/getting-started-windows-tutorial.rst | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/doc/source/getting-started-windows-tutorial.rst b/doc/source/getting-started-windows-tutorial.rst index c89b065f5..979cf1d96 100644 --- a/doc/source/getting-started-windows-tutorial.rst +++ b/doc/source/getting-started-windows-tutorial.rst @@ -15,19 +15,19 @@ Memory can be acquired using a number of tools, below are some examples but othe Listing Plugins --------------- -The following is a sample of the windows plugins available for volatility3, it is not complete and more more plugins may +The following is a sample of the windows plugins available for volatility3, it is not complete and more plugins may be added. For a complete reference, please see the volatility 3 :doc:`list of plugins `. For plugin requests, please create an issue with a description of the requested plugin. .. code-block:: shell-session - $ python3 vol.py --help | grep windows | head -n 5 + $ python3 vol.py --help | grep windows | head -n 4 windows.bigpools.BigPools windows.cmdline.CmdLine windows.crashinfo.Crashinfo windows.dlllist.DllList -.. note:: Here the the command is piped to grep and head in-order to provide the start of a list of the available windows plugins. +.. note:: Here the the command is piped to grep and head to provide the start of a list of the available windows plugins. Using plugins ------------- @@ -95,9 +95,9 @@ windows.pstree ** 616 504 svchost.exe 0xfa8002b86ab0 13 314 0 False 2022-02-07 16:32:16.000000 N/A ** 624 504 svchost.exe 0xfa8002410630 10 350 0 False 2022-02-07 16:30:14.000000 N/A -``windows.pstree`` helps to display the parent child relationships between processes. +``windows.pstree`` helps to display the parent-child relationships between processes. -.. note:: Here the the command is piped to head in-order to provide smaller output, here listing only the first 20. +.. note:: Here the the command is piped to head to provide smaller output, here listing only the first 20. windows.hashdump ~~~~~~~~~~~~~~~~ @@ -116,9 +116,3 @@ windows.hashdump Dennis 1003 aad3b435b51404eeaad3b435b51404ee cf96684bbc7877920adaa9663698bf54 ``windows.hashdump`` helps to list the hashes of the users in the system. - - - - - - From c740a6c77017834329f0361866536509938bc0c4 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 12 Dec 2024 18:14:35 +0000 Subject: [PATCH 0150/1352] Modify using as a library documentation Tiny changes. --- doc/source/using-as-a-library.rst | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/doc/source/using-as-a-library.rst b/doc/source/using-as-a-library.rst index 4acf35f98..55b77e90a 100644 --- a/doc/source/using-as-a-library.rst +++ b/doc/source/using-as-a-library.rst @@ -3,7 +3,7 @@ Using Volatility 3 as a Library This portion of the documentation discusses how to access the Volatility 3 framework from an external application. -The general process of using volatility as a library is to as follows: +The general process of using volatility as a library is as follows: 1. :ref:`create_context` 2. (Optional) :ref:`available_plugins` @@ -21,7 +21,7 @@ Creating a context First we make sure the volatility framework works the way we expect it (and is the version we expect). The versioning used is semantic versioning, meaning any version with the same major number and a higher or equal minor number will satisfy the requirement. An example is below since the CLI doesn't need any of the features -from versions 1.1 or 1.2: +from version 1.1: :: @@ -86,7 +86,7 @@ List requirements are a list of simple types (integers, booleans, floats and str options, multiple requirements needs all their subrequirements fulfilled and the other types require the names of valid translation layers or symbol tables within the context, respectively. Luckily, each of these requirements can tell you whether they've been fulfilled or not later in the process. For now, they can be used to ask the user to -fill in any parameters they made need to. Some requirements are optional, others are not. +fill in any parameters they may need to. Some requirements are optional, others are not. The plugin is essentially a multiple requirement. It should also be noted that automagic classes can have requirements (as can translation layers). @@ -100,7 +100,7 @@ Once you know what requirements the plugin will need, you can populate them with The configuration is essentially a hierarchical tree of values, much like the windows registry. Each plugin is instantiated at a particular branch within the hierarchy and will look for its configuration options under that hierarchy (if it holds any configurable items, it will likely instantiate those at a point -underneaths its own branch). To set the hierarchy, you'll need to know where the configurables will be constructed. +underneath its own branch). To set the hierarchy, you'll need to know where the configurables will be constructed. For this example, we'll assume plugins' base_config_path is set as `plugins`, and that automagics are configured under the `automagic` tree. We'll see later how to ensure this matches up with the plugins and automagic when they're @@ -139,7 +139,7 @@ A suitable list of automagics for a particular plugin (based on operating system This will take the plugin module, extract the operating system (first level of the hierarchy) and then return just the automagics which apply to the operating system. Each automagic can exclude itself from being used for specific -operating systems, so that an automagic designed for linux is not used for windows or mac plugins. +operating systems, so that for example an automagic designed for linux is not used for windows or mac plugins. These automagics can then be run by providing the list, the context, the plugin to be run, the hierarchy name that the plugin will be constructed on ('plugins' by default) and a progress_callback. This is a callable which takes @@ -157,8 +157,8 @@ Any exceptions that occur during the execution of the automagic will be returned Run the plugin -------------- -Firstly, we should check whether the plugin will be able to run (ie, whether the configuration options it needs -have been successfully set). We do this as follow (where plugin_config_path is the base_config_path (which defaults +Firstly, we should check whether the plugin will be able to run (i.e., whether the configuration options it needs +have been successfully set). We do this as follows, where plugin_config_path is the base_config_path (which defaults to `plugins` and then the name of the class itself): :: @@ -166,7 +166,7 @@ to `plugins` and then the name of the class itself): unsatisfied = plugin.unsatisfied(context, plugin_config_path) If unsatisfied is an empty list, then the plugin has been given everything it requires. If not, it will be a -Dictionary of the hierarchy paths and their associated requirements that weren't satisfied. +dictionary of the hierarchy paths and their associated requirements that weren't satisfied. The plugin can then be instantiated with the context (containing the plugin's configuration) and the path that the plugin can find its configuration at. This configuration path only needs to be a unique value to identify where the From b235ed05b7f916de864916db98e7f2385a52bb07 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 12 Dec 2024 18:50:23 +0000 Subject: [PATCH 0151/1352] Update the CLI manual documentation --- doc/source/vol-cli.rst | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/doc/source/vol-cli.rst b/doc/source/vol-cli.rst index 7b91e815d..9fb48e67a 100644 --- a/doc/source/vol-cli.rst +++ b/doc/source/vol-cli.rst @@ -58,7 +58,7 @@ Options EXTEND. Extensions must be of the form **configuration.item.name=value** -p PLUGIN_DIRS, --plugin-dirs PLUGIN_DIRS - Specified a semi-colon separated list of paths that contain directories + Specified as a semi-colon separated list of paths that contain directories where plugins may be found. These paths are searched before the default paths when loading python files for plugins. This can therefore be used to override built-in plugins. NOTE: All python code within this directory @@ -67,12 +67,12 @@ Options -s SYMBOL_DIRS, --symbol-dirs SYMBOL_DIRS SYMBOL_DIRS is a semi-colon separated list of paths that contain symbol files or symbol zip packs. Symbols must be within a particular directory - structure if they depending on the operating system of the symbols, + structure if they depend on the operating system of the symbols, whilst symbol packs must be in the root of the directory and named after - the after the operating system to which they apply. + the operating system to which they apply. -v, --verbose - A flag which can be used multiple times, each time increasing the level of + A flag which can be used multiple times (up to four), each time increasing the level of detail in the logs produced. -l LOG, --log LOG @@ -87,7 +87,7 @@ Options -q, --quiet When present, this flag mutes the progress feedback for operations. This can be beneficial when piping the output directly to a file or another - tool. This also removes the + tool. -r RENDERER, --renderer RENDERER Specifies the output format in which to display results. The default is @@ -120,9 +120,7 @@ Options Change the default path used to store the cache. --offline - Do not search online for additional JSON files. - Run offline mode (defaults to false) and for - remote windows symbol tables, linux/mac banner repositories. + Run offline mode (defaults to false). Do not search online for additional JSON files, remote windows symbol tables, nor linux/mac banner repositories. --single-location SINGLE_LOCATION This specifies a URL which will be downloaded if necessary, and built @@ -152,7 +150,7 @@ but can be overridden by creating a JSON file (`%APPDATA%/volatility3/vol.json` systems, or `~/.config/volatility3/vol.json` or `volshell.json` for all others). The format of this file is a JSON dictionary, containing the options above and their value. -It should be noted that the ordering is (`<` means is overridden by): +It should be noted that the ordering is (`x < y` means `x` is overridden by `y`): `in-built default value < config file value < command line parameter` From 04517ca79768c16cb8afc323a5625567fe87d225 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 12 Dec 2024 23:24:40 -0600 Subject: [PATCH 0152/1352] Windows: Handle missing _MM_SESSION_SPACE As of Windows 11 24H2, the `_MM_SESSION_SPACE` type no longer appears in the kernel PDB. Instead, the `_EPROCESS.Session` member refers to a new type, `_PSP_SESSION_SPACE`, which does not have a type definition. However, experimentation has shown that this new structure is functionally identical to the old structure - the `ProcessList` and `SessionId` members still appear to be at their old offsets. In order to account for this when analyzing these newer Windows versions, this catches the `SymbolError` and instantiates an `unsigned long` at the offset (8) where the `SessionId` member would normally be defined within an `_MM_SESSION_SPACE` structure. --- .../framework/plugins/windows/modules.py | 34 ++++++++++++++---- .../symbols/windows/extensions/__init__.py | 35 +++++++++++++------ 2 files changed, 51 insertions(+), 18 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index ba45834d5..5ff252074 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -165,13 +165,33 @@ class Modules(interfaces.plugins.PluginInterface): # create the session space object in the process' own layer. # not all processes have a valid session pointer. - session_space = context.object( - symbol_table + constants.BANG + "_MM_SESSION_SPACE", - layer_name=layer_name, - offset=proc.Session, - ) + try: + session_space = context.object( + symbol_table + constants.BANG + "_MM_SESSION_SPACE", + layer_name=layer_name, + offset=proc.Session, + ) + session_id = session_space.SessionId - if session_space.SessionId in seen_ids: + except exceptions.SymbolError: + # In Windows 11 24H2, the _MM_SESSION_SPACE type was + # replaced with _PSP_SESSION_SPACE, and the kernel PDB + # doesn't contain information about its members (otherwise, + # we would just fall back to the new type). However, it + # appears to be, for our purposes, functionally identical + # to the _MM_SESSION_SPACE. Because _MM_SESSION_SPACE + # stores its session ID at offset 8 as an unsigned long, we + # create an unsigned long at that offset and use that + # instead. + session_id = int( + context.object( + layer_name=layer_name, + object_type=symbol_table + constants.BANG + "unsigned long", + offset=proc.Session + 8, + ) + ) + + if session_id in seen_ids: continue except exceptions.InvalidAddressException: @@ -184,7 +204,7 @@ class Modules(interfaces.plugins.PluginInterface): continue # save the layer if we haven't seen the session yet - seen_ids.append(session_space.SessionId) + seen_ids.append(session_id) yield proc_layer_name @classmethod diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 793e506c3..78f59fc0c 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -813,23 +813,36 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): offset=kvo, native_layer_name=self.vol.native_layer_name, ) - session = ntkrnlmp.object( - object_type="_MM_SESSION_SPACE", offset=self.Session, absolute=True - ) - - if session.has_member("SessionId"): - return session.SessionId + try: + session = ntkrnlmp.object( + object_type="_MM_SESSION_SPACE", + offset=self.Session, + absolute=True, + ) + if session.has_member("SessionId"): + return session.SessionId + except exceptions.SymbolError: + # In Windows 11 24H2, the _MM_SESSION_SPACE type was + # replaced with _PSP_SESSION_SPACE, and the kernel PDB + # doesn't contain information about its members (otherwise, + # we would just fall back to the new type). However, it + # appears to be, for our purposes, functionally identical + # to the _MM_SESSION_SPACE. Because _MM_SESSION_SPACE + # stores its session ID at offset 8 as an unsigned long, we + # create an unsigned long at that offset and use that + # instead. + session_id = ntkrnlmp.object( + object_type="unsigned long", + offset=self.Session + 8, + absolute=True, + ) + return int(session_id) except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VVV, f"Cannot access _EPROCESS.Session.SessionId at {self.vol.offset:#x}", ) - except exceptions.SymbolError: - vollog.log( - constants.LOGLEVEL_VVV, - "Could not lookup _MM_SESSION_SPACE in symbol table", - ) return renderers.UnreadableValue() From e8b318552839e25264ebade5c0cc58d3fae27b12 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 13 Dec 2024 00:09:02 -0600 Subject: [PATCH 0153/1352] Windows: Handles - New pointer calculation method After researching this structure (`_HANDLE_TABLE_ENTRY`), it appears to be stable as far back as Windows 8. It's also a union, with an `ObjectPointerBits` member at the same offset as `LowValue` but within a specific bit range (bit length 44, bit position 20). Taking this value and shifting it left by four produces the correct pointer. This four-bit shift is due to 16-byte alignment of object header structures, and is what we would expect to see with 44-bit pointers in Windows. See https://www.alex-ionescu.com/behind-windows-x64s-44-bit-memory-addressing-limit/ --- .../framework/plugins/windows/handles.py | 122 +----------------- 1 file changed, 4 insertions(+), 118 deletions(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index e5cbbf4ca..977a8c804 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -3,9 +3,9 @@ # import logging -from typing import List, Optional, Dict +from typing import Dict, List, Optional -from volatility3.framework import constants, exceptions, renderers, interfaces, symbols +from volatility3.framework import constants, exceptions, interfaces, renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints @@ -13,16 +13,6 @@ from volatility3.plugins.windows import pslist, psscan vollog = logging.getLogger(__name__) -try: - import capstone - - has_capstone = True -except ImportError: - has_capstone = False - - -DEFAULT_SAR_VALUE = 0x10 # to be used only when decoding fails - class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" @@ -32,7 +22,6 @@ class Handles(interfaces.plugins.PluginInterface): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) - self._sar_value = None self._type_map = None self._cookie = None self._level_mask = 7 @@ -65,21 +54,6 @@ class Handles(interfaces.plugins.PluginInterface): ), ] - def _decode_pointer(self, value, magic): - """Windows encodes pointers to objects and decodes them on the fly - before using them. - - This function mimics the decoding routine so we can generate the - proper pointer values as well. - """ - - value = value & 0xFFFFFFFFFFFFFFF8 - value = value >> magic - # if (value & (1 << 47)): - # value = value | 0xFFFF000000000000 - - return value - def _get_item(self, handle_table_entry, handle_value): """Given a handle table entry (_HANDLE_TABLE_ENTRY) structure from a process' handle table, determine where the corresponding object's @@ -103,28 +77,11 @@ class Handles(interfaces.plugins.PluginInterface): ) if is_64bit: - if handle_table_entry.LowValue == 0: + if handle_table_entry.ObjectPointerBits == 0: return None - magic = self.find_sar_value() + offset = handle_table_entry.ObjectPointerBits << 4 - # is this the right thing to raise here? - if magic is None: - if has_capstone: - raise AttributeError( - "Unable to find the SAR value for decoding handle table pointers" - ) - else: - raise exceptions.MissingModuleException( - "capstone", - "Requires capstone to find the SAR value for decoding handle table pointers", - ) - - offset = self._decode_pointer(handle_table_entry.LowValue, magic) - if not self.context.layers[virtual].is_valid(offset): - offset = self._decode_pointer( - handle_table_entry.LowValue, DEFAULT_SAR_VALUE - ) else: if handle_table_entry.InfoTable == 0: return None @@ -142,77 +99,6 @@ class Handles(interfaces.plugins.PluginInterface): object_header.HandleValue = handle_value return object_header - def find_sar_value(self): - """Locate ObpCaptureHandleInformationEx if it exists in the sample. - - Once found, parse it for the SAR value that we need to decode - pointers in the _HANDLE_TABLE_ENTRY which allows us to find the - associated _OBJECT_HEADER. - """ - - if self._sar_value is None: - if not has_capstone: - vollog.debug( - "capstone module is missing, unable to create disassembly of ObpCaptureHandleInformationEx" - ) - return None - kernel = self.context.modules[self.config["kernel"]] - - virtual_layer_name = kernel.layer_name - kvo = self.context.layers[virtual_layer_name].config[ - "kernel_virtual_offset" - ] - ntkrnlmp = self.context.module( - kernel.symbol_table_name, layer_name=virtual_layer_name, offset=kvo - ) - - try: - func_addr = ntkrnlmp.get_symbol("ObpCaptureHandleInformationEx").address - except exceptions.SymbolError: - vollog.debug("Unable to locate ObpCaptureHandleInformationEx symbol") - return None - - try: - func_addr_to_read = kvo + func_addr - num_bytes_to_read = 0x200 - vollog.debug( - f"ObpCaptureHandleInformationEx symbol located at {hex(func_addr_to_read)}" - ) - data = self.context.layers.read( - virtual_layer_name, func_addr_to_read, num_bytes_to_read - ) - except exceptions.InvalidAddressException: - vollog.warning( - f"Failed to read {hex(num_bytes_to_read)} bytes at symbol {hex(func_addr_to_read)}. Unable to decode SAR value. Failing back to a common value of {hex(DEFAULT_SAR_VALUE)}" - ) - self._sar_value = DEFAULT_SAR_VALUE - return self._sar_value - - md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64) - - instruction_count = 0 - for address, size, mnemonic, op_str in md.disasm_lite( - data, kvo + func_addr - ): - # print("{} {} {} {}".format(address, size, mnemonic, op_str)) - instruction_count += 1 - if mnemonic.startswith("sar"): - # if we don't want to parse op strings, we can disasm the - # single sar instruction again, but we use disasm_lite for speed - self._sar_value = int(op_str.split(",")[1].strip(), 16) - vollog.debug( - f"SAR located at {hex(address)} with value of {hex(self._sar_value)}" - ) - break - - if self._sar_value is None: - vollog.warning( - f"Failed to to locate SAR value having parsed {instruction_count} instructions, failing back to a common value of {hex(DEFAULT_SAR_VALUE)}" - ) - self._sar_value = DEFAULT_SAR_VALUE - - return self._sar_value - @classmethod def get_type_map( cls, From 31492f4ab80dcc3c5ca38c2c4754ccfafc46a994 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 14 Dec 2024 15:50:50 +0000 Subject: [PATCH 0154/1352] Rectify maximum repetition of verbose flag From four to six (-vvvvvv). --- doc/source/vol-cli.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/vol-cli.rst b/doc/source/vol-cli.rst index 9fb48e67a..43ca33f04 100644 --- a/doc/source/vol-cli.rst +++ b/doc/source/vol-cli.rst @@ -72,7 +72,7 @@ Options the operating system to which they apply. -v, --verbose - A flag which can be used multiple times (up to four), each time increasing the level of + A flag which can be used multiple times (up to six, -vvvvvv), each time increasing the level of detail in the logs produced. -l LOG, --log LOG From 5086be30b2c153bf168704022cff793190e1a750 Mon Sep 17 00:00:00 2001 From: TheMythologist Date: Sun, 15 Dec 2024 14:04:15 +0800 Subject: [PATCH 0155/1352] Refactor: move version None check to top --- volatility3/framework/configuration/requirements.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 86e1aac52..f130f9544 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -529,6 +529,8 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): component: Type[interfaces.configuration.VersionableInterface] = None, version: Optional[Tuple[int, ...]] = None, ) -> None: + if version is None: + raise TypeError("Version cannot be None") if description is None: description = f"Version {'.'.join([str(x) for x in version])} dependency on {component.__module__}.{component.__name__} unmet" super().__init__( @@ -537,8 +539,6 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): if component is None: raise TypeError("Component cannot be None") self._component: Type[interfaces.configuration.VersionableInterface] = component - if version is None: - raise TypeError("Version cannot be None") self._version = version def unsatisfied( From c8c39837abdf489c8316aa51ebb4f2634321d77c Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 15 Dec 2024 19:26:22 +0000 Subject: [PATCH 0156/1352] Tiny change text_renderer.py --- volatility3/cli/text_renderer.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 31307f67e..408a562d8 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -49,12 +49,12 @@ def hex_bytes_as_text(value: bytes, width: int = 16) -> str: output += "\n" printables = "" - # Handle leftovers when the lenght is not mutiple of width + # Handle leftovers when the length is not mutiple of width if printables: padding = width - len(printables) - output += " " * (padding) + output += " " * padding output += printables - output += " " * (padding) + output += " " * padding return output @@ -132,7 +132,7 @@ def display_disassembly(disasm: interfaces.renderers.Disassembly) -> str: for i in disasm_types[disasm.architecture].disasm( disasm.data, disasm.offset ): - output += f"\n0x{i.address:x}:\t{i.mnemonic}\t{i.op_str}" + output += f"\n{i.address:#x}:\t{i.mnemonic}\t{i.op_str}" return output return QuickTextRenderer._type_renderers[bytes](disasm.data) @@ -342,7 +342,7 @@ class PrettyTextRenderer(CLIRenderer): column_separator = " | " tree_indent_column = "".join( - random.choice(string.ascii_uppercase + string.digits) for _ in range(20) + random.choices(string.ascii_uppercase + string.digits, k=20) ) max_column_widths = dict( [(column.name, len(column.name)) for column in grid.columns] From bb1ff69e426ad688ea116bcdab2f1a9c77a182e6 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 16 Dec 2024 19:25:24 +1100 Subject: [PATCH 0157/1352] linux: dentry: Fix dentry type support for kernels pre-3.19 --- .../framework/symbols/linux/extensions/__init__.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 927f767e2..829622154 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1107,9 +1107,16 @@ class dentry(objects.StructType): walk_member = "d_sib" list_head_member = self.d_children elif self.has_member("d_child") and self.has_member("d_subdirs"): - # 2.5.0 <= kernels < 6.8 + # 3.19.0 <= kernels < 6.8 walk_member = "d_child" list_head_member = self.d_subdirs + elif self.has_member("d_u") and self.has_member("d_subdirs"): + # kernels < 3.19 + + # Actually, 'd_u.d_child' but to_list() doesn't support something like that. + # Since, it's an union, everything is at the same offset than 'd_u'. + walk_member = "d_u" + list_head_member = self.d_subdirs else: raise exceptions.VolatilityException("Unsupported dentry type") From 3b0f0915c7fd24512d12603ab989a53f6ac68928 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 16 Dec 2024 19:36:54 +1100 Subject: [PATCH 0158/1352] linux: page_cache: add testcase for page_cache.files plugin --- test/test_volatility.py | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index f7cb23e93..b5910e1c8 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -632,6 +632,26 @@ def test_linux_vmayarascan_yara_string(image, volatility, python): assert rc == 0 +def test_linux_page_cache_files(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.pagecache.Files", + image, + volatility, + python, + pluginargs=["--find", "/etc/passwd"], + ) + out = out.lower() + + assert out.count(b"\n") > 4 + + # inode_num inode_addr ... file_path + assert re.search( + rb"146829\s0x88001ab5c270.*?/etc/passwd", + out, + ) + assert rc == 0 + + # MAC From 02b11b44a28634c230b0676bf4feafe37fac6dff Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Mon, 16 Dec 2024 16:59:58 +0000 Subject: [PATCH 0159/1352] Remove use of int function after math.ceil Return type of math.ceil is already an int. --- volatility3/framework/layers/intel.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index c30ae48a8..846f246dc 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -73,8 +73,8 @@ class Intel(linear.LinearlyMappedLayer): ) # These can vary depending on the type of space - self._index_shift = int( - math.ceil(math.log2(struct.calcsize(self._entry_format))) + self._index_shift = math.ceil( + math.log2(struct.calcsize(self._entry_format)) ) @classproperty @@ -125,7 +125,6 @@ class Intel(linear.LinearlyMappedLayer): high_mask = (1 << (high_bit + 1)) - 1 low_mask = (1 << low_bit) - 1 mask = high_mask ^ low_mask - # print(high_bit, low_bit, bin(mask), bin(value)) return value & mask @staticmethod @@ -147,7 +146,7 @@ class Intel(linear.LinearlyMappedLayer): return self._mask(addr, self._maxvirtaddr, 0) + self._canonical_prefix def decanonicalize(self, addr: int) -> int: - """Removes canonicalization to ensure an adress fits within the correct range if it has been canonicalized + """Removes canonicalization to ensure an address fits within the correct range if it has been canonicalized This will produce an address outside the range if the canonicalization is incorrect """ From b37923c183bec9a6381d5d592b405a9fcf51887f Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Mon, 16 Dec 2024 17:08:37 +0000 Subject: [PATCH 0160/1352] Remove use of int function after math.ceil Return type of math.ceil is already an int. --- volatility3/framework/layers/intel.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 846f246dc..7918ebed4 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -73,9 +73,7 @@ class Intel(linear.LinearlyMappedLayer): ) # These can vary depending on the type of space - self._index_shift = math.ceil( - math.log2(struct.calcsize(self._entry_format)) - ) + self._index_shift = math.ceil(math.log2(struct.calcsize(self._entry_format))) @classproperty @functools.lru_cache() From 4e2227e2643b52d2a6f660f62c058ba85526123b Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 16 Dec 2024 17:54:01 +0000 Subject: [PATCH 0161/1352] Windows: Update get_commit_charge extension to handle Core.CommitCharge case --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 793e506c3..ff6d14a8c 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -269,7 +269,10 @@ class MMVAD_SHORT(objects.StructType): return self.u.VadFlags.CommitCharge elif self.has_member("Core"): - return self.Core.u1.VadFlags1.CommitCharge + if self.Core.has_member("CommitCharge"): + return self.Core.CommitCharge + else: + return self.Core.u1.VadFlags1.CommitCharge raise AttributeError("Unable to find the commit charge member") From 267c5a60c3b99da48cb0ead9c9d1492b857ea340 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 17 Dec 2024 10:05:38 +1100 Subject: [PATCH 0162/1352] Linux: PageCache: Remove unused variable --- volatility3/framework/plugins/linux/pagecache.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 6d2607ada..46b24b27a 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -520,7 +520,6 @@ class InodePages(plugins.PluginInterface): yield 0, fields if self.config["dump"]: - filename = self.config["dump"] open_method = self.open inode_address = inode.vol.offset filename = open_method.sanitize_filename(f"inode_0x{inode_address:x}.dmp") From 7299f925dcd8a7ae1a00b47cf4846fc683c8e5ac Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 16 Dec 2024 17:58:53 -0600 Subject: [PATCH 0163/1352] Windows: Handles - major version bump Bumps the major version in plugin + dependences after removal of a publicly exposed instance method. --- volatility3/framework/plugins/windows/callbacks.py | 2 +- volatility3/framework/plugins/windows/dumpfiles.py | 2 +- volatility3/framework/plugins/windows/handles.py | 2 +- volatility3/framework/plugins/windows/poolscanner.py | 2 +- volatility3/framework/plugins/windows/psxview.py | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 562846def..414a8814a 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -48,7 +48,7 @@ class Callbacks(interfaces.plugins.PluginInterface): name="driverirp", plugin=driverirp.DriverIrp, version=(1, 0, 0) ), requirements.PluginRequirement( - name="handles", plugin=handles.Handles, version=(1, 0, 0) + name="handles", plugin=handles.Handles, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index 33d2d0d41..bc554c0bf 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -69,7 +69,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(2, 0, 0) ), requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(1, 0, 0) + name="handles", component=handles.Handles, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 977a8c804..a3067b09f 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -18,7 +18,7 @@ class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 3) + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 1f70cfb8c..8c56d202d 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -139,7 +139,7 @@ class PoolScanner(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="handles", plugin=handles.Handles, version=(1, 0, 0) + name="handles", plugin=handles.Handles, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index a8d185a2c..6c845bf81 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -62,7 +62,7 @@ class PsXView(plugins.PluginInterface): name="thrdscan", component=thrdscan.ThrdScan, version=(1, 0, 0) ), requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(1, 0, 0) + name="handles", component=handles.Handles, version=(2, 0, 0) ), requirements.BooleanRequirement( name="physical-offsets", From fd9d3ec04c967c5e1a16d7735cf7f064d2b82a47 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 16 Dec 2024 18:17:42 -0600 Subject: [PATCH 0164/1352] Windows: Typing - Remove type casts, add signature Removes the needless `int` casts, and adds the return type to the `get_session_id` method signature. --- volatility3/framework/plugins/windows/modules.py | 16 +++++++--------- .../symbols/windows/extensions/__init__.py | 4 ++-- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 5ff252074..b9d754328 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -2,14 +2,14 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Iterable, Generator +from typing import Generator, Iterable, List -from volatility3.framework import exceptions, interfaces, constants, renderers +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe -from volatility3.plugins.windows import pslist, pedump +from volatility3.plugins.windows import pedump, pslist vollog = logging.getLogger(__name__) @@ -183,12 +183,10 @@ class Modules(interfaces.plugins.PluginInterface): # stores its session ID at offset 8 as an unsigned long, we # create an unsigned long at that offset and use that # instead. - session_id = int( - context.object( - layer_name=layer_name, - object_type=symbol_table + constants.BANG + "unsigned long", - offset=proc.Session + 8, - ) + session_id = context.object( + layer_name=layer_name, + object_type=symbol_table + constants.BANG + "unsigned long", + offset=proc.Session + 8, ) if session_id in seen_ids: diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 78f59fc0c..12f84ca90 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -797,7 +797,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): return renderers.UnreadableValue() - def get_session_id(self): + def get_session_id(self) -> Union[int, interfaces.renderers.BaseAbsentValue]: try: if self.has_member("Session"): if self.Session == 0: @@ -836,7 +836,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): offset=self.Session + 8, absolute=True, ) - return int(session_id) + return session_id except exceptions.InvalidAddressException: vollog.log( From 02f17af8a632fb70d1152c66ff3847b2fb921033 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 17 Dec 2024 12:09:29 +1100 Subject: [PATCH 0165/1352] linux: fix task parent pid in several plugins. It also adds a method to get the correct one in a unified way from the task object extension --- .../framework/plugins/linux/capabilities.py | 4 ++-- volatility3/framework/plugins/linux/envars.py | 12 ++---------- volatility3/framework/plugins/linux/psaux.py | 10 ++-------- volatility3/framework/plugins/linux/pslist.py | 4 ++-- volatility3/framework/plugins/linux/psscan.py | 7 ++----- volatility3/framework/plugins/linux/pstree.py | 6 +++--- .../framework/symbols/linux/extensions/__init__.py | 14 ++++++++++++++ 7 files changed, 27 insertions(+), 30 deletions(-) diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index a8a8fb1fa..a06ee4c1b 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -50,7 +50,7 @@ class Capabilities(plugins.PluginInterface): """Lists process capabilities""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -136,7 +136,7 @@ class Capabilities(plugins.PluginInterface): comm=utility.array_to_string(task.comm), pid=int(task.pid), tgid=int(task.tgid), - ppid=int(task.parent.pid), + ppid=int(task.get_parent_pid()), euid=int(task.cred.euid), ) diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index 22aba6408..a3eb21cf5 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -17,7 +17,7 @@ class Envars(plugins.PluginInterface): """Lists processes with their environment variables""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 1, 0) @classmethod def get_requirements(cls): @@ -48,15 +48,7 @@ class Envars(plugins.PluginInterface): # get process name as string name = utility.array_to_string(task.comm) - - # try and get task parent - try: - ppid = task.parent.pid - except exceptions.InvalidAddressException: - vollog.debug( - f"Unable to read parent pid for task {pid} {name}, setting ppid to 0." - ) - ppid = 0 + ppid = task.get_parent_pid() # kernel threads never have an mm as they do not have userland mappings try: diff --git a/volatility3/framework/plugins/linux/psaux.py b/volatility3/framework/plugins/linux/psaux.py index 5467c3b4c..5a4d75c70 100644 --- a/volatility3/framework/plugins/linux/psaux.py +++ b/volatility3/framework/plugins/linux/psaux.py @@ -15,7 +15,7 @@ class PsAux(plugins.PluginInterface): """Lists processes with their command line arguments""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 1, 0) @classmethod def get_requirements(cls): @@ -98,14 +98,8 @@ class PsAux(plugins.PluginInterface): # walk the process list and report the arguments for task in tasks: pid = task.pid - - try: - ppid = task.parent.pid - except exceptions.InvalidAddressException: - ppid = 0 - + ppid = task.get_parent_pid() name = utility.array_to_string(task.comm) - args = self._get_command_line_args(task, name) yield (0, (pid, ppid, name, args)) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 6460462a7..edfc0688c 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -18,7 +18,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular linux memory image.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) + _version = (3, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -95,7 +95,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """ pid = task.tgid tid = task.pid - ppid = task.parent.tgid if task.parent else 0 + ppid = task.get_parent_pid() name = utility.array_to_string(task.comm) start_time = task.get_create_time() if decorate_comm: diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index 40784a647..55e3778ab 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -28,7 +28,7 @@ class PsScan(interfaces.plugins.PluginInterface): """Scans for processes present in a particular linux image.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -52,10 +52,7 @@ class PsScan(interfaces.plugins.PluginInterface): """ pid = task.tgid tid = task.pid - ppid = 0 - - if task.parent.is_readable(): - ppid = task.parent.tgid + ppid = task.get_parent_pid() name = utility.array_to_string(task.comm) exit_state = DescExitStateEnum(task.exit_state).name diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index 9dc5ea3cc..7ea9df3d6 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -13,7 +13,7 @@ class PsTree(interfaces.plugins.PluginInterface): ID.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 1, 0) @classmethod def get_requirements(cls): @@ -56,9 +56,9 @@ class PsTree(interfaces.plugins.PluginInterface): seen = set([pid]) level = 0 proc = self._tasks.get(pid) - while proc and proc.parent and proc.parent.pid not in seen: + while proc and proc.get_parent_pid() not in seen: if proc.is_thread_group_leader: - parent_pid = proc.parent.pid + parent_pid = proc.get_parent_pid() else: parent_pid = proc.tgid diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 927f767e2..f27306e67 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -635,6 +635,20 @@ class task_struct(generic.GenericIntelProcess): # root time namespace, not within the task's own time namespace return boottime + task_start_time_timedelta + def get_parent_pid(self) -> int: + """Returns the parent process ID (PPID) + + This method replicates the Linux kernel's `getppid` syscall behavior. + Avoid using `task.parent`; instead, use this function for accurate results. + """ + + if self.real_parent and self.real_parent.is_readable(): + ppid = self.real_parent.pid + else: + ppid = 0 + + return ppid + class fs_struct(objects.StructType): def get_root_dentry(self): From 74ff42a12d2665d05e64c7c71beb2bec5f4c9333 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 17 Dec 2024 13:28:57 +1100 Subject: [PATCH 0166/1352] Fix ProducerMetadata class bug introduced in #1369 --- volatility3/framework/symbols/metadata.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 73ad2cf21..7e069e518 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -27,7 +27,7 @@ class ProducerMetadata(interfaces.symbols.MetadataInterface): @property def version(self) -> Optional[Tuple[int]]: """Returns the version of the ISF file producer""" - version = self.version_string() + version = self.version_string if not version: return None if all(x in "0123456789." for x in version): From 0255151ef508f5c4a1e75c71dfafa99218e15b05 Mon Sep 17 00:00:00 2001 From: TheMythologist Date: Tue, 17 Dec 2024 12:15:46 +0800 Subject: [PATCH 0167/1352] Fix: Error early if no inodes are found in linux.pagecache.InodePages plugin --- volatility3/framework/plugins/linux/pagecache.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 46b24b27a..7dbf074b3 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -483,6 +483,9 @@ class InodePages(plugins.PluginInterface): if inode_in.path == self.config["find"]: inode = inode_in.inode break # Only the first match + else: + vollog.error("Unable to find inode with path %s", self.config["find"]) + return None elif self.config["inode"]: inode = vmlinux.object("inode", self.config["inode"], absolute=True) From 054f0496c123ec074a134ab9e75416fdef15e1c4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 17 Dec 2024 17:55:52 +0000 Subject: [PATCH 0168/1352] Windows: Cannot use capstone typing information if capstone didn'tr import --- volatility3/framework/plugins/windows/indirect_system_calls.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index 1a5eb317f..c4f3f6d28 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -73,8 +73,7 @@ class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): @staticmethod def _indirect_syscall_block_target( - proc_layer: interfaces.layers.DataLayerInterface, inst: capstone._cs_insn - ) -> Optional[int]: + proc_layer: interfaces.layers.DataLayerInterface, inst) -> Optional[int]: """ This function determines the address of a jmp in the following form: From 246d19c0fadbb986e4ec4c019505bed4d32b6359 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 17 Dec 2024 18:14:29 +0000 Subject: [PATCH 0169/1352] Windows: Fix black issue --- volatility3/framework/plugins/windows/indirect_system_calls.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index c4f3f6d28..f09851b30 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -73,7 +73,8 @@ class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): @staticmethod def _indirect_syscall_block_target( - proc_layer: interfaces.layers.DataLayerInterface, inst) -> Optional[int]: + proc_layer: interfaces.layers.DataLayerInterface, inst + ) -> Optional[int]: """ This function determines the address of a jmp in the following form: From c45beb3ebe7feaec42567eb8ef3dd665e15db3ae Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 17 Dec 2024 18:12:19 +0000 Subject: [PATCH 0170/1352] Automagic: Fixes #1417 --- volatility3/framework/automagic/symbol_cache.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index e38771f79..2c9883c7d 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -299,6 +299,13 @@ class SqliteCache(CacheManagerInterface): This also updates remote locations based on a cache timeout. """ + if progress_callback is None: + + def dummy_progress(*args, **kargs) -> None: + return None + + progress_callback = dummy_progress + on_disk_locations = set( [ filename From f0f3bb65581e433cc7b44c2e877a1e95c927e17e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 17 Dec 2024 18:31:41 +0000 Subject: [PATCH 0171/1352] Core: Start to fix up the typing in ModuleCollection Fixes #1418 --- volatility3/framework/contexts/__init__.py | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index 6961d9328..1a55656b3 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -11,7 +11,7 @@ without them interfering with each other. import functools import hashlib import logging -from typing import Callable, Iterable, List, Optional, Set, Tuple, Union +from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple, Union from volatility3.framework import constants, interfaces, symbols, exceptions from volatility3.framework.objects import templates @@ -386,10 +386,9 @@ class ModuleCollection(interfaces.context.ModuleContainer): """Class to contain a collection of SizedModules and reason about their contents.""" - def __init__( - self, modules: Optional[List[interfaces.context.ModuleInterface]] = None - ) -> None: + def __init__(self, modules: Optional[List[SizedModule]] = None) -> None: self._prefix_count = {} + self._modules: Dict[str, SizedModule] = {} super().__init__(modules) def deduplicate(self) -> "ModuleCollection": @@ -402,9 +401,9 @@ class ModuleCollection(interfaces.context.ModuleContainer): new_modules = [] seen: Set[str] = set() for mod in self._modules: - if mod.hash not in seen or mod.size == 0: + if self._modules[mod].hash not in seen or self._modules[mod].size == 0: new_modules.append(mod) - seen.add(mod.hash) # type: ignore # FIXME: mypy #5107 + seen.add(self._modules[mod].hash) return ModuleCollection(new_modules) def free_module_name(self, prefix: str = "module") -> str: From a0b169cf6b1f0a5d8ced886ff855e7ad7dd791c0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 17 Dec 2024 18:34:19 +0000 Subject: [PATCH 0172/1352] This PR does not strictly change any interfaces, just the inner workings of a function. --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 55ef19e4b..2ea034176 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 12 # Number of changes that only add to the interface -VERSION_PATCH = 0 # Number of changes that do not change the interface +VERSION_PATCH = 1 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From 1b8f831fda1fc0d47eaf81144dec81354dca8490 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 17 Dec 2024 18:37:39 +0000 Subject: [PATCH 0173/1352] Core: Also fix up the interface to match the concrete classes --- volatility3/framework/interfaces/context.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index 8b5e816e8..e85429732 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -295,6 +295,7 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): def has_enumeration(self, name: str) -> bool: """Determines whether an enumeration is present in the module's symbol table.""" + @property def symbols(self) -> List: """Lists the symbols contained in the symbol table for this module""" From 9ef90c2091a5b838817fc9251251b74f34dccf7e Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 17 Dec 2024 13:14:33 -0600 Subject: [PATCH 0174/1352] Windows: PeDump - use contextmanager Several tools, including pyright and PyCharm, report that `file_handle` may be an unbound local. Regardless of whether or not this is likely to happen in practice, it makes sense to just use a `ContextManager` here anyway, since `FileHandlerInterface` implements it. --- .../framework/plugins/windows/pedump.py | 41 +++++++++---------- 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 858d0615a..5b4bb07d7 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -64,30 +64,27 @@ class PEDump(interfaces.plugins.PluginInterface): """ Returns the filename of the dump file or None """ - try: - file_handle = open_method(file_name) + with open_method(file_name) as file_handle: + try: + dos_header = context.object( + pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", + offset=base, + layer_name=layer_name, + ) - dos_header = context.object( - pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", - offset=base, - layer_name=layer_name, - ) + for offset, data in dos_header.reconstruct(): + file_handle.seek(offset) + file_handle.write(data) + except ( + IOError, + exceptions.VolatilityException, + OverflowError, + ValueError, + ) as excp: + vollog.debug(f"Unable to dump PE file at offset {base}: {excp}") + return None - for offset, data in dos_header.reconstruct(): - file_handle.seek(offset) - file_handle.write(data) - except ( - IOError, - exceptions.VolatilityException, - OverflowError, - ValueError, - ) as excp: - vollog.debug(f"Unable to dump PE file at offset {base}: {excp}") - return None - finally: - file_handle.close() - - return file_handle.preferred_filename + return file_handle.preferred_filename @classmethod def dump_ldr_entry( From 24e1904376aa501e5ec4b240f2cbe6fb23267ebe Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 17 Dec 2024 19:22:35 +0000 Subject: [PATCH 0175/1352] Modify using as a library documentation Tiny changes. --- doc/source/using-as-a-library.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/source/using-as-a-library.rst b/doc/source/using-as-a-library.rst index 55b77e90a..144cae644 100644 --- a/doc/source/using-as-a-library.rst +++ b/doc/source/using-as-a-library.rst @@ -21,7 +21,7 @@ Creating a context First we make sure the volatility framework works the way we expect it (and is the version we expect). The versioning used is semantic versioning, meaning any version with the same major number and a higher or equal minor number will satisfy the requirement. An example is below since the CLI doesn't need any of the features -from version 1.1: +from version 1.1 or later: :: @@ -139,7 +139,7 @@ A suitable list of automagics for a particular plugin (based on operating system This will take the plugin module, extract the operating system (first level of the hierarchy) and then return just the automagics which apply to the operating system. Each automagic can exclude itself from being used for specific -operating systems, so that for example an automagic designed for linux is not used for windows or mac plugins. +operating systems, such that an automagic designed for linux is not used for windows or mac plugins. These automagics can then be run by providing the list, the context, the plugin to be run, the hierarchy name that the plugin will be constructed on ('plugins' by default) and a progress_callback. This is a callable which takes @@ -166,7 +166,7 @@ to `plugins` and then the name of the class itself): unsatisfied = plugin.unsatisfied(context, plugin_config_path) If unsatisfied is an empty list, then the plugin has been given everything it requires. If not, it will be a -dictionary of the hierarchy paths and their associated requirements that weren't satisfied. +dict of the hierarchy paths and their associated requirements that weren't satisfied. The plugin can then be instantiated with the context (containing the plugin's configuration) and the path that the plugin can find its configuration at. This configuration path only needs to be a unique value to identify where the From b04ca88d0754bfc2e79fbe70c9280eba344d8375 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 17 Dec 2024 13:28:37 -0600 Subject: [PATCH 0176/1352] Windows Extensions: Fixes type-hint on list_timers This method is incorrectly type-hinted as returning a `Tuple` when it should be returning an instance of the `KTIMER` extension class. This leaves the version number as is since it only updates the type-hint, but let me know if that's incorrect and we need to bump it. --- volatility3/framework/plugins/windows/timers.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index d49c28784..fad25df72 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -14,7 +14,7 @@ from volatility3.framework import ( ) from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows import versions, extensions from volatility3.plugins.windows import ssdt, kpcrs vollog = logging.getLogger(__name__) @@ -49,7 +49,7 @@ class Timers(interfaces.plugins.PluginInterface): kernel_module_name: str, layer_name: str, symbol_table: str, - ) -> Iterable[Tuple[str, int, str]]: + ) -> Iterable[extensions.KTIMER]: """Lists all kernel timers. Args: From c134dcd64306e3c5f355f97d4e117d34c3e76f33 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 17 Dec 2024 13:55:34 -0600 Subject: [PATCH 0177/1352] Windows Timers: Bump patch version --- volatility3/framework/plugins/windows/timers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index fad25df72..8bd7c8eb4 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -24,7 +24,7 @@ class Timers(interfaces.plugins.PluginInterface): """Print kernel timers and associated module DPCs""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From d76bf96f36a60a4c17aa51fa9033b80836b10812 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 17 Dec 2024 20:25:10 +0000 Subject: [PATCH 0178/1352] Use generator expressions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PEP 289 – Generator Expressions. --- volatility3/framework/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 23ea745de..61ad787a1 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -64,8 +64,8 @@ def require_interface_version(*args) -> None: if args[1] > interface_version()[1]: raise RuntimeError( "Framework interface version {} is an older revision than the required version {}".format( - ".".join([str(x) for x in interface_version()[0:2]]), - ".".join([str(x) for x in args[0:2]]), + ".".join(str(x) for x in interface_version()[0:2]), + ".".join(str(x) for x in args[0:2]), ) ) From 60ca99710728fc923420b8e7c64b8b8dfa60e1a2 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 17 Dec 2024 20:40:54 +0000 Subject: [PATCH 0179/1352] Use generator expressions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PEP 289 – Generator Expressions. --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 55ef19e4b..8c4856f0b 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -5,7 +5,7 @@ VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( - ".".join([str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]]) + ".".join(str(x) for x in [VERSION_MAJOR, VERSION_MINOR, VERSION_PATCH]) + VERSION_SUFFIX ) """The canonical version of the volatility3 package""" From c8e2347a0f1577f349cbc212821e7b3122cc60e1 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 17 Dec 2024 20:47:36 +0000 Subject: [PATCH 0180/1352] Use generator expressions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PEP 289 – Generator Expressions. --- volatility3/framework/plugins/windows/getservicesids.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 9b20ed2d0..12fc44682 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -26,7 +26,7 @@ def createservicesid(svc) -> str: ## The use of struct here is OK. It doesn't make much sense ## to leverage obj.Object inside this loop. dec.append(struct.unpack(" Date: Tue, 17 Dec 2024 20:48:42 +0000 Subject: [PATCH 0181/1352] Use generator expressions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PEP 289 – Generator Expressions. --- volatility3/framework/plugins/linux/check_creds.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index 0857576d5..4916b67d2 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -55,7 +55,7 @@ class Check_creds(interfaces.plugins.PluginInterface): for cred_addr, pids in creds.items(): if len(pids) > 1: - pid_str = ", ".join([str(pid) for pid in pids]) + pid_str = ", ".join(str(pid) for pid in pids) fields = [ format_hints.Hex(cred_addr), From eeb7cf71317bb5a195172d756d44ec11916b84a9 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 17 Dec 2024 20:50:38 +0000 Subject: [PATCH 0182/1352] Use generator expressions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PEP 289 – Generator Expressions. --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 82c470e1a..d02d054ee 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -203,7 +203,7 @@ class Volshell(interfaces.plugins.PluginInterface): connector = " " if chunk_size < 2: connector = "" - ascii_data = connector.join([self._ascii_bytes(x) for x in valid_data]) + ascii_data = connector.join(self._ascii_bytes(x) for x in valid_data) print(hex(offset), " ", hex_data, " ", ascii_data) offset += 16 From ae1079f923a4b5f36aa394805c26805e0b31408e Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 17 Dec 2024 20:52:29 +0000 Subject: [PATCH 0183/1352] Use generator expressions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PEP 289 – Generator Expressions. --- volatility3/framework/configuration/requirements.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index f130f9544..a52d7ff27 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -532,7 +532,7 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): if version is None: raise TypeError("Version cannot be None") if description is None: - description = f"Version {'.'.join([str(x) for x in version])} dependency on {component.__module__}.{component.__name__} unmet" + description = f"Version {'.'.join(str(x) for x in version)} dependency on {component.__module__}.{component.__name__} unmet" super().__init__( name=name, description=description, default=default, optional=optional ) From 8e9b719a1641a8c72fcbae61c313061fb60864f0 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 13:23:11 +0100 Subject: [PATCH 0184/1352] use ruff for linting and enforce linting via ci --- .github/workflows/ruff.yaml | 15 +++++++++++++++ pyproject.toml | 18 ++++++++++++++++++ 2 files changed, 33 insertions(+) create mode 100644 .github/workflows/ruff.yaml diff --git a/.github/workflows/ruff.yaml b/.github/workflows/ruff.yaml new file mode 100644 index 000000000..77e3aa864 --- /dev/null +++ b/.github/workflows/ruff.yaml @@ -0,0 +1,15 @@ +--- +name: Ruff + +on: [push, pull_request] + +jobs: + lint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - uses: astral-sh/ruff-action@v1 + with: + args: check + src: "." diff --git a/pyproject.toml b/pyproject.toml index 9b4b8d485..7035f7a15 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -71,6 +71,24 @@ show_traceback = true [tool.mypy.overrides] ignore_missing_imports = true +[tool.ruff] +line-length = 88 +target-version = "py38" + +[tool.ruff.lint] +select = [ + "F", # pyflakes + "E", # pycodestyle errors + "W", # pycodestyle warnings + "G", # flake8-logging-format + "PIE", # flake8-pie + "UP", # pyupgrade +] + +ignore = [ + "E501", # ignore due to conflict with formatter +] + [build-system] requires = ["setuptools>=68"] build-backend = "setuptools.build_meta" From ad7daafc508da70e140ccb4babb3c53b9a2085d7 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 16:45:18 +0100 Subject: [PATCH 0185/1352] linted with ruff (`ruff check . --fix`) --- development/compare-vol.py | 2 +- development/pdbparse-to-json.py | 5 +- development/schema_validate.py | 4 +- volatility3/cli/__init__.py | 22 +++----- volatility3/cli/text_filter.py | 2 +- volatility3/cli/text_renderer.py | 2 +- volatility3/cli/volargparse.py | 2 +- volatility3/cli/volshell/__init__.py | 6 +-- volatility3/cli/volshell/generic.py | 1 - volatility3/framework/__init__.py | 10 ++-- volatility3/framework/automagic/linux.py | 4 +- volatility3/framework/automagic/mac.py | 2 +- volatility3/framework/automagic/pdbscan.py | 4 +- .../framework/automagic/symbol_cache.py | 9 +--- .../framework/automagic/symbol_finder.py | 2 +- .../framework/configuration/requirements.py | 4 +- volatility3/framework/contexts/__init__.py | 2 +- .../framework/interfaces/configuration.py | 10 ++-- volatility3/framework/interfaces/layers.py | 7 +-- volatility3/framework/interfaces/plugins.py | 2 +- volatility3/framework/interfaces/renderers.py | 12 +++-- volatility3/framework/interfaces/symbols.py | 3 +- volatility3/framework/layers/crash.py | 9 ++-- volatility3/framework/layers/intel.py | 19 +++---- volatility3/framework/layers/leechcore.py | 2 +- volatility3/framework/layers/qemu.py | 2 +- volatility3/framework/layers/registry.py | 8 +-- volatility3/framework/layers/resources.py | 2 +- .../framework/layers/scanners/multiregexp.py | 2 +- volatility3/framework/objects/utility.py | 4 +- volatility3/framework/plugins/layerwriter.py | 2 +- .../framework/plugins/linux/check_idt.py | 2 +- .../framework/plugins/linux/check_syscall.py | 2 +- .../framework/plugins/linux/pagecache.py | 2 +- volatility3/framework/plugins/linux/proc.py | 4 +- volatility3/framework/plugins/linux/psscan.py | 2 +- .../framework/plugins/mac/proc_maps.py | 4 +- volatility3/framework/plugins/timeliner.py | 4 +- .../framework/plugins/windows/cmdline.py | 4 +- .../framework/plugins/windows/consoles.py | 22 ++------ .../framework/plugins/windows/dlllist.py | 15 ++---- .../framework/plugins/windows/dumpfiles.py | 8 +-- .../framework/plugins/windows/envars.py | 6 +-- .../plugins/windows/getservicesids.py | 2 +- .../framework/plugins/windows/getsids.py | 6 +-- .../plugins/windows/hollowprocesses.py | 37 +++++-------- volatility3/framework/plugins/windows/iat.py | 8 +-- .../framework/plugins/windows/malfind.py | 8 +-- .../framework/plugins/windows/memmap.py | 10 +--- .../framework/plugins/windows/modules.py | 4 +- .../framework/plugins/windows/netscan.py | 31 ++--------- .../framework/plugins/windows/netstat.py | 8 +-- .../framework/plugins/windows/pe_symbols.py | 2 +- .../framework/plugins/windows/pedump.py | 54 +++++++++---------- .../framework/plugins/windows/privileges.py | 2 +- .../framework/plugins/windows/psxview.py | 1 - .../plugins/windows/registry/hivelist.py | 26 +++------ .../plugins/windows/registry/userassist.py | 6 +-- .../plugins/windows/skeleton_key_check.py | 8 +-- .../framework/plugins/windows/strings.py | 4 +- .../framework/plugins/windows/svclist.py | 4 +- .../framework/plugins/windows/svcscan.py | 14 ++--- .../framework/plugins/windows/thrdscan.py | 2 +- .../framework/plugins/windows/threads.py | 2 +- .../framework/plugins/windows/timers.py | 2 +- .../plugins/windows/unhooked_system_calls.py | 2 +- .../framework/plugins/windows/vadinfo.py | 4 +- .../framework/plugins/windows/verinfo.py | 4 +- volatility3/framework/renderers/__init__.py | 8 +-- volatility3/framework/symbols/intermed.py | 2 +- .../framework/symbols/linux/__init__.py | 2 +- .../symbols/linux/extensions/__init__.py | 4 +- .../symbols/windows/extensions/__init__.py | 8 +-- .../symbols/windows/extensions/consoles.py | 2 +- .../symbols/windows/extensions/mbr.py | 7 +-- .../symbols/windows/extensions/network.py | 8 ++- .../symbols/windows/extensions/pe.py | 4 +- .../symbols/windows/extensions/pool.py | 6 +-- .../symbols/windows/extensions/registry.py | 4 +- .../framework/symbols/windows/pdbconv.py | 6 +-- .../framework/symbols/windows/pdbutil.py | 6 +-- .../plugins/windows/registry/certificates.py | 2 +- volatility3/plugins/windows/statistics.py | 4 +- volatility3/schemas/__init__.py | 6 +-- 84 files changed, 191 insertions(+), 381 deletions(-) diff --git a/development/compare-vol.py b/development/compare-vol.py index d0d834038..1074c5d9c 100644 --- a/development/compare-vol.py +++ b/development/compare-vol.py @@ -101,7 +101,7 @@ class Volatility2Test(VolatilityTest): print(f" Tested volatility2 imageinfo with image {image.filepath}: {end_time - start_time}") with open(os.path.join(self.output_directory, f'vol2_imageinfo_{image_hash}_stdout'), "wb") as f: f.write(vol2_completed.stdout) - image.vol2_profile = re.search(b"Suggested Profile\(s\) : ([^,]+)", vol2_completed.stdout)[1] + image.vol2_profile = re.search(rb"Suggested Profile\(s\) : ([^,]+)", vol2_completed.stdout)[1] class RekallTest(VolatilityTest): diff --git a/development/pdbparse-to-json.py b/development/pdbparse-to-json.py index 819e44e15..6eb265227 100644 --- a/development/pdbparse-to-json.py +++ b/development/pdbparse-to-json.py @@ -145,8 +145,7 @@ class PDBConvertor: """Generates the metadata necessary for this object""" dbg = self._pdb.STREAM_DBI last_bytes = str(binascii.hexlify(self._pdb.STREAM_PDB.GUID.Data4), 'ascii')[-16:] - guidstr = u'{:08x}{:04x}{:04x}{}'.format(self._pdb.STREAM_PDB.GUID.Data1, self._pdb.STREAM_PDB.GUID.Data2, - self._pdb.STREAM_PDB.GUID.Data3, last_bytes) + guidstr = f'{self._pdb.STREAM_PDB.GUID.Data1:08x}{self._pdb.STREAM_PDB.GUID.Data2:04x}{self._pdb.STREAM_PDB.GUID.Data3:04x}{last_bytes}' pdb_data = { "GUID": guidstr.upper(), "age": self._pdb.STREAM_PDB.Age, @@ -195,7 +194,7 @@ class PDBConvertor: try: sects = self._pdb.STREAM_SECT_HDR_ORIG.sections omap = self._pdb.STREAM_OMAP_FROM_SRC - except AttributeError as e: + except AttributeError: # In this case there is no OMAP, so we use the given section # headers and use the identity function for omap.remap sects = self._pdb.STREAM_SECT_HDR.sections diff --git a/development/schema_validate.py b/development/schema_validate.py index 0908e934f..031039e38 100644 --- a/development/schema_validate.py +++ b/development/schema_validate.py @@ -28,7 +28,7 @@ if __name__ == '__main__': schema = None if args.schema: - with open(os.path.abspath(args.schema), 'r') as s: + with open(os.path.abspath(args.schema)) as s: schema = json.load(s) failures = [] @@ -36,7 +36,7 @@ if __name__ == '__main__': try: if os.path.exists(filename): print(f"[?] Validating file: {filename}") - with open(filename, 'r') as t: + with open(filename) as t: test = json.load(t) if args.schema: diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 901f299a8..cf1335443 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -57,7 +57,7 @@ formatter = logging.Formatter("%(levelname)-8s %(name)-12s: %(message)s") console.setFormatter(formatter) -class PrintedProgress(object): +class PrintedProgress: """A progress handler that prints the progress value and the description onto the command line.""" @@ -126,9 +126,7 @@ class CommandLine: "--help", action="help", default=argparse.SUPPRESS, - help="Show this help message and exit, for specific plugin options use '{} --help'".format( - parser.prog - ), + help=f"Show this help message and exit, for specific plugin options use '{parser.prog} --help'", ) parser.add_argument( "-c", @@ -360,9 +358,7 @@ class CommandLine: subparser = parser.add_subparsers( title="Plugins", dest="plugin", - description="For plugin specific options, run '{} --help'".format( - self.CLI_NAME - ), + description=f"For plugin specific options, run '{self.CLI_NAME} --help'", action=volargparse.HelpfulSubparserAction, metavar="PLUGIN", ) @@ -416,7 +412,7 @@ class CommandLine: # UI fills in the config, here we load it from the config file and do it before we process the CL parameters if args.config: - with open(args.config, "r") as f: + with open(args.config) as f: json_val = json.load(f) ctx.config.splice( plugin_config_path, @@ -722,9 +718,7 @@ class CommandLine: if isinstance(requirement, requirements.ListRequirement): if not isinstance(value, list): raise TypeError( - "Configuration for ListRequirement was not a list: {}".format( - requirement.name - ) + f"Configuration for ListRequirement was not a list: {requirement.name}" ) value = [requirement.element_type(x) for x in value] if not inspect.isclass(configurables_list[configurable]): @@ -797,7 +791,7 @@ class CommandLine: fd, self._name = tempfile.mkstemp( suffix=".vol3", prefix="tmp_", dir=output_dir ) - self._file = io.open(fd, mode="w+b") + self._file = open(fd, mode="w+b") CLIFileHandler.__init__(self, filename) for item in dir(self._file): if not item.startswith("_") and item not in ( @@ -870,9 +864,7 @@ class CommandLine: requirement, interfaces.configuration.RequirementInterface ): raise TypeError( - "Plugin contains requirements that are not RequirementInterfaces: {}".format( - configurable.__name__ - ) + f"Plugin contains requirements that are not RequirementInterfaces: {configurable.__name__}" ) if isinstance(requirement, interfaces.configuration.SimpleTypeRequirement): additional["type"] = requirement.instance_type diff --git a/volatility3/cli/text_filter.py b/volatility3/cli/text_filter.py index 3d69934e9..955d647f5 100644 --- a/volatility3/cli/text_filter.py +++ b/volatility3/cli/text_filter.py @@ -76,7 +76,7 @@ class ColumnFilter: if self.regex: return re.search(self.pattern, f"{item}") return self.pattern in f"{item}" - except IOError: + except OSError: return False def found(self, row: List[Any]) -> bool: diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 408a562d8..937ba4ef4 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -467,7 +467,7 @@ class JsonRenderer(CLIRenderer): def output_result(self, outfd, result): """Outputs the JSON data to a file in a particular format""" - outfd.write("{}\n".format(json.dumps(result, indent=2, sort_keys=True))) + outfd.write(f"{json.dumps(result, indent=2, sort_keys=True)}\n") def render(self, grid: interfaces.renderers.TreeGrid): outfd = sys.stdout diff --git a/volatility3/cli/volargparse.py b/volatility3/cli/volargparse.py index fd61ddce0..dce9cafa6 100644 --- a/volatility3/cli/volargparse.py +++ b/volatility3/cli/volargparse.py @@ -5,7 +5,7 @@ import argparse import gettext import re -from typing import List, Optional, Sequence, Any, Union +from typing import Optional, Sequence, Any, Union # This effectively overrides/monkeypatches the core argparse module to provide more helpful output around choices diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py index e9d3fda08..0affe5d59 100644 --- a/volatility3/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -282,9 +282,7 @@ class VolShell(cli.CommandLine): for plugin in volshell_plugin_list: subparser = parser.add_argument_group( title=plugin.capitalize(), - description="Configuration options based on {} options".format( - plugin.capitalize() - ), + description=f"Configuration options based on {plugin.capitalize()} options", ) self.populate_requirements_argparse(subparser, volshell_plugin_list[plugin]) configurables_list[plugin] = volshell_plugin_list[plugin] @@ -331,7 +329,7 @@ class VolShell(cli.CommandLine): # UI fills in the config, here we load it from the config file and do it before we process the CL parameters if args.config: - with open(args.config, "r") as f: + with open(args.config) as f: json_val = json.load(f) ctx.config.splice( plugin_config_path, diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 82c470e1a..65040bb2a 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -585,7 +585,6 @@ class NullFileHandler(io.BytesIO, interfaces.plugins.FileHandlerInterface): def writelines(self, lines: Iterable[bytes]): """Dummy method""" - pass def write(self, b: bytes): """Dummy method""" diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 23ea745de..e0f7c778a 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -56,9 +56,7 @@ def require_interface_version(*args) -> None: if len(args): if args[0] != interface_version()[0]: raise RuntimeError( - "Framework interface version {} is incompatible with required version {}".format( - interface_version()[0], args[0] - ) + f"Framework interface version {interface_version()[0]} is incompatible with required version {args[0]}" ) if len(args) > 1: if args[1] > interface_version()[1]: @@ -70,7 +68,7 @@ def require_interface_version(*args) -> None: ) -class NonInheritable(object): +class NonInheritable: def __init__(self, value: Any, cls: Type) -> None: self.default_value = value self.cls = cls @@ -187,9 +185,7 @@ def import_file(module: str, path: str, ignore_errors: bool = False) -> List[str traceback.TracebackException.from_exception(e).format(chain=True) ) ) - vollog.debug( - "Failed to import module {} based on file: {}".format(module, path) - ) + vollog.debug(f"Failed to import module {module} based on file: {path}") failures.append(module) if not ignore_errors: raise diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index ef54a0aa5..6b58577a3 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -173,9 +173,7 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): if aslr_shift & 0xFFF != 0 or kaslr_shift & 0xFFF != 0: continue vollog.debug( - "Linux ASLR shift values determined: physical {:0x} virtual {:0x}".format( - kaslr_shift, aslr_shift - ) + f"Linux ASLR shift values determined: physical {kaslr_shift:0x} virtual {aslr_shift:0x}" ) return kaslr_shift, aslr_shift diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py index 7c478b521..89dd5a187 100644 --- a/volatility3/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -184,7 +184,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): aslr_shift = 0 for offset, banner in offset_generator: - banner_major, banner_minor = [int(x) for x in banner[22:].split(b".")[0:2]] + banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[0:2]) tmp_aslr_shift = offset - cls.virtual_to_physical_address( version_json_address diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 0b4f6c73a..729c48063 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -215,9 +215,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): return (virtual_layer_name, kvo, kernel) else: vollog.debug( - "Potential kernel_virtual_offset did not map to expected location: {}".format( - hex(kvo) - ) + f"Potential kernel_virtual_offset did not map to expected location: {hex(kvo)}" ) except exceptions.InvalidAddressException: vollog.debug( diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index e38771f79..9fad506ae 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -106,7 +106,6 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): def add_identifier(self, location: str, operating_system: str, identifier: str): """Adds an identifier to the store""" - pass def find_location( self, identifier: bytes, operating_system: Optional[str] @@ -120,18 +119,15 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): Returns: The location of the symbols file that matches the identifier """ - pass def get_local_locations(self) -> Iterable[str]: """Returns a list of all the local locations""" - pass def update(self): """Locates all files under the symbol directories. Updates the cache with additions, modifications and removals. This also updates remote locations based on a cache timeout. """ - pass def get_identifier_dictionary( self, operating_system: Optional[str] = None, local_only: bool = False @@ -145,15 +141,12 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): Returns: A dictionary of identifiers mapped to a location """ - pass def get_identifier(self, location: str) -> Optional[bytes]: """Returns an identifier based on a specific location or None""" - pass def get_identifiers(self, operating_system: Optional[str]) -> List[bytes]: """Returns all identifiers for a particular operating system""" - pass def get_location_statistics( self, location: str @@ -572,6 +565,6 @@ class RemoteIdentifierFormat: try: subrbf = RemoteIdentifierFormat(location) yield from subrbf.process(identifiers, operating_system) - except IOError: + except OSError: vollog.debug(f"Remote file not found: {location}") return identifiers diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 6d689e194..1d30f3f51 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -4,7 +4,7 @@ import logging import os -from typing import Any, Callable, Iterable, List, Optional, Tuple +from typing import Callable, List, Optional, Tuple from volatility3.framework import constants, interfaces, layers from volatility3.framework.automagic import symbol_cache diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index f130f9544..828c89daa 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -664,9 +664,7 @@ class ModuleRequirement( if value is not None: vollog.log( constants.LOGLEVEL_V, - "TypeError - Module Requirement only accepts string labels: {}".format( - repr(value) - ), + f"TypeError - Module Requirement only accepts string labels: {repr(value)}", ) return {config_path: self} diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index 6961d9328..5111b168a 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -356,7 +356,7 @@ class SizedModule(Module): return size or 0 @property # type: ignore # FIXME: mypy #5107 - @functools.lru_cache() + @functools.lru_cache def hash(self) -> str: """Hashes the module for equality checks. diff --git a/volatility3/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py index da0a4556c..cbbf7e342 100644 --- a/volatility3/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -94,7 +94,7 @@ class HierarchicalDict(collections.abc.Mapping): raise TypeError(f"Separator must be a one character string: {separator}") self._separator = separator self._data: Dict[str, ConfigSimpleType] = {} - self._subdict: Dict[str, "HierarchicalDict"] = {} + self._subdict: Dict[str, HierarchicalDict] = {} if isinstance(initial_dict, str): initial_dict = json.loads(initial_dict) if isinstance(initial_dict, dict): @@ -182,9 +182,7 @@ class HierarchicalDict(collections.abc.Mapping): else: if not isinstance(value, HierarchicalDict): raise TypeError( - "HierarchicalDicts can only store HierarchicalDicts within their structure: {}".format( - type(value) - ) + f"HierarchicalDicts can only store HierarchicalDicts within their structure: {type(value)}" ) self._subdict[key] = value @@ -498,9 +496,7 @@ class SimpleTypeRequirement(RequirementInterface): if not isinstance(value, self.instance_type): vollog.log( constants.LOGLEVEL_V, - "TypeError - {} requirements only accept {} type: {}".format( - self.name, self.instance_type.__name__, repr(value) - ), + f"TypeError - {self.name} requirements only accept {self.instance_type.__name__} type: {repr(value)}", ) return {config_path: self} return {} diff --git a/volatility3/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py index 78687d8d5..56798aca9 100644 --- a/volatility3/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -188,7 +188,6 @@ class DataLayerInterface( the object unreadable (exceptions will be thrown using a DataLayer after destruction) """ - pass @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -361,9 +360,7 @@ class DataLayerInterface( data += self.context.layers[layer_name].read(address, chunk_size) except exceptions.InvalidAddressException: vollog.debug( - "Invalid address in layer {} found scanning {} at address {:x}".format( - layer_name, self.name, address - ) + f"Invalid address in layer {layer_name} found scanning {self.name} at address {address:x}" ) if len(data) > scanner.chunk_size + scanner.overlap: @@ -721,7 +718,7 @@ class LayerContainer(collections.abc.Mapping): raise NotImplementedError("Cycle checking has not yet been implemented") -class DummyProgress(object): +class DummyProgress: """A class to emulate Multiprocessing/threading Value objects.""" def __init__(self) -> None: diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py index 74902636e..f763815a6 100644 --- a/volatility3/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -46,7 +46,7 @@ class FileHandlerInterface(io.RawIOBase): def preferred_filename(self, filename: str): """Sets the preferred filename""" if self.closed: - raise IOError("FileHandler name cannot be changed once closed") + raise OSError("FileHandler name cannot be changed once closed") if not isinstance(filename, str): raise TypeError("FileHandler preferred filenames must be strings") if os.path.sep in filename: diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index b13de1834..7105274c0 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -26,7 +26,11 @@ from typing import ( Union, ) -Column = NamedTuple("Column", [("name", str), ("type", Any)]) + +class Column(NamedTuple): + name: str + type: Any + RenderOption = Any @@ -98,11 +102,11 @@ class TreeNode(abc.Sequence, metaclass=ABCMeta): """ -class BaseAbsentValue(object): +class BaseAbsentValue: """Class that represents values which are not present for some reason.""" -class Disassembly(object): +class Disassembly: """A class to indicate that the bytes provided should be disassembled (based on the architecture)""" @@ -137,7 +141,7 @@ ColumnsType = List[Tuple[str, BaseTypes]] VisitorSignature = Callable[[TreeNode, _Type], _Type] -class TreeGrid(object, metaclass=ABCMeta): +class TreeGrid(metaclass=ABCMeta): """Class providing the interface for a TreeGrid (which contains TreeNodes) The structure of a TreeGrid is designed to maintain the structure of the tree in a single object. diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index b645f5cd1..ead91fb4d 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -250,7 +250,6 @@ class BaseSymbolTableInterface: def clear_symbol_cache(self) -> None: """Clears the symbol cache of this symbol table.""" - pass class SymbolSpaceInterface(collections.abc.Mapping): @@ -378,7 +377,7 @@ class NativeTableInterface(BaseSymbolTableInterface): return [] -class MetadataInterface(object): +class MetadataInterface: """Interface for accessing metadata stored within a symbol table.""" def __init__(self, json_data: Dict) -> None: diff --git a/volatility3/framework/layers/crash.py b/volatility3/framework/layers/crash.py index 3cfc0a25b..a5b25d178 100644 --- a/volatility3/framework/layers/crash.py +++ b/volatility3/framework/layers/crash.py @@ -1,7 +1,6 @@ # This file is Copyright 2021 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import contextlib import logging import struct from typing import Tuple, Optional @@ -138,7 +137,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): ulong_bitmap_array = summary_header.get_buffer_long() # outer_index points to a 32 bits array inside a list of arrays, # each bit indicating a page mapping state - for outer_index in range(0, ulong_bitmap_array.vol.count): + for outer_index in range(ulong_bitmap_array.vol.count): ulong_bitmap = ulong_bitmap_array[outer_index] # All pages in this 32 bits array are mapped (speedup iteration process) if ulong_bitmap == 0xFFFFFFFF: @@ -166,7 +165,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): seg_first_bit = None # Some pages in this 32 bits array are mapped and some aren't else: - for inner_bit_position in range(0, 32): + for inner_bit_position in range(32): current_bit = outer_index * 32 + inner_bit_position page_mapped = ulong_bitmap & (1 << inner_bit_position) if page_mapped: @@ -220,9 +219,7 @@ class WindowsCrashDump32Layer(segmented.SegmentedLayer): for idx, (start_position, mapped_offset, length, _) in enumerate(segments): vollog.log( constants.LOGLEVEL_VVVV, - "Segment {}: Position {:#x} Offset {:#x} Length {:#x}".format( - idx, start_position, mapped_offset, length - ), + f"Segment {idx}: Position {start_position:#x} Offset {mapped_offset:#x} Length {length:#x}", ) self._segments = segments diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 7918ebed4..7c2c72ac1 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -76,13 +76,13 @@ class Intel(linear.LinearlyMappedLayer): self._index_shift = math.ceil(math.log2(struct.calcsize(self._entry_format))) @classproperty - @functools.lru_cache() + @functools.lru_cache def page_shift(cls) -> int: """Page shift for the intel memory layers.""" return cls._page_size_in_bits @classproperty - @functools.lru_cache() + @functools.lru_cache def page_size(cls) -> int: """Page size for the intel memory layers. @@ -91,25 +91,25 @@ class Intel(linear.LinearlyMappedLayer): return 1 << cls._page_size_in_bits @classproperty - @functools.lru_cache() + @functools.lru_cache def page_mask(cls) -> int: """Page mask for the intel memory layers.""" return ~(cls.page_size - 1) @classproperty - @functools.lru_cache() + @functools.lru_cache def bits_per_register(cls) -> int: """Returns the bits_per_register to determine the range of an IntelTranslationLayer.""" return cls._bits_per_register @classproperty - @functools.lru_cache() + @functools.lru_cache def minimum_address(cls) -> int: return 0 @classproperty - @functools.lru_cache() + @functools.lru_cache def maximum_address(cls) -> int: return (1 << cls._maxvirtaddr) - 1 @@ -251,12 +251,7 @@ class Intel(linear.LinearlyMappedLayer): if INTEL_TRANSLATION_DEBUGGING: vollog.log( constants.LOGLEVEL_VVVV, - "Entry {} at index {} gives data {} as {}".format( - hex(entry), - hex(index), - hex(struct.unpack(self._entry_format, entry_data)[0]), - name, - ), + f"Entry {hex(entry)} at index {hex(index)} gives data {hex(struct.unpack(self._entry_format, entry_data)[0])} as {name}", ) # Read out the new entry from memory diff --git a/volatility3/framework/layers/leechcore.py b/volatility3/framework/layers/leechcore.py index 542fd6ca2..eeede1673 100644 --- a/volatility3/framework/layers/leechcore.py +++ b/volatility3/framework/layers/leechcore.py @@ -48,7 +48,7 @@ if HAS_LEECHCORE: try: self._handle = leechcorepyc.LeechCore(self._device) except TypeError: - raise IOError(f"Unable to open LeechCore device {self._device}") + raise OSError(f"Unable to open LeechCore device {self._device}") return self._handle def fileno(self): diff --git a/volatility3/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py index ff483291c..a8127e954 100644 --- a/volatility3/framework/layers/qemu.py +++ b/volatility3/framework/layers/qemu.py @@ -236,7 +236,7 @@ class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): if self._architecture is None: vollog.log( constants.LOGLEVEL_VV, - f"QEVM architecture could not be determined", + "QEVM architecture could not be determined", ) # Once all segments have been read, determine the PCI hole if any diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 609832886..cc364ad50 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -156,9 +156,7 @@ class RegistryHive(linear.LinearlyMappedLayer): else: # It doesn't matter that we use KeyNode, we're just after the first two bytes vollog.debug( - "Unknown Signature {} (0x{:x}) at offset {}".format( - signature, cell.u.KeyNode.Signature, cell_offset - ) + f"Unknown Signature {signature} (0x{cell.u.KeyNode.Signature:x}) at offset {cell_offset}" ) return cell @@ -178,9 +176,7 @@ class RegistryHive(linear.LinearlyMappedLayer): if not root_node.vol.type_name.endswith(constants.BANG + "_CM_KEY_NODE"): raise RegistryFormatException( self.name, - "Encountered {} instead of _CM_KEY_NODE".format( - root_node.vol.type_name - ), + f"Encountered {root_node.vol.type_name} instead of _CM_KEY_NODE", ) node_key = [root_node] if key.endswith("\\"): diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index 2dba7caa8..c7a7fee67 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -57,7 +57,7 @@ def cascadeCloseFile(new_fp: IO[bytes], original_fp: IO[bytes]) -> IO[bytes]: return new_fp -class ResourceAccessor(object): +class ResourceAccessor: """Object for opening URLs as files (downloading locally first if necessary)""" diff --git a/volatility3/framework/layers/scanners/multiregexp.py b/volatility3/framework/layers/scanners/multiregexp.py index be3581f05..9831a9d8e 100644 --- a/volatility3/framework/layers/scanners/multiregexp.py +++ b/volatility3/framework/layers/scanners/multiregexp.py @@ -6,7 +6,7 @@ import re from typing import Generator, List, Tuple -class MultiRegexp(object): +class MultiRegexp: """Algorithm for multi-string matching.""" def __init__(self) -> None: diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 8aa527cdb..b241ed56a 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -22,8 +22,8 @@ def bswap_32(value: int) -> int: def bswap_64(value: int) -> int: - low = bswap_32((value >> 32)) - high = bswap_32((value & 0xFFFFFFFF)) + low = bswap_32(value >> 32) + high = bswap_32(value & 0xFFFFFFFF) return ((high << 32) | low) & 0xFFFFFFFFFFFFFFFF diff --git a/volatility3/framework/plugins/layerwriter.py b/volatility3/framework/plugins/layerwriter.py index 24149a390..10e7a7a72 100644 --- a/volatility3/framework/plugins/layerwriter.py +++ b/volatility3/framework/plugins/layerwriter.py @@ -119,7 +119,7 @@ class LayerWriter(plugins.PluginInterface): # Update the filename, which may have changed if a file # with the same name already existed. output_name = file_handle.preferred_filename - except IOError as excp: + except OSError as excp: yield 0, (f"Layer cannot be written to {output_name}: {excp}",) yield 0, (f"Layer has been written to {output_name}",) diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index cc3a08933..07582e2c1 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -53,7 +53,7 @@ class Check_idt(interfaces.plugins.PluginInterface): address_mask = self.context.layers[vmlinux.layer_name].address_mask # hw handlers + system call - check_idxs = list(range(0, 20)) + [128] + check_idxs = list(range(20)) + [128] if is_32bit: if vmlinux.has_type("gate_struct"): diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index b6634d612..3537a9fa1 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -103,7 +103,7 @@ class Check_syscall(plugins.PluginInterface): try: func_addr = vmlinux.get_symbol(syscall_entry_func).address - except exceptions.SymbolError as e: + except exceptions.SymbolError: # if we can't find the disassemble function then bail and rely on a different method return 0 diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 7dbf074b3..382268515 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -462,7 +462,7 @@ class InodePages(plugins.PluginInterface): f.seek(current_fp) f.write(page_bytes) - except IOError as e: + except OSError as e: vollog.error("Unable to write to file (%s): %s", filename, e) def _generator(self): diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 00832140a..065f239a9 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -125,9 +125,7 @@ class Maps(plugins.PluginInterface): proc_layer_name = task.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - pid, excp.invalid_address, excp.layer_name - ) + f"Process {pid}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) return None vm_size = vm_end - vm_start diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index 40784a647..0cca4704f 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -133,7 +133,7 @@ class PsScan(interfaces.plugins.PluginInterface): ) elif len(kernel_layer.dependencies) == 0: vollog.error( - f"Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan." + "Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan." ) raise exceptions.LayerException( kernel_layer_name, f"Layer {kernel_layer_name} has no dependencies" diff --git a/volatility3/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py index fe5179dfa..5c002e472 100644 --- a/volatility3/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -115,9 +115,7 @@ class Maps(interfaces.plugins.PluginInterface): proc_layer_name = task.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - pid, excp.invalid_address, excp.layer_name - ) + f"Process {pid}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) return None vm_size = vm_end - vm_start diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index c754e43ef..ba729f898 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -143,9 +143,7 @@ class Timeliner(interfaces.plugins.PluginInterface): times = self.timeline.get((plugin_name, item), {}) if times.get(timestamp_type, None) is not None: vollog.debug( - "Multiple timestamps for the same plugin/file combination found: {} {}".format( - plugin_name, item - ) + f"Multiple timestamps for the same plugin/file combination found: {plugin_name} {item}" ) times[timestamp_type] = timestamp self.timeline[(plugin_name, item)] = times diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index 8cfb5576c..9bd9eda0e 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -84,9 +84,7 @@ class CmdLine(interfaces.plugins.PluginInterface): result_text = f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)" except exceptions.InvalidAddressException as exp: - result_text = "Process {}: Required memory at {:#x} is not valid (incomplete layer {}?)".format( - proc_id, exp.invalid_address, exp.layer_name - ) + result_text = f"Process {proc_id}: Required memory at {exp.invalid_address:#x} is not valid (incomplete layer {exp.layer_name}?)" yield (0, (proc.UniqueProcessId, process_name, result_text)) diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index ad1c9d4bd..a448989c0 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -95,9 +95,7 @@ class Consoles(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - proc_id, excp.invalid_address, excp.layer_name - ) + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) @classmethod @@ -176,12 +174,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) vollog.debug( - "Determined OS Version: {}.{} {}.{}".format( - kuser.NtMajorVersion, - kuser.NtMinorVersion, - vers.MajorVersion, - vers.MinorVersion, - ) + f"Determined OS Version: {kuser.NtMajorVersion}.{kuser.NtMinorVersion} {vers.MajorVersion}.{vers.MinorVersion}" ) if nt_major_version == 10 and arch == "x64": @@ -260,9 +253,7 @@ class Consoles(interfaces.plugins.PluginInterface): if ver: conhost_mod_version = ver[3] vollog.debug( - "Determined conhost.exe's FileVersion: {}".format( - conhost_mod_version - ) + f"Determined conhost.exe's FileVersion: {conhost_mod_version}" ) else: vollog.debug("Could not determine conhost.exe's FileVersion.") @@ -311,12 +302,7 @@ class Consoles(interfaces.plugins.PluginInterface): else: raise NotImplementedError( - "This version of Windows is not supported: {}.{} {}.{}!".format( - nt_major_version, - nt_minor_version, - vers.MajorVersion, - vers_minor_version, - ) + f"This version of Windows is not supported: {nt_major_version}.{nt_minor_version} {vers.MajorVersion}.{vers_minor_version}!" ) vollog.debug(f"Determined symbol filename: {filename}") diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 5a1b37fcf..57f19f620 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -5,9 +5,9 @@ import contextlib import datetime import logging import re -from typing import List, Optional, Type +from typing import List -from volatility3.framework import constants, exceptions, interfaces, renderers +from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed @@ -199,16 +199,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _depth, row_data = row if not isinstance(row_data[6], datetime.datetime): continue - description = ( - "DLL Load: Process {} {} Loaded {} ({}) Size {} Offset {}".format( - row_data[0], - row_data[1], - row_data[4], - row_data[5], - row_data[3], - row_data[2], - ) - ) + description = f"DLL Load: Process {row_data[0]} {row_data[1]} Loaded {row_data[4]} ({row_data[5]}) Size {row_data[3]} Offset {row_data[2]}" yield (description, timeliner.TimeLinerType.CREATED, row_data[6]) def run(self): diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index bc554c0bf..64d9be4db 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -192,13 +192,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): for memory_object, layer, extension in dump_parameters: cache_name = EXTENSION_CACHE_MAP[extension] - desired_file_name = "file.{0:#x}.{1:#x}.{2}.{3}.{4}".format( - file_obj.vol.offset, - memory_object.vol.offset, - cache_name, - ntpath.basename(obj_name), - extension, - ) + desired_file_name = f"file.{file_obj.vol.offset:#x}.{memory_object.vol.offset:#x}.{cache_name}.{ntpath.basename(obj_name)}.{extension}" file_handle = cls.dump_file_producer( file_obj, memory_object, open_method, layer, desired_file_name diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 66db03c9c..cac4ecf40 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -92,7 +92,7 @@ class Envars(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, registry.RegistryFormatException, - ) as excp: + ): vollog.log( constants.LOGLEVEL_VVV, "Error while parsing global environment variables keys (some keys might be excluded)", @@ -113,7 +113,7 @@ class Envars(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, registry.RegistryFormatException, - ) as excp: + ): vollog.log( constants.LOGLEVEL_VVV, "Error while parsing user environment variables keys (some keys might be excluded)", @@ -134,7 +134,7 @@ class Envars(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, registry.RegistryFormatException, - ) as excp: + ): vollog.log( constants.LOGLEVEL_VVV, "Error while parsing volatile environment variables keys (some keys might be excluded)", diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 9b20ed2d0..37df940a2 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -55,7 +55,7 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): ) # Get service sids dictionary (we need only the service sids). - with open(sids_json_file_name, "r") as file_handle: + with open(sids_json_file_name) as file_handle: self.servicesids = json.load(file_handle)["service sids"] @classmethod diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 3e332f85d..df0c7a835 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -58,7 +58,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): ) # Get all the sids from the json file. - with open(sids_json_file_name, "r") as file_handle: + with open(sids_json_file_name) as file_handle: sids_json_data = json.load(file_handle) self.servicesids = sids_json_data["service sids"] self.well_known_sids = sids_json_data["well known"] @@ -122,7 +122,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, layers.registry.RegistryFormatException, - ) as excp: + ): continue try: value_data = node.decode_data() @@ -156,7 +156,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): ValueError, exceptions.InvalidAddressException, layers.registry.RegistryFormatException, - ) as excp: + ): continue except (KeyError, exceptions.InvalidAddressException): continue diff --git a/volatility3/framework/plugins/windows/hollowprocesses.py b/volatility3/framework/plugins/windows/hollowprocesses.py index 69fa94f06..30d4b602c 100644 --- a/volatility3/framework/plugins/windows/hollowprocesses.py +++ b/volatility3/framework/plugins/windows/hollowprocesses.py @@ -12,20 +12,15 @@ from volatility3.plugins.windows import pslist, vadinfo vollog = logging.getLogger(__name__) -VadData = NamedTuple( - "VadData", - [ - ("protection", str), - ("path", str), - ], -) -DLLData = NamedTuple( - "DLLData", - [ - ("path", str), - ], -) +class VadData(NamedTuple): + protection: str + path: str + + +class DLLData(NamedTuple): + path: str + ### Useful references on process hollowing # https://cysinfo.com/detecting-deceptive-hollowing-techniques/ @@ -146,9 +141,7 @@ class HollowProcesses(interfaces.plugins.PluginInterface): """ image_base = self._get_image_base(proc) if image_base is not None and image_base != proc.SectionBaseAddress: - yield "The ImageBaseAddress reported from the PEB ({:#x}) does not match the process SectionBaseAddress ({:#x})".format( - image_base, proc.SectionBaseAddress - ) + yield f"The ImageBaseAddress reported from the PEB ({image_base:#x}) does not match the process SectionBaseAddress ({proc.SectionBaseAddress:#x})" def _check_exe_protection( self, proc, vads: Dict[int, VadData], __ @@ -166,13 +159,9 @@ class HollowProcesses(interfaces.plugins.PluginInterface): base = proc.SectionBaseAddress if base not in vads: - yield "There is no VAD starting at the base address of the process executable ({:#x})".format( - base - ) + yield f"There is no VAD starting at the base address of the process executable ({base:#x})" elif vads[base].protection != "PAGE_EXECUTE_WRITECOPY": - yield "Unexpected protection ({}) for VAD hosting the process executable ({:#x}) with path {}".format( - vads[base].protection, base, vads[base].path - ) + yield f"Unexpected protection ({vads[base].protection}) for VAD hosting the process executable ({base:#x}) with path {vads[base].path}" def _check_dlls_protection( self, _, vads: Dict[int, VadData], dlls: Dict[int, DLLData] @@ -184,9 +173,7 @@ class HollowProcesses(interfaces.plugins.PluginInterface): # PAGE_EXECUTE_WRITECOPY is the only valid permission for mapped DLLs and .exe files if vads[dll_base].protection != "PAGE_EXECUTE_WRITECOPY": - yield "Unexpected protection ({}) for DLL in the PEB's load order list ({:#x}) with path {}".format( - vads[dll_base].protection, dll_base, dlls[dll_base].path - ) + yield f"Unexpected protection ({vads[dll_base].protection}) for DLL in the PEB's load order list ({dll_base:#x}) with path {dlls[dll_base].path}" def _generator(self, procs): checks = [ diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index d2fdc0ad8..3bf7f57ed 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -1,7 +1,9 @@ # This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 -import logging, io, pefile +import logging +import io +import pefile from volatility3.framework.symbols import intermed from volatility3.framework import renderers, interfaces, exceptions, constants from volatility3.framework.configuration import requirements @@ -119,9 +121,7 @@ class IAT(interfaces.plugins.PluginInterface): ) except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - proc_id, excp.invalid_address, excp.layer_name - ) + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) continue diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 1df090b5b..510719352 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -106,9 +106,7 @@ class Malfind(interfaces.plugins.PluginInterface): proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - proc_id, excp.invalid_address, excp.layer_name - ) + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) return None @@ -211,9 +209,7 @@ class Malfind(interfaces.plugins.PluginInterface): file_output = file_handle.preferred_filename except (exceptions.InvalidAddressException, OverflowError) as excp: vollog.debug( - "Unable to dump PE with pid {0}.{1:#x}: {2}".format( - proc.UniqueProcessId, vad.get_start(), excp - ) + f"Unable to dump PE with pid {proc.UniqueProcessId}.{vad.get_start():#x}: {excp}" ) yield ( diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index b5c9a211e..62ab3c510 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -53,9 +53,7 @@ class Memmap(interfaces.plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - pid, excp.invalid_address, excp.layer_name - ) + f"Process {pid}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) continue @@ -80,11 +78,7 @@ class Memmap(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: file_output = "Error outputting to file" vollog.debug( - "Unable to write {}'s address {} to {}".format( - proc_layer_name, - offset, - file_handle.preferred_filename, - ) + f"Unable to write {proc_layer_name}'s address {offset} to {file_handle.preferred_filename}" ) yield ( diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index ba45834d5..2e8dc1b0e 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -177,9 +177,7 @@ class Modules(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VVV, - "Process {} does not have a valid Session or a layer could not be constructed for it".format( - proc_id - ), + f"Process {proc_id} does not have a valid Session or a layer could not be constructed for it", ) continue diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index 66a24da5a..77bd22ab9 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -169,12 +169,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) vollog.debug( - "Determined OS Version: {}.{} {}.{}".format( - kuser.NtMajorVersion, - kuser.NtMinorVersion, - vers.MajorVersion, - vers.MinorVersion, - ) + f"Determined OS Version: {kuser.NtMajorVersion}.{kuser.NtMinorVersion} {vers.MajorVersion}.{vers.MinorVersion}" ) if nt_major_version == 10 and arch == "x64": @@ -272,9 +267,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): if ver: tcpip_mod_version = ver[3] vollog.debug( - "Determined tcpip.sys's FileVersion: {}".format( - tcpip_mod_version - ) + f"Determined tcpip.sys's FileVersion: {tcpip_mod_version}" ) else: vollog.debug("Could not determine tcpip.sys's FileVersion.") @@ -316,12 +309,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): else: raise NotImplementedError( - "This version of Windows is not supported: {}.{} {}.{}!".format( - nt_major_version, - nt_minor_version, - vers.MajorVersion, - vers_minor_version, - ) + f"This version of Windows is not supported: {nt_major_version}.{nt_minor_version} {vers.MajorVersion}.{vers_minor_version}!" ) vollog.debug(f"Determined symbol filename: {filename}") @@ -510,17 +498,8 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): for i in row_data ] description = ( - "Network connection: Process {} {} Local Address {}:{} " - "Remote Address {}:{} State {} Protocol {} ".format( - row_data[7], - row_data[8], - row_data[2], - row_data[3], - row_data[4], - row_data[5], - row_data[6], - row_data[1], - ) + f"Network connection: Process {row_data[7]} {row_data[8]} Local Address {row_data[2]}:{row_data[3]} " + f"Remote Address {row_data[4]}:{row_data[5]} State {row_data[6]} Protocol {row_data[1]} " ) yield (description, timeliner.TimeLinerType.CREATED, row_data[9]) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 0908767fc..c774e23a3 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -311,9 +311,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): part_table.Partitions.count = part_count vollog.debug( - "Found TCP connection PartitionTable @ 0x{:x} (partition count: {})".format( - part_table_addr, part_count - ) + f"Found TCP connection PartitionTable @ 0x{part_table_addr:x} (partition count: {part_count})" ) entry_offset = context.symbol_space.get_type(obj_name).relative_child_offset( "ListEntry" @@ -624,9 +622,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): proto = "TCPv6" else: vollog.debug( - "TCP Endpoint @ 0x{:2x} has unknown address family 0x{:x}".format( - netw_obj.vol.offset, netw_obj.get_address_family() - ) + f"TCP Endpoint @ 0x{netw_obj.vol.offset:2x} has unknown address family 0x{netw_obj.get_address_family():x}" ) proto = "TCPv?" diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 955098d6b..002577241 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -645,7 +645,7 @@ class PESymbols(interfaces.plugins.PluginInterface): and wanted_addresses_identifier not in wanted_symbols ): vollog.warning( - f"Invalid `wanted_symbols` sent to `find_symbols`. addresses and names keys both misssing." + "Invalid `wanted_symbols` sent to `find_symbols`. addresses and names keys both misssing." ) return diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 5b4bb07d7..d2a8a7370 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -64,27 +64,30 @@ class PEDump(interfaces.plugins.PluginInterface): """ Returns the filename of the dump file or None """ - with open_method(file_name) as file_handle: - try: - dos_header = context.object( - pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", - offset=base, - layer_name=layer_name, - ) + try: + file_handle = open_method(file_name) - for offset, data in dos_header.reconstruct(): - file_handle.seek(offset) - file_handle.write(data) - except ( - IOError, - exceptions.VolatilityException, - OverflowError, - ValueError, - ) as excp: - vollog.debug(f"Unable to dump PE file at offset {base}: {excp}") - return None + dos_header = context.object( + pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", + offset=base, + layer_name=layer_name, + ) - return file_handle.preferred_filename + for offset, data in dos_header.reconstruct(): + file_handle.seek(offset) + file_handle.write(data) + except ( + OSError, + exceptions.VolatilityException, + OverflowError, + ValueError, + ) as excp: + vollog.debug(f"Unable to dump PE file at offset {base}: {excp}") + return None + finally: + file_handle.close() + + return file_handle.preferred_filename @classmethod def dump_ldr_entry( @@ -116,12 +119,7 @@ class PEDump(interfaces.plugins.PluginInterface): if layer_name is None: layer_name = ldr_entry.vol.layer_name - file_name = "{}{}.{:#x}.{:#x}.dmp".format( - prefix, - ntpath.basename(name), - ldr_entry.vol.offset, - ldr_entry.DllBase, - ) + file_name = f"{prefix}{ntpath.basename(name)}.{ldr_entry.vol.offset:#x}.{ldr_entry.DllBase:#x}.dmp" return cls.dump_pe( context, @@ -143,11 +141,7 @@ class PEDump(interfaces.plugins.PluginInterface): pid: int, base: int, ) -> Optional[str]: - file_name = "PE.{:#x}.{:d}.{:#x}.dmp".format( - proc_offset, - pid, - base, - ) + file_name = f"PE.{proc_offset:#x}.{pid:d}.{base:#x}.dmp" return PEDump.dump_pe( context, pe_table_name, layer_name, open_method, file_name, base diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index 0370dfc92..7b4d00205 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -39,7 +39,7 @@ class Privs(interfaces.plugins.PluginInterface): ) # Get service sids dictionary (we need only the service sids). - with open(sids_json_file_name, "r") as file_handle: + with open(sids_json_file_name) as file_handle: temp_json = json.load(file_handle)["privileges"] self.privilege_info = { int(priv_num): temp_json[priv_num] for priv_num in temp_json diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 6c845bf81..053ec20d5 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -14,7 +14,6 @@ from volatility3.plugins.windows import ( info, pslist, psscan, - sessions, thrdscan, ) diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index ddc9c1855..91a99a9fb 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -232,10 +232,8 @@ class HiveList(interfaces.plugins.PluginInterface): for hive in hg: if hive.vol.offset in seen: vollog.debug( - "Hivelist found an already seen offset {} while " - "traversing forwards, this should not occur".format( - hex(hive.vol.offset) - ) + f"Hivelist found an already seen offset {hex(hive.vol.offset)} while " + "traversing forwards, this should not occur" ) break seen.add(hive.vol.offset) @@ -249,18 +247,14 @@ class HiveList(interfaces.plugins.PluginInterface): forward_invalid = hg.invalid if forward_invalid: vollog.debug( - "Hivelist failed traversing the list forwards at {}, traversing backwards".format( - hex(forward_invalid) - ) + f"Hivelist failed traversing the list forwards at {hex(forward_invalid)}, traversing backwards" ) hg = HiveGenerator(cmhive, forward=False) for hive in hg: if hive.vol.offset in seen: vollog.debug( - "Hivelist found an already seen offset {} while " - "traversing backwards, list walking met in the middle".format( - hex(hive.vol.offset) - ) + f"Hivelist found an already seen offset {hex(hive.vol.offset)} while " + "traversing backwards, list walking met in the middle" ) break seen.add(hive.vol.offset) @@ -281,10 +275,8 @@ class HiveList(interfaces.plugins.PluginInterface): # by walking the list, so revert to scanning, and walk the list forwards and backwards from each # found hive vollog.debug( - "Hivelist failed traversing backwards at {}, a different " - "location from forwards, revert to scanning".format( - hex(backward_invalid) - ) + f"Hivelist failed traversing backwards at {hex(backward_invalid)}, a different " + "location from forwards, revert to scanning" ) for hive in hivescan.HiveScan.scan_hives( context, layer_name, symbol_table @@ -320,9 +312,7 @@ class HiveList(interfaces.plugins.PluginInterface): yield linked_hive except exceptions.InvalidAddressException: vollog.debug( - "InvalidAddressException when traversing hive {} found from scan, skipping".format( - hex(hive.vol.offset) - ) + f"InvalidAddressException when traversing hive {hex(hive.vol.offset)} found from scan, skipping" ) def run(self) -> renderers.TreeGrid: diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index bd832b20c..932ee9d6f 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -39,7 +39,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac os.path.join(os.path.dirname(__file__), "userassist.json"), "rb" ) as fp: self._folder_guids = json.load(fp) - except IOError: + except OSError: vollog.error("Usersassist data file not found") @classmethod @@ -308,9 +308,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac ) except exceptions.InvalidAddressException as excp: vollog.debug( - "Invalid address identified in lower layer {}: {}".format( - excp.layer_name, excp.invalid_address - ) + f"Invalid address identified in lower layer {excp.layer_name}: {excp.invalid_address}" ) except KeyError: vollog.debug( diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index d321c2cc0..f5d7e1b3a 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -172,9 +172,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: vollog.debug( - "Unable to construct cSystems array at given offset: {:x}".format( - array_start - ) + f"Unable to construct cSystems array at given offset: {array_start:x}" ) array = None @@ -291,9 +289,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - proc_id, excp.invalid_address, excp.layer_name - ) + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) return None, None diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index 0eaa65884..b8dea0cdd 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -170,9 +170,7 @@ class Strings(interfaces.plugins.PluginInterface): proc_layer_name = process.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - proc_id, excp.invalid_address, excp.layer_name - ) + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) continue diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index a59581063..7c26a09bd 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -85,9 +85,7 @@ class SvcList(svcscan.SvcScan): layer_name = proc.add_process_layer() except exceptions.InvalidAddressException: vollog.warning( - "Unable to access memory of services.exe running with PID: {}".format( - proc.UniqueProcessId - ) + f"Unable to access memory of services.exe running with PID: {proc.UniqueProcessId}" ) continue diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index ca390561f..bd477ba27 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -26,13 +26,9 @@ from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) -ServiceBinaryInfo = NamedTuple( - "ServiceBinaryInfo", - [ - ("dll", Union[str, interfaces.renderers.BaseAbsentValue]), - ("binary", Union[str, interfaces.renderers.BaseAbsentValue]), - ], -) +class ServiceBinaryInfo(NamedTuple): + dll: Union[str, interfaces.renderers.BaseAbsentValue] + binary: Union[str, interfaces.renderers.BaseAbsentValue] class SvcScan(interfaces.plugins.PluginInterface): @@ -306,9 +302,7 @@ class SvcScan(interfaces.plugins.PluginInterface): proc_layer_name = task.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - proc_id, excp.invalid_address, excp.layer_name - ) + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) continue diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index b812a15ff..c0963e754 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -82,7 +82,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) ethread.get_exit_time() ) # datetime.datetime object / volatility3.framework.renderers.UnparsableValue object except exceptions.InvalidAddressException: - vollog.debug("Thread invalid address {:#x}".format(ethread.vol.offset)) + vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None return ( diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 98a3169a5..a34818fc1 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -3,7 +3,7 @@ # import logging -from typing import Callable, Iterable, List, Generator +from typing import Iterable, List, Generator from volatility3.framework import interfaces, constants from volatility3.framework.configuration import requirements diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index d49c28784..54bca1a1e 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -141,7 +141,7 @@ class Timers(interfaces.plugins.PluginInterface): if dpc.DeferredRoutine == 0: continue deferred_routine = dpc.DeferredRoutine - except Exception as e: + except Exception: continue module_symbols = list( diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index 1a1e59940..5b21225c8 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -191,7 +191,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): # gather processes on small_idx since these are the malware infected ones for pid, pname in cb[small_idx]: - ps.append("{:d}:{}".format(pid, pname)) + ps.append(f"{pid:d}:{pname}") proc_names = ", ".join(ps) diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 2c6ed4daf..0c4a8aaca 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -169,9 +169,7 @@ class VadInfo(interfaces.plugins.PluginInterface): proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - proc_id, excp.invalid_address, excp.layer_name - ) + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) return None diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 4a06ed0c9..4930789d2 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -212,9 +212,7 @@ class VerInfo(interfaces.plugins.PluginInterface): proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException as excp: vollog.debug( - "Process {}: invalid address {} in layer {}".format( - proc_id, excp.invalid_address, excp.layer_name - ) + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" ) continue diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index 43bb59a21..02805acc2 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -88,9 +88,7 @@ class TreeNode(interfaces.renderers.TreeNode): val = values[index] if not isinstance(val, (column.type, interfaces.renderers.BaseAbsentValue)): raise TypeError( - "Values item with index {} is the wrong type for column {} (got {} but expected {})".format( - index, column.name, type(val), column.type - ) + f"Values item with index {index} is the wrong type for column {column.name} (got {type(val)} but expected {column.type})" ) # TODO: Consider how to deal with timezone naive/aware datetimes (and alert plugin uses to be precise) # if isinstance(val, datetime.datetime): @@ -189,9 +187,7 @@ class TreeGrid(interfaces.renderers.TreeGrid): is_simple_type = issubclass(column_type, self.base_types) if not is_simple_type: raise TypeError( - "Column {}'s type is not a simple type: {}".format( - name, column_type.__class__.__name__ - ) + f"Column {name}'s type is not a simple type: {column_type.__class__.__name__}" ) converted_columns.append(interfaces.renderers.Column(name, column_type)) self.RowStructure = RowStructureConstructor( diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 5f558bf12..8a28d732f 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -171,7 +171,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): (indicating that only additive changes have been made) than the consumer (in this case, the file reader). """ - major, minor, patch = [int(x) for x in version.split(".")] + major, minor, patch = (int(x) for x in version.split(".")) supported_versions = [x for x in versions if x[0] == major and x[1] >= minor] if not supported_versions: raise ValueError( diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 3289775b6..537b729ad 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -798,7 +798,7 @@ class RadixTree(IDStorage): return True -class PageCache(object): +class PageCache: """Linux Page Cache abstraction""" def __init__( diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 829622154..e9fd09eaa 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1469,7 +1469,7 @@ class mount(objects.StructType): def next_peer(self): table_name = self.vol.type_name.split(constants.BANG)[0] - mount_struct = "{0}{1}mount".format(table_name, constants.BANG) + mount_struct = f"{table_name}{constants.BANG}mount" offset = self._context.symbol_space.get_type( mount_struct ).relative_child_offset("mnt_share") @@ -2487,7 +2487,7 @@ class address_space(objects.StructType): class page(objects.StructType): @property - @functools.lru_cache() + @functools.lru_cache def pageflags_enum(self) -> Dict: """Returns 'pageflags' enumeration key/values diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 793e506c3..07ab5f5a8 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -1081,7 +1081,7 @@ class KTIMER(objects.StructType): return self.Header.Type in self.VALID_TYPES def get_due_time(self): - return "{0:#010x}:{1:#010x}".format(self.DueTime.HighPart, self.DueTime.LowPart) + return f"{self.DueTime.HighPart:#010x}:{self.DueTime.LowPart:#010x}" def get_dpc(self): """Return Dpc, and if Windows 7 or later, decode it""" @@ -1388,7 +1388,7 @@ class SHARED_CACHE_MAP(objects.StructType): ) # Iterate through the entries - for counter in range(0, self.VACB_ARRAY): + for counter in range(self.VACB_ARRAY): # Check if the VACB entry is in use if not vacb_array[counter]: continue @@ -1472,7 +1472,7 @@ class SHARED_CACHE_MAP(objects.StructType): if not section_size > self.VACB_SIZE_OF_FIRST_LEVEL: array_head = vacb_obj - for counter in range(0, full_blocks): + for counter in range(full_blocks): vacb_entry = self._context.object( symbol_table_name + constants.BANG + "pointer", layer_name=self.vol.layer_name, @@ -1531,7 +1531,7 @@ class SHARED_CACHE_MAP(objects.StructType): # Walk the array and if any entry points to the shared cache map object then we extract it. # Otherwise, if it is non-zero, then traverse to the next level. - for counter in range(0, self.VACB_ARRAY): + for counter in range(self.VACB_ARRAY): if not vacb_array[counter]: continue diff --git a/volatility3/framework/symbols/windows/extensions/consoles.py b/volatility3/framework/symbols/windows/extensions/consoles.py index 2312149c7..cf6f43a9b 100644 --- a/volatility3/framework/symbols/windows/extensions/consoles.py +++ b/volatility3/framework/symbols/windows/extensions/consoles.py @@ -73,7 +73,7 @@ class ROW(objects.StructType): ) for i in range(0, len(char_row), 3) ) - except Exception as e: + except Exception: line = "" if truncate: diff --git a/volatility3/framework/symbols/windows/extensions/mbr.py b/volatility3/framework/symbols/windows/extensions/mbr.py index afdc73a17..078c4beb0 100644 --- a/volatility3/framework/symbols/windows/extensions/mbr.py +++ b/volatility3/framework/symbols/windows/extensions/mbr.py @@ -8,12 +8,7 @@ from volatility3.framework import objects class PARTITION_TABLE(objects.StructType): def get_disk_signature(self) -> str: """Get Disk Signature (GUID).""" - return "{0:02x}-{1:02x}-{2:02x}-{3:02x}".format( - self.DiskSignature[0], - self.DiskSignature[1], - self.DiskSignature[2], - self.DiskSignature[3], - ) + return f"{self.DiskSignature[0]:02x}-{self.DiskSignature[1]:02x}-{self.DiskSignature[2]:02x}-{self.DiskSignature[3]:02x}" class PARTITION_ENTRY(objects.StructType): diff --git a/volatility3/framework/symbols/windows/extensions/network.py b/volatility3/framework/symbols/windows/extensions/network.py index 9b7573c2e..00c24f176 100644 --- a/volatility3/framework/symbols/windows/extensions/network.py +++ b/volatility3/framework/symbols/windows/extensions/network.py @@ -22,7 +22,7 @@ def inet_ntop(address_family: int, packed_ip: Union[List[int], Array]) -> str: raise RuntimeError( "This version of python does not have socket.inet_ntop, please upgrade" ) - raise socket.error("[Errno 97] Address family not supported by protocol") + raise OSError("[Errno 97] Address family not supported by protocol") # Python's socket.AF_INET6 is 0x1e but Microsoft defines it @@ -167,11 +167,9 @@ class _TCP_LISTENER(objects.StructType): def is_valid(self): try: - if not self.get_address_family() in (AF_INET, AF_INET6): + if self.get_address_family() not in (AF_INET, AF_INET6): vollog.debug( - "netw obj 0x{:x} invalid due to invalid address_family {}".format( - self.vol.offset, self.get_address_family() - ) + f"netw obj 0x{self.vol.offset:x} invalid due to invalid address_family {self.get_address_family()}" ) return False diff --git a/volatility3/framework/symbols/windows/extensions/pe.py b/volatility3/framework/symbols/windows/extensions/pe.py index 3f34fc3dd..2c7400f25 100644 --- a/volatility3/framework/symbols/windows/extensions/pe.py +++ b/volatility3/framework/symbols/windows/extensions/pe.py @@ -101,9 +101,9 @@ class IMAGE_DOS_HEADER(objects.StructType): ) except OverflowError: vollog.warning( - "Volatility was unable to fix the image base for the PE file at base address {:#x}. " + f"Volatility was unable to fix the image base for the PE file at base address {self.vol.offset:#x}. " "This will cause issues with many static analysis tools if you do not inform the " - "tool of the in-memory load address.".format(self.vol.offset) + "tool of the in-memory load address." ) new_pe = raw_data diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index b761ddad8..5a7847986 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -217,7 +217,7 @@ class POOL_HEADER(objects.StructType): yield mem_object @classmethod - @functools.lru_cache() + @functools.lru_cache def _calculate_optional_header_lengths( cls, context: interfaces.context.ContextInterface, symbol_table_name: str ) -> Tuple[List[str], List[int]]: @@ -430,9 +430,7 @@ class OBJECT_HEADER(objects.StructType): if header_offset == 0: raise ValueError( - "Could not find _OBJECT_HEADER_NAME_INFO for object at {} of layer {}".format( - self.vol.offset, self.vol.layer_name - ) + f"Could not find _OBJECT_HEADER_NAME_INFO for object at {self.vol.offset} of layer {self.vol.layer_name}" ) header = ntkrnlmp.object( diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index bebfaea89..9e2f8df3b 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -196,9 +196,7 @@ class CM_KEY_NODE(objects.StructType): yield cast("CM_KEY_NODE", node) else: vollog.debug( - "Unexpected node type encountered when traversing subkeys: {}, signature: {}".format( - node.vol.type_name, signature - ) + f"Unexpected node type encountered when traversing subkeys: {node.vol.type_name}, signature: {signature}" ) if listjump: diff --git a/volatility3/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py index 82ec31ccb..4feb396e7 100644 --- a/volatility3/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -263,9 +263,7 @@ class PdbReader: ) if header.index_max < header.index_min: raise ValueError( - "Maximum {} index is smaller than minimum TPI index, found: {} < {} ".format( - stream_name, header.index_max, header.index_min - ) + f"Maximum {stream_name} index is smaller than minimum TPI index, found: {header.index_max} < {header.index_min} " ) # Reset the state info_references: Dict[str, int] = {} @@ -976,7 +974,7 @@ class PdbRetreiver: if __name__ == "__main__": import argparse - class PrintedProgress(object): + class PrintedProgress: """A progress handler that prints the progress value and the description onto the command line.""" diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 3816312cd..1a8644fa8 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -94,7 +94,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): if not requirements.VersionRequirement.matches_required( (1, 0, 0), symbol_cache.SqliteCache.version ): - vollog.debug(f"Required version of SQLiteCache not found") + vollog.debug("Required version of SQLiteCache not found") return None identifiers_path = os.path.join( @@ -291,9 +291,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): break except PermissionError: vollog.warning( - "Cannot write necessary symbol file, please check permissions on {}".format( - potential_output_filename - ) + f"Cannot write necessary symbol file, please check permissions on {potential_output_filename}" ) continue finally: diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 5ef840f32..8587b3719 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -60,7 +60,7 @@ class Certificates(interfaces.plugins.PluginInterface): open_method: Type[interfaces.plugins.FileHandlerInterface], ) -> Optional[interfaces.plugins.FileHandlerInterface]: try: - dump_name = "{}-{}-{}.crt".format(hive_offset, reg_section, key_hash) + dump_name = f"{hive_offset}-{reg_section}-{key_hash}.crt" file_handle = open_method(dump_name) file_handle.write(certificate_data) return file_handle diff --git a/volatility3/plugins/windows/statistics.py b/volatility3/plugins/windows/statistics.py index 7f56b75f8..e7557dc0c 100644 --- a/volatility3/plugins/windows/statistics.py +++ b/volatility3/plugins/windows/statistics.py @@ -64,9 +64,7 @@ class Statistics(plugins.PluginInterface): other_invalid += 1 page_size = expected_page_size vollog.debug( - "A non-page lookup invalid address exception occurred at: {} in layer {}".format( - hex(excp.invalid_address), excp.layer_name - ) + f"A non-page lookup invalid address exception occurred at: {hex(excp.invalid_address)} in layer {excp.layer_name}" ) page_addr += page_size diff --git a/volatility3/schemas/__init__.py b/volatility3/schemas/__init__.py index 3ca00e5dc..90cfaba48 100644 --- a/volatility3/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -20,7 +20,7 @@ def load_cached_validations() -> Set[str]: to revalidate them.""" validhashes: Set = set() if os.path.exists(cached_validation_filepath): - with open(cached_validation_filepath, "r") as f: + with open(cached_validation_filepath) as f: validhashes.update(json.load(f)) return validhashes @@ -46,7 +46,7 @@ def validate(input: Dict[str, Any], use_cache: bool = True) -> bool: if not os.path.exists(schema_path): vollog.debug(f"Schema for format not found: {schema_path}") return False - with open(schema_path, "r") as s: + with open(schema_path) as s: schema = json.load(s) return valid(input, schema, use_cache) @@ -66,7 +66,7 @@ def create_json_hash( if not os.path.exists(schema_path): vollog.debug(f"Schema for format not found: {schema_path}") return None - with open(schema_path, "r") as s: + with open(schema_path) as s: schema = json.load(s) return hashlib.sha1( bytes(json.dumps((input, schema), sort_keys=True), "utf-8") From a63ea662f46bcbcf156df1d4bd69257c4ac0a0b3 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 17:05:34 +0100 Subject: [PATCH 0186/1352] apply unsafe fixes (`ruff check --unsafe-fixes --fix`) --- test/plugins/windows/test_scheduled_tasks.py | 3 +- volatility3/framework/__init__.py | 9 +++-- volatility3/framework/plugins/linux/lsmod.py | 3 +- volatility3/framework/plugins/linux/proc.py | 4 ++- .../framework/plugins/linux/sockstat.py | 2 +- .../framework/plugins/mac/check_sysctl.py | 5 ++- volatility3/framework/plugins/mac/kevents.py | 3 +- volatility3/framework/plugins/mac/mount.py | 3 +- .../framework/plugins/mac/proc_maps.py | 4 ++- volatility3/framework/plugins/mac/pslist.py | 4 ++- volatility3/framework/plugins/timeliner.py | 3 +- .../framework/plugins/windows/handles.py | 6 ++-- .../framework/plugins/windows/modules.py | 3 +- .../framework/plugins/windows/netstat.py | 5 ++- .../framework/plugins/windows/pslist.py | 35 +++++++++++++------ .../framework/plugins/windows/psscan.py | 35 ++++++++++++------- .../framework/plugins/windows/shimcachemem.py | 7 ++-- .../framework/plugins/windows/svclist.py | 5 ++- .../framework/plugins/windows/threads.py | 3 +- .../plugins/windows/unloadedmodules.py | 3 +- .../framework/plugins/windows/virtmap.py | 3 +- .../framework/renderers/format_hints.py | 30 +++++++++------- .../framework/symbols/linux/__init__.py | 6 ++-- .../symbols/linux/extensions/__init__.py | 12 +++---- volatility3/framework/symbols/mac/__init__.py | 15 ++++---- .../symbols/windows/extensions/__init__.py | 15 ++++---- .../symbols/windows/extensions/consoles.py | 23 +++++------- .../framework/symbols/windows/pdbconv.py | 5 ++- 28 files changed, 129 insertions(+), 125 deletions(-) diff --git a/test/plugins/windows/test_scheduled_tasks.py b/test/plugins/windows/test_scheduled_tasks.py index 8f771b323..fdb19fbae 100644 --- a/test/plugins/windows/test_scheduled_tasks.py +++ b/test/plugins/windows/test_scheduled_tasks.py @@ -84,8 +84,7 @@ class TestActionsDecoding(unittest.TestCase): self.assertEqual(actions[0].action_type, scheduled_tasks.ActionType.Exe) except Exception: self.fail( - "ActionDecoder.decode should not raise exception:\n%s" - % traceback.format_exc() + f"ActionDecoder.decode should not raise exception:\n{traceback.format_exc()}" ) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index e0f7c778a..244b353a2 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -97,8 +97,7 @@ def class_subclasses(cls: Type[T]) -> Generator[Type[T], None, None]: # The typing system is not clever enough to realize that clazz has a hidden attr after the hasattr check if not hasattr(clazz, "hidden") or not clazz.hidden: # type: ignore yield clazz - for return_value in class_subclasses(clazz): - yield return_value + yield from class_subclasses(clazz) def import_files(base_module, ignore_errors: bool = False) -> List[str]: @@ -159,9 +158,9 @@ def import_files(base_module, ignore_errors: bool = False) -> List[str]: def _filter_files(filename: str): """Ensures that a filename traversed is an importable python file""" - return ( - filename.endswith(".py") or filename.endswith(".pyc") - ) and not filename.startswith("__") + return (filename.endswith((".py", ".pyc"))) and not filename.startswith( + "__" + ) def import_file(module: str, path: str, ignore_errors: bool = False) -> List[str]: diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index a65b0d00b..49e990e93 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -54,8 +54,7 @@ class Lsmod(plugins.PluginInterface): table_name = modules.vol.type_name.split(constants.BANG)[0] - for module in modules.to_list(table_name + constants.BANG + "module", "list"): - yield module + yield from modules.to_list(table_name + constants.BANG + "module", "list") def _generator(self): try: diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 065f239a9..893eea71e 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -163,7 +163,9 @@ class Maps(plugins.PluginInterface): address_list = self.config.get("address", None) if not address_list: # do not filter as no address_list was supplied - vma_filter_func = lambda _: True + def vma_filter_func(_): + return True + else: # filter for any vm_start that matches the supplied address config def vma_filter_function(x: interfaces.objects.ObjectInterface) -> bool: diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index e5cf48d16..aee0b1e2e 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -372,7 +372,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): bt_sock = sock.cast("bt_sock") def bt_addr(addr): - return ":".join(reversed(["%02x" % x for x in addr.b])) + return ":".join(reversed([f"{x:02x}" for x in addr.b])) src_addr = src_port = dst_addr = dst_port = None bt_protocol = bt_sock.get_protocol() diff --git a/volatility3/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py index 4f64eaed8..e8218962d 100644 --- a/volatility3/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -93,10 +93,9 @@ class Check_sysctl(plugins.PluginInterface): val = self._parse_global_variable_sysctls(kernel, name) elif ctltype == "CTLTYPE_NODE": if sysctl.oid_handler == 0: - for info in self._process_sysctl_list( + yield from self._process_sysctl_list( kernel, sysctl.oid_arg1, recursive=1 - ): - yield info + ) val = "Node" diff --git a/volatility3/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py index 2a8692b77..41fde31ca 100644 --- a/volatility3/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -119,8 +119,7 @@ class Kevents(interfaces.plugins.PluginInterface): return None for klist in klist_array: - for kn in mac.MacUtilities.walk_slist(klist, "kn_link"): - yield kn + yield from mac.MacUtilities.walk_slist(klist, "kn_link") @classmethod def _get_task_kevents(cls, kernel, task): diff --git a/volatility3/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py index ff654e1a7..1a1e33571 100644 --- a/volatility3/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -49,8 +49,7 @@ class Mount(plugins.PluginInterface): list_head = kernel.object_from_symbol(symbol_name="mountlist") - for mount in mac.MacUtilities.walk_tailq(list_head, "mnt_list"): - yield mount + yield from mac.MacUtilities.walk_tailq(list_head, "mnt_list") def _generator(self): for mount in self.list_mounts(self.context, self.config["kernel"]): diff --git a/volatility3/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py index 5c002e472..bd905615d 100644 --- a/volatility3/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -152,7 +152,9 @@ class Maps(interfaces.plugins.PluginInterface): address_list = self.config.get("address", None) if not address_list: # do not filter as no address_list was supplied - vma_filter_func = lambda _: True + def vma_filter_func(_): + return True + else: # filter for any vm_start that matches the supplied address config def vma_filter_function(task: interfaces.objects.ObjectInterface) -> bool: diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index 9b570f3f9..74d044ba9 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -83,7 +83,9 @@ class PsList(interfaces.plugins.PluginInterface): @classmethod def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: - filter_func = lambda _: False + def filter_func(_): + return False + # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index ba729f898..4e483922b 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -204,8 +204,7 @@ class Timeliner(interfaces.plugins.PluginInterface): ) vollog.log(logging.DEBUG, traceback.format_exc()) - for data_item in sorted(data, key=self._sort_function): - yield data_item + yield from sorted(data, key=self._sort_function) # Write out a body file if necessary if self.config.get("create-bodyfile", True): diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index a3067b09f..62eceb973 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -227,8 +227,7 @@ class Handles(interfaces.plugins.PluginInterface): for entry in table: if level > 0: - for x in self._make_handle_array(entry, level - 1, depth): - yield x + yield from self._make_handle_array(entry, level - 1, depth) depth += 1 else: handle_multiplier = 4 @@ -264,8 +263,7 @@ class Handles(interfaces.plugins.PluginInterface): ) return None - for handle_table_entry in self._make_handle_array(TableCode, table_levels): - yield handle_table_entry + yield from self._make_handle_array(TableCode, table_levels) def _generator(self, procs): kernel = self.context.modules[self.config["kernel"]] diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 2e8dc1b0e..00424938f 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -248,8 +248,7 @@ class Modules(interfaces.plugins.PluginInterface): object_type=type_name, offset=list_entry.vol.offset - reloff, absolute=True ) - for mod in module.InLoadOrderLinks: - yield mod + yield from module.InLoadOrderLinks def run(self): return renderers.TreeGrid( diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index c774e23a3..a1521a8c6 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -488,14 +488,13 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """ # first, TCP endpoints by parsing the partition table - for endpoint in cls.parse_partitions( + yield from cls.parse_partitions( context, layer_name, net_symbol_table, tcpip_symbol_table, tcpip_module_offset, - ): - yield endpoint + ) # then, towards the UDP and TCP port pools # first, find their addresses diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 478cc8b1b..f262aeae6 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -126,15 +126,24 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Returns: Filter function for passing to the `list_processes` method """ - filter_func = lambda _: False + + def filter_func(_): + return False + # FIXME: mypy #4973 or #2608 pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] if filter_list: if exclude: - filter_func = lambda x: x.UniqueProcessId in filter_list + + def filter_func(x): + return x.UniqueProcessId in filter_list + else: - filter_func = lambda x: x.UniqueProcessId not in filter_list + + def filter_func(x): + return x.UniqueProcessId not in filter_list + return filter_func @classmethod @@ -173,20 +182,24 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Returns: Filter function for passing to the `list_processes` method """ - filter_func = lambda _: False + + def filter_func(_): + return False + # FIXME: mypy #4973 or #2608 name_list = name_list or [] filter_list = [x for x in name_list if x is not None] if filter_list: if exclude: - filter_func = ( - lambda x: utility.array_to_string(x.ImageFileName) in filter_list - ) + + def filter_func(x): + return utility.array_to_string(x.ImageFileName) in filter_list + else: - filter_func = ( - lambda x: utility.array_to_string(x.ImageFileName) - not in filter_list - ) + + def filter_func(x): + return utility.array_to_string(x.ImageFileName) not in filter_list + return filter_func @classmethod diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 5ce470cd8..86eb47300 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -102,29 +102,38 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Returns: Filter function to be passed to the list of processes. """ - filter_func = lambda _: False + + def filter_func(_): + return False if offset: if physical: if exclude: - filter_func = ( - lambda proc: cls.physical_offset_from_virtual( - context, layer_name, proc + + def filter_func(proc): + return ( + cls.physical_offset_from_virtual(context, layer_name, proc) + == offset ) - == offset - ) + else: - filter_func = ( - lambda proc: cls.physical_offset_from_virtual( - context, layer_name, proc + + def filter_func(proc): + return ( + cls.physical_offset_from_virtual(context, layer_name, proc) + != offset ) - != offset - ) + else: if exclude: - filter_func = lambda proc: proc.vol.offset == offset + + def filter_func(proc): + return proc.vol.offset == offset + else: - filter_func = lambda proc: proc.vol.offset != offset + + def filter_func(proc): + return proc.vol.offset != offset return filter_func diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 6afaf4356..3cf6d60d8 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -285,10 +285,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf if not shim_head: return - for shim_entry in shim_head.ListEntry.to_list( + yield from shim_head.ListEntry.to_list( shimcache_symbol_table + constants.BANG + "SHIM_CACHE_ENTRY", "ListEntry" - ): - yield shim_entry + ) @classmethod def try_get_shim_head_at_offset( @@ -333,7 +332,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf eresource_rel_off = ersrc_size + ((offset - ersrc_size) % ersrc_alignment) eresource_offset = offset - eresource_rel_off - vollog.debug("Constructing ERESOURCE at %s" % hex(eresource_offset)) + vollog.debug(f"Constructing ERESOURCE at {hex(eresource_offset)}") eresource = context.object( kernel_symbol_table + constants.BANG + "_ERESOURCE", layer_name, diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index 7c26a09bd..ea73247ce 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -103,11 +103,10 @@ class SvcList(svcscan.SvcScan): scanner=scanners.BytesScanner(needle=b"Sc27"), sections=exe_range, ): - for record in cls.enumerate_vista_or_later_header( + yield from cls.enumerate_vista_or_later_header( context, service_table_name, service_binary_dll_map, layer_name, offset, - ): - yield record + ) diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index a34818fc1..84daa8595 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -82,5 +82,4 @@ class Threads(thrdscan.ThrdScan): symbol_table=symbol_table_name, filter_func=filter_func, ): - for thread in cls.list_threads(module, proc): - yield thread + yield from cls.list_threads(module, proc) diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index 01e575818..077fe33cb 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -116,8 +116,7 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt ) unloadedmodules_array.UnloadedDrivers.count = unloaded_count - for mod in unloadedmodules_array.UnloadedDrivers: - yield mod + yield from unloadedmodules_array.UnloadedDrivers def _generator(self): kernel = self.context.modules[self.config["kernel"]] diff --git a/volatility3/framework/plugins/windows/virtmap.py b/volatility3/framework/plugins/windows/virtmap.py index 3f3f270e2..e02cca89e 100644 --- a/volatility3/framework/plugins/windows/virtmap.py +++ b/volatility3/framework/plugins/windows/virtmap.py @@ -138,8 +138,7 @@ class VirtMap(interfaces.plugins.PluginInterface): mapping = cls.determine_map(module) for entry in mapping: if "Unused" not in entry: - for value in mapping[entry]: - yield value + yield from mapping[entry] def run(self): kernel = self.context.modules[self.config["kernel"]] diff --git a/volatility3/framework/renderers/format_hints.py b/volatility3/framework/renderers/format_hints.py index 194e38099..d57c7e9f1 100644 --- a/volatility3/framework/renderers/format_hints.py +++ b/volatility3/framework/renderers/format_hints.py @@ -70,15 +70,21 @@ class MultiTypeData(bytes): ) -BinOrAbsent = lambda x: ( - Bin(x) if not isinstance(x, interfaces.renderers.BaseAbsentValue) else x -) -HexOrAbsent = lambda x: ( - Hex(x) if not isinstance(x, interfaces.renderers.BaseAbsentValue) else x -) -HexBytesOrAbsent = lambda x: ( - HexBytes(x) if not isinstance(x, interfaces.renderers.BaseAbsentValue) else x -) -MultiTypeDataOrAbsent = lambda x: ( - MultiTypeData(x) if not isinstance(x, interfaces.renderers.BaseAbsentValue) else x -) +def BinOrAbsent(x): + return Bin(x) if not isinstance(x, interfaces.renderers.BaseAbsentValue) else x + + +def HexOrAbsent(x): + return Hex(x) if not isinstance(x, interfaces.renderers.BaseAbsentValue) else x + + +def HexBytesOrAbsent(x): + return HexBytes(x) if not isinstance(x, interfaces.renderers.BaseAbsentValue) else x + + +def MultiTypeDataOrAbsent(x): + return ( + MultiTypeData(x) + if not isinstance(x, interfaces.renderers.BaseAbsentValue) + else x + ) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 537b729ad..0230a9c48 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -629,8 +629,7 @@ class IDStorage(ABC): if self.is_valid_node(nodep): yield nodep else: - for child_node in self._iter_node(nodep, height - 1): - yield child_node + yield from self._iter_node(nodep, height - 1) def get_entries(self, root: interfaces.objects.ObjectInterface) -> Iterator[int]: """Walks the tree data structure @@ -659,8 +658,7 @@ class IDStorage(ABC): if self.is_valid_node(nodep): yield nodep else: - for child_node in self._iter_node(nodep, height): - yield child_node + yield from self._iter_node(nodep, height) class XArray(IDStorage): diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index e9fd09eaa..61b7b8f73 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -200,8 +200,7 @@ class module(generic.GenericIntelProcess): count=num_sects, ) - for attr in arr: - yield attr + yield from arr def get_elf_table_name(self): elf_table_name = intermed.IntermediateSymbolTable.create( @@ -237,8 +236,7 @@ class module(generic.GenericIntelProcess): count=self.num_symtab + 1, ) if self.section_strtab: - for sym in syms: - yield sym + yield from syms def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module @@ -2665,8 +2663,7 @@ class IDR(objects.StructType): id_storage = linux.IDStorage.choose_id_storage( self._context, kernel_module_name="kernel" ) - for page_addr in id_storage.get_entries(root=self.idr_rt): - yield page_addr + yield from id_storage.get_entries(root=self.idr_rt) def get_entries(self) -> Iterable[int]: """Walks the IDR and yield a pointer associated with each element. @@ -2684,8 +2681,7 @@ class IDR(objects.StructType): # Kernels < 4.11 get_entries_func = self._old_kernel_get_entries - for page_addr in get_entries_func(): - yield page_addr + yield from get_entries_func() class rb_root(objects.StructType): diff --git a/volatility3/framework/symbols/mac/__init__.py b/volatility3/framework/symbols/mac/__init__.py index c695ca77a..ee6dd10a3 100644 --- a/volatility3/framework/symbols/mac/__init__.py +++ b/volatility3/framework/symbols/mac/__init__.py @@ -232,10 +232,9 @@ class MacUtilities(interfaces.configuration.VersionableInterface): next_member: str, max_elements: int = 4096, ) -> Iterable[interfaces.objects.ObjectInterface]: - for element in cls._walk_iterable( + yield from cls._walk_iterable( queue, "tqh_first", "tqe_next", next_member, max_elements - ): - yield element + ) @classmethod def walk_list_head( @@ -244,10 +243,9 @@ class MacUtilities(interfaces.configuration.VersionableInterface): next_member: str, max_elements: int = 4096, ) -> Iterable[interfaces.objects.ObjectInterface]: - for element in cls._walk_iterable( + yield from cls._walk_iterable( queue, "lh_first", "le_next", next_member, max_elements - ): - yield element + ) @classmethod def walk_slist( @@ -256,7 +254,6 @@ class MacUtilities(interfaces.configuration.VersionableInterface): next_member: str, max_elements: int = 4096, ) -> Iterable[interfaces.objects.ObjectInterface]: - for element in cls._walk_iterable( + yield from cls._walk_iterable( queue, "slh_first", "sle_next", next_member, max_elements - ): - yield element + ) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 07ab5f5a8..d40df6bd6 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -749,11 +749,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): try: peb = self.get_peb() - for entry in peb.Ldr.InLoadOrderModuleList.to_list( + yield from peb.Ldr.InLoadOrderModuleList.to_list( f"{self.get_symbol_table_name()}{constants.BANG}_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks", - ): - yield entry + ) except exceptions.InvalidAddressException: return None @@ -762,11 +761,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): try: peb = self.get_peb() - for entry in peb.Ldr.InInitializationOrderModuleList.to_list( + yield from peb.Ldr.InInitializationOrderModuleList.to_list( f"{self.get_symbol_table_name()}{constants.BANG}_LDR_DATA_TABLE_ENTRY", "InInitializationOrderLinks", - ): - yield entry + ) except exceptions.InvalidAddressException: return None @@ -775,11 +773,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): try: peb = self.get_peb() - for entry in peb.Ldr.InMemoryOrderModuleList.to_list( + yield from peb.Ldr.InMemoryOrderModuleList.to_list( f"{self.get_symbol_table_name()}{constants.BANG}_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks", - ): - yield entry + ) except exceptions.InvalidAddressException: return None diff --git a/volatility3/framework/symbols/windows/extensions/consoles.py b/volatility3/framework/symbols/windows/extensions/consoles.py index cf6f43a9b..9666fd79c 100644 --- a/volatility3/framework/symbols/windows/extensions/consoles.py +++ b/volatility3/framework/symbols/windows/extensions/consoles.py @@ -107,11 +107,10 @@ class EXE_ALIAS_LIST(objects.StructType): def get_aliases(self) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Generator for the individual aliases for a particular executable.""" - for alias in self.AliasList.to_list( + yield from self.AliasList.to_list( f"{self.get_symbol_table_name()}{constants.BANG}_ALIAS", "ListEntry", - ): - yield alias + ) class SCREEN_INFORMATION(objects.StructType): @@ -245,11 +244,10 @@ class CONSOLE_INFORMATION(objects.StructType): def get_histories( self, ) -> Generator[interfaces.objects.ObjectInterface, None, None]: - for cmd_hist in self.HistoryList.to_list( + yield from self.HistoryList.to_list( f"{self.get_symbol_table_name()}{constants.BANG}_COMMAND_HISTORY", "ListEntry", - ): - yield cmd_hist + ) def get_exe_aliases( self, @@ -258,20 +256,18 @@ class CONSOLE_INFORMATION(objects.StructType): # Windows 10 22000 and Server 20348 made this a Pointer if isinstance(exe_alias_list, objects.Pointer): exe_alias_list = exe_alias_list.dereference() - for exe_alias_list_item in exe_alias_list.to_list( + yield from exe_alias_list.to_list( f"{self.get_symbol_table_name()}{constants.BANG}_EXE_ALIAS_LIST", "ListEntry", - ): - yield exe_alias_list_item + ) def get_processes( self, ) -> Generator[interfaces.objects.ObjectInterface, None, None]: - for proc in self.ConsoleProcessList.to_list( + yield from self.ConsoleProcessList.to_list( f"{self.get_symbol_table_name()}{constants.BANG}_CONSOLE_PROCESS_LIST", "ListEntry", - ): - yield proc + ) def get_title(self) -> Union[str, None]: try: @@ -393,8 +389,7 @@ class COMMAND_HISTORY(objects.StructType): rest are coalesced. """ - for i, cmd in self.scan_command_bucket(self.CommandBucket.End): - yield i, cmd + yield from self.scan_command_bucket(self.CommandBucket.End) win10_x64_class_types = { diff --git a/volatility3/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py index 4feb396e7..ea2884bb2 100644 --- a/volatility3/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -128,7 +128,10 @@ class PdbReader: self._layer_name, self._context = self.load_pdb_layer(context, location) self._dbiheader: Optional[interfaces.objects.ObjectInterface] = None if not progress_callback: - progress_callback = lambda x, y: None + + def progress_callback(x, y): + return None + self._progress_callback = progress_callback self.types: List[ Tuple[ From e708a62eefa6bc48823050850959e689f67abd9e Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 17:28:43 +0100 Subject: [PATCH 0187/1352] make ruff happy --- development/mac-kdk/parse_pbzx2.py | 7 ++-- development/pdbparse-to-json.py | 6 ++-- development/schema_validate.py | 4 +-- doc/source/conf.py | 12 +++---- volatility3/cli/__init__.py | 2 +- volatility3/framework/__init__.py | 16 ++++----- .../framework/configuration/__init__.py | 2 ++ volatility3/framework/constants/__init__.py | 35 ++++++++++++++++++- volatility3/framework/interfaces/__init__.py | 11 ++++++ volatility3/framework/layers/resources.py | 2 +- .../framework/layers/scanners/__init__.py | 3 ++ volatility3/framework/objects/__init__.py | 12 +++---- volatility3/framework/plugins/isfinfo.py | 9 ++--- volatility3/framework/plugins/linux/kmsg.py | 4 +-- .../framework/plugins/mac/check_sysctl.py | 2 +- .../framework/plugins/mac/kauth_scopes.py | 2 +- .../framework/plugins/windows/netscan.py | 2 +- .../framework/plugins/windows/psxview.py | 2 +- .../framework/plugins/windows/shimcachemem.py | 2 +- volatility3/framework/renderers/__init__.py | 4 +-- .../symbols/mac/extensions/__init__.py | 2 +- 21 files changed, 93 insertions(+), 48 deletions(-) diff --git a/development/mac-kdk/parse_pbzx2.py b/development/mac-kdk/parse_pbzx2.py index 173a4d648..1ca212211 100644 --- a/development/mac-kdk/parse_pbzx2.py +++ b/development/mac-kdk/parse_pbzx2.py @@ -7,6 +7,7 @@ # Cleaned up C version (as the basis for my code) here, thanks to Pepijn Bruienne / @bruienne # https://gist.github.com/bruienne/029494bbcfb358098b41 +import os import struct import sys @@ -22,7 +23,7 @@ def seekread(f, offset = None, length = 0, relative = True): def parse_pbzx(pbzx_path): section = 0 - xar_out_path = '%s.part%02d.cpio.xz' % (pbzx_path, section) + xar_out_path = f'{pbzx_path}.part{section:02d}.cpio.xz' with open(pbzx_path, 'rb') as f: # pbzx = f.read() # f.close() @@ -50,12 +51,12 @@ def parse_pbzx(pbzx_path): # ... and split it out ... f_content = seekread(f, length = f_length) section += 1 - decomp_out = '%s.part%02d.cpio' % (pbzx_path, section) + decomp_out = f'{pbzx_path}.part{section:02d}.cpio' with open(decomp_out, 'wb') as g: g.write(f_content) # Now to start the next section, which should hopefully be .xz (we'll just assume it is ...) section += 1 - xar_out_path = '%s.part%02d.cpio.xz' % (pbzx_path, section) + xar_out_path = f'{pbzx_path}.part{section:02d}.cpio.xz' else: f_length -= 6 # This part needs buffering diff --git a/development/pdbparse-to-json.py b/development/pdbparse-to-json.py index 6eb265227..6ffa4ea49 100644 --- a/development/pdbparse-to-json.py +++ b/development/pdbparse-to-json.py @@ -32,12 +32,12 @@ class PDBRetreiver: result = None for suffix in [file_name[:-1] + '_', file_name]: try: - logger.debug(f"Attempting to retrieve {url + suffix}") + logger.debug("Attempting to retrieve %s", url + suffix) result, _ = request.urlretrieve(url + suffix) except request.HTTPError as excp: - logger.debug(f"Failed with {excp}") + logger.debug("Failed with %s", excp) if result: - logger.debug(f"Successfully written to {result}") + logger.debug("Successfully written to %s", result) break return result diff --git a/development/schema_validate.py b/development/schema_validate.py index 031039e38..f44b3267e 100644 --- a/development/schema_validate.py +++ b/development/schema_validate.py @@ -6,7 +6,7 @@ import sys # TODO: Rather nasty hack, when volatility's actually installed this would be unnecessary sys.path += ".." -import logging +import logging # noqa: E402 console = logging.StreamHandler() console.setLevel(logging.DEBUG) @@ -17,7 +17,7 @@ logger = logging.getLogger("") logger.addHandler(console) logger.setLevel(logging.DEBUG) -from volatility3 import schemas +from volatility3 import schemas # noqa: E402 if __name__ == '__main__': parser = argparse.ArgumentParser("Validates ") diff --git a/doc/source/conf.py b/doc/source/conf.py index cabfdc327..7a9a72891 100644 --- a/doc/source/conf.py +++ b/doc/source/conf.py @@ -19,6 +19,8 @@ import sys import sphinx.ext.apidoc +from importlib.util import find_spec + def setup(app): volatility_directory = os.path.abspath( @@ -124,7 +126,7 @@ def setup(app): # documentation root, use os.path.abspath to make it absolute, like shown here. sys.path.insert(0, os.path.abspath("../..")) -from volatility3.framework import constants +from volatility3.framework import constants # noqa: E402 # -- General configuration ------------------------------------------------ @@ -147,13 +149,9 @@ extensions = [ autosectionlabel_prefix_document = True -try: - import sphinx_autodoc_typehints - +if find_spec("sphinx_autodoc_typehints") is not None: extensions.append("sphinx_autodoc_typehints") -except ImportError: - # If the autodoc typehints extension isn't available, carry on regardless - pass +# If the autodoc typehints extension isn't available, carry on regardless # Add any paths that contain templates here, relative to this directory. # templates_path = ['tools/templates'] diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index cf1335443..da046de57 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -879,7 +879,7 @@ class CommandLine: volatility3.framework.configuration.requirements.ListRequirement, ): # Allow a list of integers, specified with the convenient 0x hexadecimal format - if requirement.element_type == int: + if requirement.element_type is int: additional["type"] = lambda x: int(x, 0) else: additional["type"] = requirement.element_type diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 244b353a2..bf7d3ab74 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -22,14 +22,14 @@ if ( ) ) -import importlib -import inspect -import logging -import os -import traceback -from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar +import importlib # noqa: E402 +import inspect # noqa: E402 +import logging # noqa: E402 +import os # noqa: E402 +import traceback # noqa: E402 +from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar # noqa: E402 -from volatility3.framework import constants, interfaces +from volatility3.framework import constants, interfaces # noqa: E402 # ## @@ -74,7 +74,7 @@ class NonInheritable: self.cls = cls def __get__(self, obj: Any, get_type: Type = None) -> Any: - if type == self.cls: + if type is self.cls: if hasattr(self.default_value, "__get__"): return self.default_value.__get__(obj, get_type) return self.default_value diff --git a/volatility3/framework/configuration/__init__.py b/volatility3/framework/configuration/__init__.py index 7a84ee455..6ca8b4ee3 100644 --- a/volatility3/framework/configuration/__init__.py +++ b/volatility3/framework/configuration/__init__.py @@ -3,3 +3,5 @@ # from volatility3.framework.configuration import requirements + +__all__ = ["requirements"] diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 8bdf84730..427d666e0 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -14,7 +14,7 @@ import warnings from typing import Callable, Optional import volatility3.framework.constants.linux -import volatility3.framework.constants.windows +import volatility3.framework.constants.windows # noqa: F401 from volatility3.framework.constants._version import ( PACKAGE_VERSION, VERSION_MAJOR, @@ -141,3 +141,36 @@ def __getattr__(name): return globals()[f"{deprecated_tag}{name}"] return getattr(__import__(__name__), name) + + +__all__ = [ + "PACKAGE_VERSION", + "VERSION_MAJOR", + "VERSION_MINOR", + "VERSION_PATCH", + "VERSION_SUFFIX", + "PLUGINS_PATH", + "SYMBOL_BASEPATHS", + "ISF_EXTENSIONS", + "BANG", + "AUTOMAGIC_CONFIG_PATH", + "LOGLEVEL_INFO", + "LOGLEVEL_DEBUG", + "LOGLEVEL_V", + "LOGLEVEL_VV", + "LOGLEVEL_VVV", + "LOGLEVEL_VVVV", + "CACHE_PATH", + "SQLITE_CACHE_PERIOD", + "IDENTIFIERS_FILENAME", + "CACHE_SQLITE_SCHEMA_VERSION", + "BUG_URL", + "ProgressCallback", + "OS_CATEGORIES", + "Parallelism", + "PARALLELISM", + "ISF_MINIMUM_SUPPORTED", + "ISF_MINIMUM_DEPRECATED", + "OFFLINE", + "REMOTE_ISF_URL", +] diff --git a/volatility3/framework/interfaces/__init__.py b/volatility3/framework/interfaces/__init__.py index 51d81d63a..19d11e2f4 100644 --- a/volatility3/framework/interfaces/__init__.py +++ b/volatility3/framework/interfaces/__init__.py @@ -22,3 +22,14 @@ from volatility3.framework.interfaces import ( symbols, automagic, ) + +__all__ = [ + "renderers", + "configuration", + "context", + "layers", + "objects", + "plugins", + "symbols", + "automagic", +] diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index c7a7fee67..6b17db5ff 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -29,7 +29,7 @@ except ImportError: try: # Import so that the handler is found by the framework.class_subclasses callc - import smb.SMBHandler # lgtm [py/unused-import] + import smb.SMBHandler # lgtm [py/unused-import] # noqa: F401 except ImportError: # If we fail to import this, it means that SMB handling won't be available pass diff --git a/volatility3/framework/layers/scanners/__init__.py b/volatility3/framework/layers/scanners/__init__.py index dd8dc46be..a36236a11 100644 --- a/volatility3/framework/layers/scanners/__init__.py +++ b/volatility3/framework/layers/scanners/__init__.py @@ -136,3 +136,6 @@ class MultiStringScanner(layers.ScannerInterface): ) for match in re.finditer(self._regex, haystack): yield match.start(0), match.group() + + +__all__ = ["multiregexp", "BytesScanner", "RegExScanner", "MultiStringScanner"] diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index b65277067..5846da070 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -35,13 +35,13 @@ def convert_data_to_value( data_format: DataFormatInfo, ) -> TUnion[int, float, bytes, str, bool]: """Converts a series of bytes to a particular type of value.""" - if struct_type == int: + if struct_type is int: return int.from_bytes( data, byteorder=data_format.byteorder, signed=data_format.signed ) - if struct_type == bool: + if struct_type is bool: struct_format = "?" - elif struct_type == float: + elif struct_type is float: float_vals = "zzezfzzzd" if ( data_format.length > len(float_vals) @@ -70,7 +70,7 @@ def convert_value_to_data( f"Written value is not of the correct type for {struct_type.__name__}" ) - if struct_type == int and isinstance(value, int): + if struct_type is int and isinstance(value, int): # Doubling up on the isinstance is for mypy return int.to_bytes( value, @@ -78,9 +78,9 @@ def convert_value_to_data( byteorder=data_format.byteorder, signed=data_format.signed, ) - if struct_type == bool: + if struct_type is bool: struct_format = "?" - elif struct_type == float: + elif struct_type is float: float_vals = "zzezfzzzd" if ( data_format.length > len(float_vals) diff --git a/volatility3/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py index 4f07bd5a8..78e78fb9e 100644 --- a/volatility3/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -7,6 +7,7 @@ import os import pathlib import zipfile from typing import Generator, List +from importlib.util import find_spec from volatility3 import schemas, symbols from volatility3.framework import constants, interfaces, renderers @@ -96,16 +97,12 @@ class IsfInfo(plugins.PluginInterface): if filter_item in isf_file: filtered_list.append(isf_file) - try: - import jsonschema - - if not self.config["validate"]: - raise ImportError # Act as if we couldn't import if validation is turned off + if find_spec("jsonschema") and self.config["validate"]: def check_valid(data): return "True" if schemas.validate(data, True) else "False" - except ImportError: + else: def check_valid(data): return "Unknown" diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index e26d69543..d66e3b9ca 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -149,7 +149,7 @@ class ABCKmsg(ABC): # This might seem insignificant but it could cause some issues # when compared with userland tool results or when used in # timelines. - return "%lu.%06lu" % (nsec / 1000000000, (nsec % 1000000000) / 1000) + return f"{nsec / 1000000000:lu}.{(nsec % 1000000000) / 1000:06lu}" def get_timestamp_in_sec_str(self, obj) -> str: # obj could be log, printk_log or printk_info @@ -166,7 +166,7 @@ class ABCKmsg(ABC): def get_caller_text(self, caller_id): caller_name = "CPU" if caller_id & 0x80000000 else "Task" - caller = "%s(%u)" % (caller_name, caller_id & ~0x80000000) + caller = f"{caller_name}({caller_id & ~0x80000000:u})" return caller def get_prefix(self, obj) -> Tuple[int, int, str, str]: diff --git a/volatility3/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py index e8218962d..ed3e34aea 100644 --- a/volatility3/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -60,7 +60,7 @@ class Check_sysctl(plugins.PluginInterface): return var_str def _process_sysctl_list(self, kernel, sysctl_list, recursive=0): - if type(sysctl_list) == volatility3.framework.objects.Pointer: + if type(sysctl_list) is volatility3.framework.objects.Pointer: sysctl_list = sysctl_list.dereference().cast("sysctl_oid_list") sysctl = sysctl_list.slh_first diff --git a/volatility3/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py index afb320a07..c2c473eac 100644 --- a/volatility3/framework/plugins/mac/kauth_scopes.py +++ b/volatility3/framework/plugins/mac/kauth_scopes.py @@ -80,7 +80,7 @@ class Kauth_scopes(interfaces.plugins.PluginInterface): ( identifier, format_hints.Hex(scope.ks_idata), - len([l for l in scope.get_listeners()]), + len([listener for listener in scope.get_listeners()]), format_hints.Hex(callback), module_name, symbol_name, diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index 77bd22ab9..dd8e4b133 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -161,7 +161,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): raise NotImplementedError( "Kernel Debug Structure version format not supported!" ) - except: + except: # noqa: E722 # unsure what to raise here. Also, it might be useful to add some kind of fallback, # either to a user-provided version or to another method to determine tcpip.sys's version raise exceptions.VolatilityException( diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 053ec20d5..e3ec216dd 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -218,7 +218,7 @@ class PsXView(plugins.PluginInterface): name = self._proc_name_to_string(proc) exit_time = proc.get_exit_time() - if type(exit_time) != datetime.datetime: + if type(exit_time) is not datetime.datetime: exit_time = "" else: exit_time = str(exit_time) diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 3cf6d60d8..59f33510d 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -146,7 +146,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf context, layer_name, kernel_symbol_table ): pid = process.UniqueProcessId - vollog.debug("checking process %d" % pid) + vollog.debug("checking process %d", pid) for vad in vadinfo.VadInfo.list_vads( process, lambda x: x.get_tag() == b"Vad " and x.Protection == 4 ): diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index 02805acc2..39ce1135d 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -430,10 +430,10 @@ class ColumnSortKey(interfaces.renderers.ColumnSortKey): value = datetime.datetime.min elif self._type in [int, float]: value = -1 - elif self._type == bool: + elif self._type is bool: value = False elif self._type in [str, renderers.Disassembly]: value = "-" - elif self._type == bytes: + elif self._type is bytes: value = b"" return value diff --git a/volatility3/framework/symbols/mac/extensions/__init__.py b/volatility3/framework/symbols/mac/extensions/__init__.py index 15fe7aeda..d2573fb95 100644 --- a/volatility3/framework/symbols/mac/extensions/__init__.py +++ b/volatility3/framework/symbols/mac/extensions/__init__.py @@ -237,7 +237,7 @@ class vm_map_entry(objects.StructType): def get_path(self, context, config_prefix): node = self.get_vnode(context, config_prefix) - if type(node) == str and node == "sub_map": + if type(node) is str and node == "sub_map": ret = node elif node: path = [] From 75a324ddba73462d13362ab3f0f5bbdfeb0a3d33 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 18:04:22 +0100 Subject: [PATCH 0188/1352] chore(developement/schema_validate): move logging import up --- development/schema_validate.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/development/schema_validate.py b/development/schema_validate.py index f44b3267e..0ea82d537 100644 --- a/development/schema_validate.py +++ b/development/schema_validate.py @@ -1,13 +1,12 @@ import argparse import json +import logging import os import sys # TODO: Rather nasty hack, when volatility's actually installed this would be unnecessary sys.path += ".." -import logging # noqa: E402 - console = logging.StreamHandler() console.setLevel(logging.DEBUG) formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s') From 2e093c1a53520c12c209d49cb108b654a2cc2290 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 18:08:22 +0100 Subject: [PATCH 0189/1352] chore(framework/automagic/linux): convert lambda to function --- volatility3/framework/automagic/linux.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 6b58577a3..93131a120 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -196,5 +196,8 @@ class LinuxSymbolFinder(symbol_finder.SymbolFinder): banner_config_key = "kernel_banner" operating_system = "linux" symbol_class = "volatility3.framework.symbols.linux.LinuxKernelIntermedSymbols" - find_aslr = lambda cls, *args: LinuxIntelStacker.find_aslr(*args)[1] exclusion_list = ["mac", "windows"] + + @classmethod + def find_aslr(cls, *args): + return LinuxIntelStacker.find_aslr(*args)[1] From c33e378c847b3cddcf3730f8b6ea5fc5efa8384e Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 18:18:54 +0100 Subject: [PATCH 0190/1352] chore(framework/__init__): move up imports --- volatility3/framework/__init__.py | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index bf7d3ab74..364e6f5ec 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -6,6 +6,14 @@ import glob import sys import zipfile +import importlib +import inspect +import logging +import os +import traceback +from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar + +from volatility3.framework import constants, interfaces required_python_version = (3, 8, 0) if ( @@ -22,15 +30,6 @@ if ( ) ) -import importlib # noqa: E402 -import inspect # noqa: E402 -import logging # noqa: E402 -import os # noqa: E402 -import traceback # noqa: E402 -from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar # noqa: E402 - -from volatility3.framework import constants, interfaces # noqa: E402 - # ## # From 2119b8c7b820e3fde75f9f4871cb7504ef0b5473 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 18:37:46 +0100 Subject: [PATCH 0191/1352] fix framework/__init__ --- volatility3/framework/__init__.py | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 364e6f5ec..df8d2d2b8 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -5,15 +5,6 @@ # Check the python version to ensure it's suitable import glob import sys -import zipfile -import importlib -import inspect -import logging -import os -import traceback -from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar - -from volatility3.framework import constants, interfaces required_python_version = (3, 8, 0) if ( @@ -25,10 +16,18 @@ if ( ) ): raise RuntimeError( - "Volatility framework requires python version {}.{}.{} or greater".format( - *required_python_version - ) + f"Volatility framework requires python version {'.'.join(map(str, required_python_version))} or greater" ) +else: + import zipfile + import importlib + import inspect + import logging + import os + import traceback + from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar + + from volatility3.framework import constants, interfaces # ## From ccd3e8f367df22d60eb5be300a0c8a830b8db59a Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 18:43:27 +0100 Subject: [PATCH 0192/1352] move python version check into its own module --- volatility3/framework/__init__.py | 31 ++++++------------- volatility3/framework/check_python_version.py | 14 +++++++++ 2 files changed, 23 insertions(+), 22 deletions(-) create mode 100644 volatility3/framework/check_python_version.py diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index df8d2d2b8..bf71c3c99 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -5,29 +5,16 @@ # Check the python version to ensure it's suitable import glob import sys +import volatility3.framework.check_python_version # noqa: F401 +import zipfile +import importlib +import inspect +import logging +import os +import traceback +from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar -required_python_version = (3, 8, 0) -if ( - sys.version_info.major != required_python_version[0] - or sys.version_info.minor < required_python_version[1] - or ( - sys.version_info.minor == required_python_version[1] - and sys.version_info.micro < required_python_version[2] - ) -): - raise RuntimeError( - f"Volatility framework requires python version {'.'.join(map(str, required_python_version))} or greater" - ) -else: - import zipfile - import importlib - import inspect - import logging - import os - import traceback - from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar - - from volatility3.framework import constants, interfaces +from volatility3.framework import constants, interfaces # ## diff --git a/volatility3/framework/check_python_version.py b/volatility3/framework/check_python_version.py new file mode 100644 index 000000000..f2d284f2a --- /dev/null +++ b/volatility3/framework/check_python_version.py @@ -0,0 +1,14 @@ +import sys + +required_python_version = (3, 8, 0) +if ( + sys.version_info.major != required_python_version[0] + or sys.version_info.minor < required_python_version[1] + or ( + sys.version_info.minor == required_python_version[1] + and sys.version_info.micro < required_python_version[2] + ) +): + raise RuntimeError( + f"Volatility framework requires python version {required_python_version[0]}.{required_python_version[1]}.{required_python_version[2]} or greater" + ) From 53133f4478bab042d96c468d5fd14c95f96b9913 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 21:27:38 +0100 Subject: [PATCH 0193/1352] fix codeQL error --- volatility3/framework/plugins/windows/modules.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 00424938f..3c0f5ab7c 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -104,12 +104,11 @@ class Modules(interfaces.plugins.PluginInterface): try: BaseDllName = mod.BaseDllName.get_string() + if self.config["name"] and self.config["name"] not in BaseDllName: + continue except exceptions.InvalidAddressException: BaseDllName = interfaces.renderers.BaseAbsentValue() - if self.config["name"] and self.config["name"] not in BaseDllName: - continue - try: FullDllName = mod.FullDllName.get_string() except exceptions.InvalidAddressException: From 1c0d0b086adba32763668f2b06dd1b659163d350 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Fri, 22 Nov 2024 23:07:42 +0100 Subject: [PATCH 0194/1352] use redundant import aliases instead of __all__ and noqa's --- volatility3/framework/__init__.py | 2 +- .../framework/configuration/__init__.py | 4 +- volatility3/framework/constants/__init__.py | 47 +++---------------- volatility3/framework/interfaces/__init__.py | 27 ++++------- .../framework/layers/scanners/__init__.py | 5 +- 5 files changed, 18 insertions(+), 67 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index bf71c3c99..b60ae5576 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -5,7 +5,7 @@ # Check the python version to ensure it's suitable import glob import sys -import volatility3.framework.check_python_version # noqa: F401 +from volatility3.framework import check_python_version as check_python_version import zipfile import importlib import inspect diff --git a/volatility3/framework/configuration/__init__.py b/volatility3/framework/configuration/__init__.py index 6ca8b4ee3..7b914cf16 100644 --- a/volatility3/framework/configuration/__init__.py +++ b/volatility3/framework/configuration/__init__.py @@ -2,6 +2,4 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from volatility3.framework.configuration import requirements - -__all__ = ["requirements"] +from volatility3.framework.configuration import requirements as requirements diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 427d666e0..23cc2dde5 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -13,14 +13,14 @@ import sys import warnings from typing import Callable, Optional -import volatility3.framework.constants.linux -import volatility3.framework.constants.windows # noqa: F401 +from volatility3.framework.constants import linux as linux +from volatility3.framework.constants import windows as windows from volatility3.framework.constants._version import ( - PACKAGE_VERSION, - VERSION_MAJOR, - VERSION_MINOR, - VERSION_PATCH, - VERSION_SUFFIX, + PACKAGE_VERSION as PACKAGE_VERSION, + VERSION_MAJOR as VERSION_MAJOR, + VERSION_MINOR as VERSION_MINOR, + VERSION_PATCH as VERSION_PATCH, + VERSION_SUFFIX as VERSION_SUFFIX, ) PLUGINS_PATH = [ @@ -141,36 +141,3 @@ def __getattr__(name): return globals()[f"{deprecated_tag}{name}"] return getattr(__import__(__name__), name) - - -__all__ = [ - "PACKAGE_VERSION", - "VERSION_MAJOR", - "VERSION_MINOR", - "VERSION_PATCH", - "VERSION_SUFFIX", - "PLUGINS_PATH", - "SYMBOL_BASEPATHS", - "ISF_EXTENSIONS", - "BANG", - "AUTOMAGIC_CONFIG_PATH", - "LOGLEVEL_INFO", - "LOGLEVEL_DEBUG", - "LOGLEVEL_V", - "LOGLEVEL_VV", - "LOGLEVEL_VVV", - "LOGLEVEL_VVVV", - "CACHE_PATH", - "SQLITE_CACHE_PERIOD", - "IDENTIFIERS_FILENAME", - "CACHE_SQLITE_SCHEMA_VERSION", - "BUG_URL", - "ProgressCallback", - "OS_CATEGORIES", - "Parallelism", - "PARALLELISM", - "ISF_MINIMUM_SUPPORTED", - "ISF_MINIMUM_DEPRECATED", - "OFFLINE", - "REMOTE_ISF_URL", -] diff --git a/volatility3/framework/interfaces/__init__.py b/volatility3/framework/interfaces/__init__.py index 19d11e2f4..fd6b1e062 100644 --- a/volatility3/framework/interfaces/__init__.py +++ b/volatility3/framework/interfaces/__init__.py @@ -13,23 +13,12 @@ components of volatility to write plugins. # This will also avoid namespace issues, because people can use interfaces.layers to # avoid clashing with the layers package from volatility3.framework.interfaces import ( - renderers, - configuration, - context, - layers, - objects, - plugins, - symbols, - automagic, + renderers as renderers, + configuration as configuration, + context as context, + layers as layers, + objects as objects, + plugins as plugins, + symbols as symbols, + automagic as automagic, ) - -__all__ = [ - "renderers", - "configuration", - "context", - "layers", - "objects", - "plugins", - "symbols", - "automagic", -] diff --git a/volatility3/framework/layers/scanners/__init__.py b/volatility3/framework/layers/scanners/__init__.py index a36236a11..f54b44ff4 100644 --- a/volatility3/framework/layers/scanners/__init__.py +++ b/volatility3/framework/layers/scanners/__init__.py @@ -5,7 +5,7 @@ import re from typing import Generator, List, Tuple, Dict, Optional from volatility3.framework.interfaces import layers -from volatility3.framework.layers.scanners import multiregexp +from volatility3.framework.layers.scanners import multiregexp as multiregexp class BytesScanner(layers.ScannerInterface): @@ -136,6 +136,3 @@ class MultiStringScanner(layers.ScannerInterface): ) for match in re.finditer(self._regex, haystack): yield match.start(0), match.group() - - -__all__ = ["multiregexp", "BytesScanner", "RegExScanner", "MultiStringScanner"] From 6283ab6a1a7d871eacb1c7fc9e3d71f9333f4bab Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Sun, 24 Nov 2024 11:26:25 +0100 Subject: [PATCH 0195/1352] adjust SMBHandler import to use redundat alias --- volatility3/framework/layers/resources.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index 6b17db5ff..dc510452a 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -29,7 +29,7 @@ except ImportError: try: # Import so that the handler is found by the framework.class_subclasses callc - import smb.SMBHandler # lgtm [py/unused-import] # noqa: F401 + from smb import SMBHandler as SMBHandler except ImportError: # If we fail to import this, it means that SMB handling won't be available pass From d95c32b25a65e87fc1a3a57f46dafa628d0b5568 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Sun, 24 Nov 2024 11:27:41 +0100 Subject: [PATCH 0196/1352] run `ruff check --fix` --- volatility3/framework/automagic/linux.py | 2 -- volatility3/framework/automagic/mac.py | 2 -- 2 files changed, 4 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 93131a120..c044fdd93 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -3,12 +3,10 @@ # import logging -import os from typing import Optional, Tuple, Type from volatility3.framework import constants, interfaces from volatility3.framework.automagic import symbol_cache, symbol_finder -from volatility3.framework.configuration import requirements from volatility3.framework.layers import intel, scanners from volatility3.framework.symbols import linux diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py index 89dd5a187..f3679d160 100644 --- a/volatility3/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -3,13 +3,11 @@ # import logging -import os import struct from typing import Optional from volatility3.framework import constants, exceptions, interfaces, layers from volatility3.framework.automagic import symbol_cache, symbol_finder -from volatility3.framework.configuration import requirements from volatility3.framework.layers import intel, scanners from volatility3.framework.symbols import mac From 0b4d595bac567b478c343a9a9f18957e0270c410 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Sun, 24 Nov 2024 11:35:33 +0100 Subject: [PATCH 0197/1352] don't use bare except in windows netscan plugin --- volatility3/framework/plugins/windows/netscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index dd8e4b133..9462df43d 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -161,7 +161,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): raise NotImplementedError( "Kernel Debug Structure version format not supported!" ) - except: # noqa: E722 + except Exception: # unsure what to raise here. Also, it might be useful to add some kind of fallback, # either to a user-provided version or to another method to determine tcpip.sys's version raise exceptions.VolatilityException( From 8dc9bd037d67d0dd3805ba3421a19d8b8a76304f Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Sun, 24 Nov 2024 11:39:08 +0100 Subject: [PATCH 0198/1352] add fixme to windows/netscan plugin --- volatility3/framework/plugins/windows/netscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index 9462df43d..162031104 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -162,7 +162,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): "Kernel Debug Structure version format not supported!" ) except Exception: - # unsure what to raise here. Also, it might be useful to add some kind of fallback, + # FIXME: unsure what to raise here. Also, it might be useful to add some kind of fallback, # either to a user-provided version or to another method to determine tcpip.sys's version raise exceptions.VolatilityException( "Kernel Debug Structure missing VERSION/KUSER structure, unable to determine Windows version!" From eee015033ac3a7b17742ea149d3f3e01b9a7698e Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Sun, 24 Nov 2024 12:30:44 +0100 Subject: [PATCH 0199/1352] add back lgtm imperative --- volatility3/framework/layers/resources.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index dc510452a..00215f624 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -29,7 +29,7 @@ except ImportError: try: # Import so that the handler is found by the framework.class_subclasses callc - from smb import SMBHandler as SMBHandler + from smb import SMBHandler as SMBHandler # lgtm [py/unused-import] except ImportError: # If we fail to import this, it means that SMB handling won't be available pass From f6c852c478e5bf676cbc3def50900f8af66679b5 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Sun, 24 Nov 2024 13:04:13 +0100 Subject: [PATCH 0200/1352] format with black --- development/banner_server.py | 45 ++- development/compare-vol.py | 340 ++++++++++++------- development/mac-kdk/parse_pbzx2.py | 50 +-- development/pdbparse-to-json.py | 188 ++++++---- development/schema_validate.py | 8 +- development/stock-linux-json.py | 98 +++--- test/plugins/windows/test_scheduled_tasks.py | 2 + volatility3/framework/layers/resources.py | 2 +- 8 files changed, 462 insertions(+), 271 deletions(-) diff --git a/development/banner_server.py b/development/banner_server.py index 3aea41c82..b62477a26 100644 --- a/development/banner_server.py +++ b/development/banner_server.py @@ -28,10 +28,10 @@ class BannerCacheGenerator: def run(self): context = contexts.Context() - json_output = {'version': 1} + json_output = {"version": 1} path = self._path - filename = '*' + filename = "*" for banner_cache in [linux.LinuxBannerCache, mac.MacBannerCache]: sub_path = banner_cache.os @@ -39,37 +39,54 @@ class BannerCacheGenerator: for extension in constants.ISF_EXTENSIONS: # Hopefully these will not be large lists, otherwise this might be slow try: - for found in pathlib.Path(path).joinpath(sub_path).resolve().rglob(filename + extension): + for found in ( + pathlib.Path(path) + .joinpath(sub_path) + .resolve() + .rglob(filename + extension) + ): potentials.append(found.as_uri()) except FileNotFoundError: # If there's no linux symbols, don't cry about it pass - new_banners = banner_cache.read_new_banners(context, 'BannerServer', potentials, banner_cache.symbol_name, - banner_cache.os, progress_callback = PrintedProgress()) + new_banners = banner_cache.read_new_banners( + context, + "BannerServer", + potentials, + banner_cache.symbol_name, + banner_cache.os, + progress_callback=PrintedProgress(), + ) result_banners = {} for new_banner in new_banners: # Only accept file schemes - value = [self.convert_url(url) for url in new_banners[new_banner] if - urllib.parse.urlparse(url).scheme == 'file'] + value = [ + self.convert_url(url) + for url in new_banners[new_banner] + if urllib.parse.urlparse(url).scheme == "file" + ] if value and new_banner: # Convert files into URLs - result_banners[str(base64.b64encode(new_banner), 'latin-1')] = value + result_banners[str(base64.b64encode(new_banner), "latin-1")] = value json_output[banner_cache.os] = result_banners - output_path = os.path.join(self._path, 'banners.json') - with open(output_path, 'w') as fp: + output_path = os.path.join(self._path, "banners.json") + with open(output_path, "w") as fp: vollog.warning(f"Banners file written to {output_path}") json.dump(json_output, fp) -if __name__ == '__main__': +if __name__ == "__main__": parser = argparse.ArgumentParser() - parser.add_argument('--path', default = os.path.dirname(__file__)) - parser.add_argument('--urlprefix', help = 'Web prefix that will eventually serve the ISF files', - default = 'http://localhost/symbols') + parser.add_argument("--path", default=os.path.dirname(__file__)) + parser.add_argument( + "--urlprefix", + help="Web prefix that will eventually serve the ISF files", + default="http://localhost/symbols", + ) args = parser.parse_args() diff --git a/development/compare-vol.py b/development/compare-vol.py index 1074c5d9c..a01d8e93c 100644 --- a/development/compare-vol.py +++ b/development/compare-vol.py @@ -15,17 +15,17 @@ class VolatilityImage: filepath: str = "" vol2_profile: str = "" vol2_imageinfo_time: float = None - vol2_plugin_parameters: Dict[str, List[str]] = field(default_factory = dict) - vol3_plugin_parameters: Dict[str, List[str]] = field(default_factory = dict) - rekall_plugin_parameters: Dict[str, List[str]] = field(default_factory = dict) + vol2_plugin_parameters: Dict[str, List[str]] = field(default_factory=dict) + vol3_plugin_parameters: Dict[str, List[str]] = field(default_factory=dict) + rekall_plugin_parameters: Dict[str, List[str]] = field(default_factory=dict) @dataclass class VolatilityPlugin: name: str = "" - vol2_plugin_parameters: List[str] = field(default_factory = list) - vol3_plugin_parameters: List[str] = field(default_factory = list) - rekall_plugin_parameters: List[str] = field(default_factory = list) + vol2_plugin_parameters: List[str] = field(default_factory=list) + vol3_plugin_parameters: List[str] = field(default_factory=list) + rekall_plugin_parameters: List[str] = field(default_factory=list) class VolatilityTest: @@ -39,32 +39,50 @@ class VolatilityTest: def result_titles(self) -> List[str]: return [self.long_name] - def create_prerequisites(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str) -> None: + def create_prerequisites( + self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str + ) -> None: pass - def create_results(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str) -> List[float]: + def create_results( + self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str + ) -> List[float]: self.create_prerequisites(plugin, image, image_hash) # Volatility 2 Test - print(f"[*] Testing {self.short_name} {plugin.name} with image {image.filepath}") + print( + f"[*] Testing {self.short_name} {plugin.name} with image {image.filepath}" + ) os.chdir(self.path) cmd = self.plugin_cmd(plugin, image) start_time = time.perf_counter() try: - completed = subprocess.run(cmd, cwd = self.path, capture_output = True, timeout = 420) + completed = subprocess.run( + cmd, cwd=self.path, capture_output=True, timeout=420 + ) except subprocess.TimeoutExpired as excp: completed = excp end_time = time.perf_counter() total_time = end_time - start_time - print(f" Tested {self.short_name} {plugin.name} with image {image.filepath}: {total_time}") + print( + f" Tested {self.short_name} {plugin.name} with image {image.filepath}: {total_time}" + ) with open( - os.path.join(self.output_directory, f'{self.short_name}_{plugin.name}_{image_hash}_stdout'), - "wb") as f: + os.path.join( + self.output_directory, + f"{self.short_name}_{plugin.name}_{image_hash}_stdout", + ), + "wb", + ) as f: f.write(completed.stdout) if completed.stderr: with open( - os.path.join(self.output_directory, f'{self.short_name}_{plugin.name}_{image_hash}_stderr'), - "wb") as f: + os.path.join( + self.output_directory, + f"{self.short_name}_{plugin.name}_{image_hash}_stderr", + ), + "wb", + ) as f: f.write(completed.stderr) return [total_time] @@ -77,31 +95,57 @@ class Volatility2Test(VolatilityTest): long_name = "Volatility 2" def plugin_cmd(self, plugin: VolatilityPlugin, image: VolatilityImage): - return ["python2", "-u", "vol.py", "-f", image.filepath, "--profile", image.vol2_profile - ] + plugin.vol2_plugin_parameters + image.vol2_plugin_parameters.get(plugin.name, []) + return ( + [ + "python2", + "-u", + "vol.py", + "-f", + image.filepath, + "--profile", + image.vol2_profile, + ] + + plugin.vol2_plugin_parameters + + image.vol2_plugin_parameters.get(plugin.name, []) + ) def result_titles(self): return [self.long_name, "Imageinfo", f"{self.long_name} + Imageinfo"] - def create_results(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash) -> List[float]: + def create_results( + self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash + ) -> List[float]: result = super().create_results(plugin, image, image_hash) result += [image.vol2_imageinfo_time, result[0] + image.vol2_imageinfo_time] return result - def create_prerequisites(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash): + def create_prerequisites( + self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash + ): # Volatility 2 image info if not image.vol2_profile: - print(f"[*] Testing {self.short_name} imageinfo with image {image.filepath}") + print( + f"[*] Testing {self.short_name} imageinfo with image {image.filepath}" + ) os.chdir(self.path) cmd = ["python2", "-u", "vol.py", "-f", image.filepath, "imageinfo"] start_time = time.perf_counter() - vol2_completed = subprocess.run(cmd, cwd = self.path, capture_output = True) + vol2_completed = subprocess.run(cmd, cwd=self.path, capture_output=True) end_time = time.perf_counter() image.vol2_imageinfo_time = end_time - start_time - print(f" Tested volatility2 imageinfo with image {image.filepath}: {end_time - start_time}") - with open(os.path.join(self.output_directory, f'vol2_imageinfo_{image_hash}_stdout'), "wb") as f: + print( + f" Tested volatility2 imageinfo with image {image.filepath}: {end_time - start_time}" + ) + with open( + os.path.join( + self.output_directory, f"vol2_imageinfo_{image_hash}_stdout" + ), + "wb", + ) as f: f.write(vol2_completed.stdout) - image.vol2_profile = re.search(rb"Suggested Profile\(s\) : ([^,]+)", vol2_completed.stdout)[1] + image.vol2_profile = re.search( + rb"Suggested Profile\(s\) : ([^,]+)", vol2_completed.stdout + )[1] class RekallTest(VolatilityTest): @@ -113,11 +157,16 @@ class RekallTest(VolatilityTest): plugin.rekall_plugin_parameters = plugin.vol2_plugin_parameters if not image.rekall_plugin_parameters: image.rekall_plugin_parameters = image.vol2_plugin_parameters - return ["rekall", "-f", image.filepath] + plugin.rekall_plugin_parameters + image.rekall_plugin_parameters.get( - plugin.name, []) + return ( + ["rekall", "-f", image.filepath] + + plugin.rekall_plugin_parameters + + image.rekall_plugin_parameters.get(plugin.name, []) + ) - def create_prerequisites(self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str) -> None: - shutil.rmtree('/home/mike/.rekall_cache/sessions') + def create_prerequisites( + self, plugin: VolatilityPlugin, image: VolatilityImage, image_hash: str + ) -> None: + shutil.rmtree("/home/mike/.rekall_cache/sessions") class Volatility3Test(VolatilityTest): @@ -125,14 +174,18 @@ class Volatility3Test(VolatilityTest): long_name = "Volatility 3" def plugin_cmd(self, plugin: VolatilityPlugin, image: VolatilityImage) -> List[str]: - return [ - "python", - "-u", - "vol.py", - "-q", - "-f", - image.filepath, - ] + plugin.vol3_plugin_parameters + image.vol3_plugin_parameters.get(plugin.name, []) + return ( + [ + "python", + "-u", + "vol.py", + "-q", + "-f", + image.filepath, + ] + + plugin.vol3_plugin_parameters + + image.vol3_plugin_parameters.get(plugin.name, []) + ) class Volatility3PyPyTest(VolatilityTest): @@ -140,26 +193,32 @@ class Volatility3PyPyTest(VolatilityTest): long_name = "Volatility 3 (PyPy)" def plugin_cmd(self, plugin: VolatilityPlugin, image: VolatilityImage) -> List[str]: - return [ - "pypy3", - "-u", - "vol.py", - "-q", - "-f", - image.filepath, - ] + plugin.vol3_plugin_parameters + image.vol3_plugin_parameters.get(plugin.name, []) + return ( + [ + "pypy3", + "-u", + "vol.py", + "-q", + "-f", + image.filepath, + ] + + plugin.vol3_plugin_parameters + + image.vol3_plugin_parameters.get(plugin.name, []) + ) class VolatilityTester: - def __init__(self, - images: List[VolatilityImage], - plugins: List[VolatilityPlugin], - frameworks: List[str], - output_dir: str, - vol2_path: str = None, - vol3_path: str = None, - rekall_path = None): + def __init__( + self, + images: List[VolatilityImage], + plugins: List[VolatilityPlugin], + frameworks: List[str], + output_dir: str, + vol2_path: str = None, + vol3_path: str = None, + rekall_path=None, + ): self.images = images self.plugins = plugins if not vol2_path: @@ -172,7 +231,7 @@ class VolatilityTester: Volatility3Test(vol3_path, output_dir), Volatility3PyPyTest(vol3_path, output_dir), Volatility2Test(vol2_path, output_dir), - RekallTest(rekall_path, output_dir) + RekallTest(rekall_path, output_dir), ] self.tests = [x for x in available_tests if x.short_name.lower() in frameworks] self.csv_writer = None @@ -183,7 +242,7 @@ class VolatilityTester: print(f"[?] Frameworks: {[x.long_name for x in self.tests]}") def run_tests(self): - with open("volatility-timings.csv", 'w') as csvfile: + with open("volatility-timings.csv", "w") as csvfile: self.csv_writer = csv.writer(csvfile) titles = ["Image Hash", "Image Path", "Plugin Name"] for test in self.tests: @@ -203,72 +262,121 @@ class VolatilityTester: self.csv_writer.writerow([image_hash, image.filepath, plugin.name] + results) -if __name__ == '__main__': +if __name__ == "__main__": plugins = [ - VolatilityPlugin(name = "pslist", - vol2_plugin_parameters = ["pslist"], - vol3_plugin_parameters = ["windows.pslist"]), - VolatilityPlugin(name = "psscan", - vol2_plugin_parameters = ["psscan"], - vol3_plugin_parameters = ["windows.psscan"], - rekall_plugin_parameters = ["psscan", "--scan_kernel"]), - VolatilityPlugin(name = "driverscan", - vol2_plugin_parameters = ["driverscan"], - vol3_plugin_parameters = ["windows.driverscan"], - rekall_plugin_parameters = ["driverscan", "--scan_kernel"]), - VolatilityPlugin(name = "handles", - vol2_plugin_parameters = ["handles"], - vol3_plugin_parameters = ["windows.handles"]), - VolatilityPlugin(name = "modules", - vol2_plugin_parameters = ["modules"], - vol3_plugin_parameters = ["windows.modules"]), - VolatilityPlugin(name = "hivelist", - vol2_plugin_parameters = ["hivelist"], - vol3_plugin_parameters = ["registry.hivelist"], - rekall_plugin_parameters = ["hives"]), - VolatilityPlugin(name = "vadinfo", - vol2_plugin_parameters = ["vadinfo"], - vol3_plugin_parameters = ["windows.vadinfo"], - rekall_plugin_parameters = ["vad"]), - VolatilityPlugin(name = "modscan", - vol2_plugin_parameters = ["modscan"], - vol3_plugin_parameters = ["windows.modscan"], - rekall_plugin_parameters = ["modscan", "--scan_kernel"]), - VolatilityPlugin(name = "svcscan", - vol2_plugin_parameters = ["svcscan"], - vol3_plugin_parameters = ["windows.svcscan"], - rekall_plugin_parameters = ["svcscan"]), - VolatilityPlugin(name = "ssdt", vol2_plugin_parameters = ["ssdt"], vol3_plugin_parameters = ["windows.ssdt"]), - VolatilityPlugin(name = "printkey", - vol2_plugin_parameters = ["printkey", "-K", "Classes"], - vol3_plugin_parameters = ["registry.printkey", "--key", "Classes"], - rekall_plugin_parameters = ["printkey", "--key", "Classes"]) + VolatilityPlugin( + name="pslist", + vol2_plugin_parameters=["pslist"], + vol3_plugin_parameters=["windows.pslist"], + ), + VolatilityPlugin( + name="psscan", + vol2_plugin_parameters=["psscan"], + vol3_plugin_parameters=["windows.psscan"], + rekall_plugin_parameters=["psscan", "--scan_kernel"], + ), + VolatilityPlugin( + name="driverscan", + vol2_plugin_parameters=["driverscan"], + vol3_plugin_parameters=["windows.driverscan"], + rekall_plugin_parameters=["driverscan", "--scan_kernel"], + ), + VolatilityPlugin( + name="handles", + vol2_plugin_parameters=["handles"], + vol3_plugin_parameters=["windows.handles"], + ), + VolatilityPlugin( + name="modules", + vol2_plugin_parameters=["modules"], + vol3_plugin_parameters=["windows.modules"], + ), + VolatilityPlugin( + name="hivelist", + vol2_plugin_parameters=["hivelist"], + vol3_plugin_parameters=["registry.hivelist"], + rekall_plugin_parameters=["hives"], + ), + VolatilityPlugin( + name="vadinfo", + vol2_plugin_parameters=["vadinfo"], + vol3_plugin_parameters=["windows.vadinfo"], + rekall_plugin_parameters=["vad"], + ), + VolatilityPlugin( + name="modscan", + vol2_plugin_parameters=["modscan"], + vol3_plugin_parameters=["windows.modscan"], + rekall_plugin_parameters=["modscan", "--scan_kernel"], + ), + VolatilityPlugin( + name="svcscan", + vol2_plugin_parameters=["svcscan"], + vol3_plugin_parameters=["windows.svcscan"], + rekall_plugin_parameters=["svcscan"], + ), + VolatilityPlugin( + name="ssdt", + vol2_plugin_parameters=["ssdt"], + vol3_plugin_parameters=["windows.ssdt"], + ), + VolatilityPlugin( + name="printkey", + vol2_plugin_parameters=["printkey", "-K", "Classes"], + vol3_plugin_parameters=["registry.printkey", "--key", "Classes"], + rekall_plugin_parameters=["printkey", "--key", "Classes"], + ), ] parser = argparse.ArgumentParser() - parser.add_argument("--output-dir", type = str, default = os.getcwd(), help = "Directory to store all results") - parser.add_argument("--vol3path", - type = str, - default = os.path.join(os.getcwd(), 'volatility3'), - help = "Path ot the volatility 3 directory") - parser.add_argument("--vol2path", - type = str, - default = os.path.join(os.getcwd(), 'volatility'), - help = "Path to the volatility 2 directory") - parser.add_argument("--rekallpath", - type = str, - default = os.path.join(os.getcwd(), 'rekall'), - help = "Path to the rekall directory") - parser.add_argument("--frameworks", - nargs = "+", - type = str, - choices = [x.short_name.lower() for x in VolatilityTest.__subclasses__()], - default = [x.short_name.lower() for x in VolatilityTest.__subclasses__()], - help = "A comma separated list of frameworks to test") - parser.add_argument('images', metavar = 'IMAGE', type = str, nargs = '+', help = 'The list of images to compare') + parser.add_argument( + "--output-dir", + type=str, + default=os.getcwd(), + help="Directory to store all results", + ) + parser.add_argument( + "--vol3path", + type=str, + default=os.path.join(os.getcwd(), "volatility3"), + help="Path ot the volatility 3 directory", + ) + parser.add_argument( + "--vol2path", + type=str, + default=os.path.join(os.getcwd(), "volatility"), + help="Path to the volatility 2 directory", + ) + parser.add_argument( + "--rekallpath", + type=str, + default=os.path.join(os.getcwd(), "rekall"), + help="Path to the rekall directory", + ) + parser.add_argument( + "--frameworks", + nargs="+", + type=str, + choices=[x.short_name.lower() for x in VolatilityTest.__subclasses__()], + default=[x.short_name.lower() for x in VolatilityTest.__subclasses__()], + help="A comma separated list of frameworks to test", + ) + parser.add_argument( + "images", + metavar="IMAGE", + type=str, + nargs="+", + help="The list of images to compare", + ) args = parser.parse_args() - vt = VolatilityTester([VolatilityImage(filepath = x) for x in args.images], plugins, - [x.lower() for x in args.frameworks], args.output_dir, args.vol2path, args.vol3path, - args.rekallpath) + vt = VolatilityTester( + [VolatilityImage(filepath=x) for x in args.images], + plugins, + [x.lower() for x in args.frameworks], + args.output_dir, + args.vol2path, + args.vol3path, + args.rekallpath, + ) vt.run_tests() diff --git a/development/mac-kdk/parse_pbzx2.py b/development/mac-kdk/parse_pbzx2.py index 1ca212211..b175539b3 100644 --- a/development/mac-kdk/parse_pbzx2.py +++ b/development/mac-kdk/parse_pbzx2.py @@ -12,7 +12,7 @@ import struct import sys -def seekread(f, offset = None, length = 0, relative = True): +def seekread(f, offset=None, length=0, relative=True): if offset is not None: # offset provided, let's seek f.seek(offset, [0, 1, 2][relative]) @@ -23,55 +23,57 @@ def seekread(f, offset = None, length = 0, relative = True): def parse_pbzx(pbzx_path): section = 0 - xar_out_path = f'{pbzx_path}.part{section:02d}.cpio.xz' - with open(pbzx_path, 'rb') as f: + xar_out_path = f"{pbzx_path}.part{section:02d}.cpio.xz" + with open(pbzx_path, "rb") as f: # pbzx = f.read() # f.close() - magic = seekread(f, length = 4) - if magic != 'pbzx': + magic = seekread(f, length=4) + if magic != "pbzx": raise RuntimeError("Error: Not a pbzx file") # Read 8 bytes for initial flags - flags = seekread(f, length = 8) + flags = seekread(f, length=8) # Interpret the flags as a 64-bit big-endian unsigned int - flags = struct.unpack('>Q', flags)[0] + flags = struct.unpack(">Q", flags)[0] while flags & (1 << 24): - with open(xar_out_path, 'wb') as xar_f: + with open(xar_out_path, "wb") as xar_f: xar_f.seek(0, os.SEEK_END) # Read in more flags - flags = seekread(f, length = 8) - flags = struct.unpack('>Q', flags)[0] + flags = seekread(f, length=8) + flags = struct.unpack(">Q", flags)[0] # Read in length - f_length = seekread(f, length = 8) - f_length = struct.unpack('>Q', f_length)[0] - xzmagic = seekread(f, length = 6) - if xzmagic != '\xfd7zXZ\x00': + f_length = seekread(f, length=8) + f_length = struct.unpack(">Q", f_length)[0] + xzmagic = seekread(f, length=6) + if xzmagic != "\xfd7zXZ\x00": # This isn't xz content, this is actually _raw decompressed cpio_ chunk of 16MB in size... # Let's back up ... - seekread(f, offset = -6, length = 0) + seekread(f, offset=-6, length=0) # ... and split it out ... - f_content = seekread(f, length = f_length) + f_content = seekread(f, length=f_length) section += 1 - decomp_out = f'{pbzx_path}.part{section:02d}.cpio' - with open(decomp_out, 'wb') as g: + decomp_out = f"{pbzx_path}.part{section:02d}.cpio" + with open(decomp_out, "wb") as g: g.write(f_content) # Now to start the next section, which should hopefully be .xz (we'll just assume it is ...) section += 1 - xar_out_path = f'{pbzx_path}.part{section:02d}.cpio.xz' + xar_out_path = f"{pbzx_path}.part{section:02d}.cpio.xz" else: f_length -= 6 # This part needs buffering - f_content = seekread(f, length = f_length) - tail = seekread(f, offset = -2, length = 2) + f_content = seekread(f, length=f_length) + tail = seekread(f, offset=-2, length=2) xar_f.write(xzmagic) xar_f.write(f_content) - if tail != 'YZ': + if tail != "YZ": raise RuntimeError("Error: Footer is not xar file footer") def main(): parse_pbzx(sys.argv[1]) - print("Now xz decompress the .xz chunks, then 'cat' them all together in order into a single new.cpio file") + print( + "Now xz decompress the .xz chunks, then 'cat' them all together in order into a single new.cpio file" + ) -if __name__ == '__main__': +if __name__ == "__main__": main() diff --git a/development/pdbparse-to-json.py b/development/pdbparse-to-json.py index 6ffa4ea49..49b4da009 100644 --- a/development/pdbparse-to-json.py +++ b/development/pdbparse-to-json.py @@ -13,10 +13,10 @@ import pdbparse.undecorate logger = logging.getLogger(__name__) logger.setLevel(1) -if __name__ == '__main__': +if __name__ == "__main__": console = logging.StreamHandler() console.setLevel(1) - formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s') + formatter = logging.Formatter("%(levelname)-8s %(name)-12s: %(message)s") console.setFormatter(formatter) logger.addHandler(console) @@ -25,12 +25,12 @@ class PDBRetreiver: def retreive_pdb(self, guid: str, file_name: str) -> Optional[str]: logger.info("Download PDB file...") - file_name = ".".join(file_name.split(".")[:-1] + ['pdb']) - for sym_url in ['http://msdl.microsoft.com/download/symbols']: + file_name = ".".join(file_name.split(".")[:-1] + ["pdb"]) + for sym_url in ["http://msdl.microsoft.com/download/symbols"]: url = sym_url + f"/{file_name}/{guid}/" result = None - for suffix in [file_name[:-1] + '_', file_name]: + for suffix in [file_name[:-1] + "_", file_name]: try: logger.debug("Attempting to retrieve %s", url + suffix) result, _ = request.urlretrieve(url + suffix) @@ -69,7 +69,7 @@ class PDBConvertor: "float": "float", "double": "float", "long double": "float", - "void": "void" + "void": "void", } base_type_size = { @@ -122,13 +122,18 @@ class PDBConvertor: self._seen_ctypes.add(ctype) return self.ctype[ctype] - def lookup_ctype_pointers(self, ctype_pointer: str) -> Dict[str, Union[str, Dict[str, str]]]: - base_type = ctype_pointer.replace('32P', '').replace('64P', '') + def lookup_ctype_pointers( + self, ctype_pointer: str + ) -> Dict[str, Union[str, Dict[str, str]]]: + base_type = ctype_pointer.replace("32P", "").replace("64P", "") if base_type == ctype_pointer: # We raise a KeyError, because we've been asked about a type that isn't a pointer raise KeyError self._seen_ctypes.add(base_type) - return {"kind": "pointer", "subtype": {"kind": "base", "name": self.ctype[base_type]}} + return { + "kind": "pointer", + "subtype": {"kind": "base", "name": self.ctype[base_type]}, + } def read_pdb(self) -> Dict: """Reads in the PDB file and forms essentially a python dictionary of necessary data""" @@ -137,31 +142,31 @@ class PDBConvertor: "enums": self.read_enums(), "metadata": self.generate_metadata(), "symbols": self.read_symbols(), - "base_types": self.read_basetypes() + "base_types": self.read_basetypes(), } return output def generate_metadata(self) -> Dict[str, Any]: """Generates the metadata necessary for this object""" dbg = self._pdb.STREAM_DBI - last_bytes = str(binascii.hexlify(self._pdb.STREAM_PDB.GUID.Data4), 'ascii')[-16:] - guidstr = f'{self._pdb.STREAM_PDB.GUID.Data1:08x}{self._pdb.STREAM_PDB.GUID.Data2:04x}{self._pdb.STREAM_PDB.GUID.Data3:04x}{last_bytes}' + last_bytes = str(binascii.hexlify(self._pdb.STREAM_PDB.GUID.Data4), "ascii")[ + -16: + ] + guidstr = f"{self._pdb.STREAM_PDB.GUID.Data1:08x}{self._pdb.STREAM_PDB.GUID.Data2:04x}{self._pdb.STREAM_PDB.GUID.Data3:04x}{last_bytes}" pdb_data = { "GUID": guidstr.upper(), "age": self._pdb.STREAM_PDB.Age, "database": "ntkrnlmp.pdb", - "machine_type": int(dbg.machine) + "machine_type": int(dbg.machine), } result = { "format": "6.0.0", "producer": { "datetime": datetime.datetime.now().isoformat(), "name": "pdbconv", - "version": "0.1.0" + "version": "0.1.0", }, - "windows": { - "pdb": pdb_data - } + "windows": {"pdb": pdb_data}, } return result @@ -172,16 +177,21 @@ class PDBConvertor: stream = self._pdb.STREAM_TPI for type_index in stream.types: user_type = stream.types[type_index] - if (user_type.leaf_type == "LF_ENUM" and not user_type.prop.fwdref): + if user_type.leaf_type == "LF_ENUM" and not user_type.prop.fwdref: output.update(self._format_enum(user_type)) return output def _format_enum(self, user_enum): output = { user_enum.name: { - 'base': self.lookup_ctype(user_enum.utype), - 'size': self._determine_size(user_enum.utype), - 'constants': dict([(enum.name, enum.enum_value) for enum in user_enum.fieldlist.substructs]) + "base": self.lookup_ctype(user_enum.utype), + "size": self._determine_size(user_enum.utype), + "constants": dict( + [ + (enum.name, enum.enum_value) + for enum in user_enum.fieldlist.substructs + ] + ), } } return output @@ -201,7 +211,7 @@ class PDBConvertor: omap = None for sym in self._pdb.STREAM_GSYM.globals: - if not hasattr(sym, 'offset'): + if not hasattr(sym, "offset"): continue try: virt_base = sects[sym.segment - 1].VirtualAddress @@ -222,9 +232,9 @@ class PDBConvertor: stream = self._pdb.STREAM_TPI for type_index in stream.types: user_type = stream.types[type_index] - if (user_type.leaf_type == "LF_STRUCTURE" and not user_type.prop.fwdref): + if user_type.leaf_type == "LF_STRUCTURE" and not user_type.prop.fwdref: output.update(self._format_usertype(user_type, "struct")) - elif (user_type.leaf_type == "LF_UNION" and not user_type.prop.fwdref): + elif user_type.leaf_type == "LF_UNION" and not user_type.prop.fwdref: output.update(self._format_usertype(user_type, "union")) return output @@ -232,16 +242,22 @@ class PDBConvertor: """Produces a single usertype""" fields: Dict[str, Dict[str, Any]] = {} [fields.update(self._format_field(s)) for s in usertype.fieldlist.substructs] - return {usertype.name: {'fields': fields, 'kind': kind, 'size': usertype.size}} + return {usertype.name: {"fields": fields, "kind": kind, "size": usertype.size}} def _format_field(self, field) -> Dict[str, Dict[str, Any]]: - return {field.name: {"offset": field.offset, "type": self._format_kind(field.index)}} + return { + field.name: {"offset": field.offset, "type": self._format_kind(field.index)} + } def _determine_size(self, field): output = None if isinstance(field, str): output = self.base_type_size[field] - elif (field.leaf_type == "LF_STRUCTURE" or field.leaf_type == "LF_ARRAY" or field.leaf_type == "LF_UNION"): + elif ( + field.leaf_type == "LF_STRUCTURE" + or field.leaf_type == "LF_ARRAY" + or field.leaf_type == "LF_UNION" + ): output = field.size elif field.leaf_type == "LF_POINTER": output = self.base_type_size[field.ptr_attr.type] @@ -255,6 +271,7 @@ class PDBConvertor: output = self._determine_size(field.index) if output is None: import pdb + pdb.set_trace() raise ValueError(f"Unknown size for field: {field.name}") return output @@ -266,36 +283,37 @@ class PDBConvertor: output = self.lookup_ctype_pointers(kind) except KeyError: try: - output = {'kind': 'base', 'name': self.lookup_ctype(kind)} + output = {"kind": "base", "name": self.lookup_ctype(kind)} except KeyError: - output = {'kind': 'base', 'name': kind} - elif kind.leaf_type == 'LF_MODIFIER': + output = {"kind": "base", "name": kind} + elif kind.leaf_type == "LF_MODIFIER": output = self._format_kind(kind.modified_type) - elif kind.leaf_type == 'LF_STRUCTURE': - output = {'kind': 'struct', 'name': kind.name} - elif kind.leaf_type == 'LF_UNION': - output = {'kind': 'union', 'name': kind.name} - elif kind.leaf_type == 'LF_BITFIELD': + elif kind.leaf_type == "LF_STRUCTURE": + output = {"kind": "struct", "name": kind.name} + elif kind.leaf_type == "LF_UNION": + output = {"kind": "union", "name": kind.name} + elif kind.leaf_type == "LF_BITFIELD": output = { - 'kind': 'bitfield', - 'type': self._format_kind(kind.base_type), - 'bit_length': kind.length, - 'bit_position': kind.position + "kind": "bitfield", + "type": self._format_kind(kind.base_type), + "bit_length": kind.length, + "bit_position": kind.position, } - elif kind.leaf_type == 'LF_POINTER': - output = {'kind': 'pointer', 'subtype': self._format_kind(kind.utype)} - elif kind.leaf_type == 'LF_ARRAY': + elif kind.leaf_type == "LF_POINTER": + output = {"kind": "pointer", "subtype": self._format_kind(kind.utype)} + elif kind.leaf_type == "LF_ARRAY": output = { - 'kind': 'array', - 'count': kind.size // self._determine_size(kind.element_type), - 'subtype': self._format_kind(kind.element_type) + "kind": "array", + "count": kind.size // self._determine_size(kind.element_type), + "subtype": self._format_kind(kind.element_type), } - elif kind.leaf_type == 'LF_ENUM': - output = {'kind': 'enum', 'name': kind.name} - elif kind.leaf_type == 'LF_PROCEDURE': - output = {'kind': "function"} + elif kind.leaf_type == "LF_ENUM": + output = {"kind": "enum", "name": kind.name} + elif kind.leaf_type == "LF_PROCEDURE": + output = {"kind": "function"} else: import pdb + pdb.set_trace() return output @@ -305,40 +323,70 @@ class PDBConvertor: if "64" in self._pdb.STREAM_DBI.machine: ptr_size = 8 - output = {"pointer": {"endian": "little", "kind": "int", "signed": False, "size": ptr_size}} + output = { + "pointer": { + "endian": "little", + "kind": "int", + "signed": False, + "size": ptr_size, + } + } for index in self._seen_ctypes: output[self.ctype[index]] = { "endian": "little", "kind": self.ctype_python_types.get(self.ctype[index], "int"), "signed": False if "_U" in index else True, - "size": self.base_type_size[index] + "size": self.base_type_size[index], } return output -if __name__ == '__main__': - parser = argparse.ArgumentParser(description = "Convertor for PDB files to Volatility 3 Intermediate Symbol Format") - parser.add_argument("-o", "--output", metavar = "OUTPUT", help = "Filename for data output", required = True) - file_group = parser.add_argument_group("file", description = "File-based conversion of PDB to ISF") - file_group.add_argument("-f", "--file", metavar = "FILE", help = "PDB file to translate to ISF") - data_group = parser.add_argument_group("data", description = "Convert based on a GUID and filename pattern") - data_group.add_argument("-p", "--pattern", metavar = "PATTERN", help = "Filename pattern to recover PDB file") - data_group.add_argument("-g", - "--guid", - metavar = "GUID", - help = "GUID + Age string for the required PDB file", - default = None) - data_group.add_argument("-k", - "--keep", - action = "store_true", - default = False, - help = "Keep the downloaded PDB file") +if __name__ == "__main__": + parser = argparse.ArgumentParser( + description="Convertor for PDB files to Volatility 3 Intermediate Symbol Format" + ) + parser.add_argument( + "-o", + "--output", + metavar="OUTPUT", + help="Filename for data output", + required=True, + ) + file_group = parser.add_argument_group( + "file", description="File-based conversion of PDB to ISF" + ) + file_group.add_argument( + "-f", "--file", metavar="FILE", help="PDB file to translate to ISF" + ) + data_group = parser.add_argument_group( + "data", description="Convert based on a GUID and filename pattern" + ) + data_group.add_argument( + "-p", + "--pattern", + metavar="PATTERN", + help="Filename pattern to recover PDB file", + ) + data_group.add_argument( + "-g", + "--guid", + metavar="GUID", + help="GUID + Age string for the required PDB file", + default=None, + ) + data_group.add_argument( + "-k", + "--keep", + action="store_true", + default=False, + help="Keep the downloaded PDB file", + ) args = parser.parse_args() delfile = False filename = None if args.guid is not None and args.pattern is not None: - filename = PDBRetreiver().retreive_pdb(guid = args.guid, file_name = args.pattern) + filename = PDBRetreiver().retreive_pdb(guid=args.guid, file_name=args.pattern) delfile = True elif args.file: filename = args.file @@ -351,7 +399,7 @@ if __name__ == '__main__': convertor = PDBConvertor(filename) with open(args.output, "w") as f: - json.dump(convertor.read_pdb(), f, indent = 2, sort_keys = True) + json.dump(convertor.read_pdb(), f, indent=2, sort_keys=True) if args.keep: print(f"Temporary PDB file: {filename}") diff --git a/development/schema_validate.py b/development/schema_validate.py index 0ea82d537..cf9565d68 100644 --- a/development/schema_validate.py +++ b/development/schema_validate.py @@ -9,7 +9,7 @@ sys.path += ".." console = logging.StreamHandler() console.setLevel(logging.DEBUG) -formatter = logging.Formatter('%(levelname)-8s %(name)-12s: %(message)s') +formatter = logging.Formatter("%(levelname)-8s %(name)-12s: %(message)s") console.setFormatter(formatter) logger = logging.getLogger("") @@ -18,10 +18,10 @@ logger.setLevel(logging.DEBUG) from volatility3 import schemas # noqa: E402 -if __name__ == '__main__': +if __name__ == "__main__": parser = argparse.ArgumentParser("Validates ") - parser.add_argument("-s", "--schema", dest = "schema", default = None) - parser.add_argument("filenames", metavar = "FILE", nargs = '+') + parser.add_argument("-s", "--schema", dest="schema", default=None) + parser.add_argument("filenames", metavar="FILE", nargs="+") args = parser.parse_args() diff --git a/development/stock-linux-json.py b/development/stock-linux-json.py index 877f78e1c..967cc7e18 100644 --- a/development/stock-linux-json.py +++ b/development/stock-linux-json.py @@ -9,7 +9,7 @@ import requests import rpmfile from debian import debfile -DWARF2JSON = './dwarf2json' +DWARF2JSON = "./dwarf2json" class Downloader: @@ -17,7 +17,7 @@ class Downloader: def __init__(self, url_lists: List[List[str]]) -> None: self.url_lists = url_lists - def download_lists(self, keep = False): + def download_lists(self, keep=False): for url_list in self.url_lists: print("Downloading files...") files_for_processing = self.download_list(url_list) @@ -35,43 +35,45 @@ class Downloader: with tempfile.NamedTemporaryFile() as archivedata: archivedata.write(data.content) archivedata.seek(0) - if url.endswith('.rpm'): + if url.endswith(".rpm"): processed_files[url] = self.process_rpm(archivedata) - elif url.endswith('.deb'): + elif url.endswith(".deb"): processed_files[url] = self.process_deb(archivedata) return processed_files def process_rpm(self, archivedata) -> Optional[str]: - rpm = rpmfile.RPMFile(fileobj = archivedata) + rpm = rpmfile.RPMFile(fileobj=archivedata) member = None extracted = None for member in rpm.getmembers(): - if 'vmlinux' in member.name or 'System.map' in member.name: + if "vmlinux" in member.name or "System.map" in member.name: print(f" - Extracting {member.name}") extracted = rpm.extractfile(member) break if not member or not extracted: return None - with tempfile.NamedTemporaryFile(delete = False, - prefix = 'vmlinux' if 'vmlinux' in member.name else 'System.map') as output: + with tempfile.NamedTemporaryFile( + delete=False, prefix="vmlinux" if "vmlinux" in member.name else "System.map" + ) as output: print(f" - Writing to {output.name}") output.write(extracted.read()) return output.name def process_deb(self, archivedata) -> Optional[str]: - deb = debfile.DebFile(fileobj = archivedata) + deb = debfile.DebFile(fileobj=archivedata) member = None extracted = None for member in deb.data.tgz().getmembers(): - if member.name.endswith('vmlinux') or 'System.map' in member.name: + if member.name.endswith("vmlinux") or "System.map" in member.name: print(f" - Extracting {member.name}") extracted = deb.data.get_file(member.name) break if not member or not extracted: return None - with tempfile.NamedTemporaryFile(delete = False, - prefix = 'vmlinux' if 'vmlinux' in member.name else 'System.map') as output: + with tempfile.NamedTemporaryFile( + delete=False, prefix="vmlinux" if "vmlinux" in member.name else "System.map" + ) as output: print(f" - Writing to {output.name}") output.write(extracted.read()) return output.name @@ -83,43 +85,55 @@ class Downloader: if named_files[i] is None: print(f"FAILURE: None encountered for {i}") return - args = [DWARF2JSON, 'linux'] - output_filename = 'unknown-kernel.json' + args = [DWARF2JSON, "linux"] + output_filename = "unknown-kernel.json" for named_file in named_files: - prefix = '--system-map' - if 'System' not in named_files[named_file]: - prefix = '--elf' - output_filename = './' + '-'.join((named_file.split('/')[-1]).split('-')[2:])[:-4] + '.json.xz' + prefix = "--system-map" + if "System" not in named_files[named_file]: + prefix = "--elf" + output_filename = ( + "./" + + "-".join((named_file.split("/")[-1]).split("-")[2:])[:-4] + + ".json.xz" + ) args += [prefix, named_files[named_file]] print(f" - Running {args}") - proc = subprocess.run(args, capture_output = True) + proc = subprocess.run(args, capture_output=True) print(f" - Writing to {output_filename}") - with lzma.open(output_filename, 'w') as f: + with lzma.open(output_filename, "w") as f: f.write(proc.stdout) -if __name__ == '__main__': - parser = argparse.ArgumentParser(description = "Takes a list of URLs for Centos and downloads them") - parser.add_argument("-f", - "--file", - dest = 'filename', - metavar = "FILENAME", - help = "Filename to be read", - required = True) - parser.add_argument("-d", - "--dwarf2json", - dest = 'dwarfpath', - metavar = "PATH", - default = DWARF2JSON, - help = "Path to the dwarf2json binary", - required = True) - parser.add_argument("-k", - "--keep", - dest = 'keep', - action = 'store_true', - help = 'Keep extracted temporary files after completion', - default = False) +if __name__ == "__main__": + parser = argparse.ArgumentParser( + description="Takes a list of URLs for Centos and downloads them" + ) + parser.add_argument( + "-f", + "--file", + dest="filename", + metavar="FILENAME", + help="Filename to be read", + required=True, + ) + parser.add_argument( + "-d", + "--dwarf2json", + dest="dwarfpath", + metavar="PATH", + default=DWARF2JSON, + help="Path to the dwarf2json binary", + required=True, + ) + parser.add_argument( + "-k", + "--keep", + dest="keep", + action="store_true", + help="Keep extracted temporary files after completion", + default=False, + ) args = parser.parse_args() DWARF2JSON = args.dwarfpath @@ -132,4 +146,4 @@ if __name__ == '__main__': urls += [[lines[2 * i].strip(), lines[(2 * i) + 1].strip()]] d = Downloader(urls) - d.download_lists(keep = args.keep) + d.download_lists(keep=args.keep) diff --git a/test/plugins/windows/test_scheduled_tasks.py b/test/plugins/windows/test_scheduled_tasks.py index fdb19fbae..15d7f79a6 100644 --- a/test/plugins/windows/test_scheduled_tasks.py +++ b/test/plugins/windows/test_scheduled_tasks.py @@ -2,9 +2,11 @@ import sys import struct import traceback import unittest + sys.path.insert(0, "../../volatility3") from volatility3.plugins.windows import scheduled_tasks + class TestActionsDecoding(unittest.TestCase): def test_decode_exe_action(self): # fmt: off diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index 00215f624..236d256f1 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -29,7 +29,7 @@ except ImportError: try: # Import so that the handler is found by the framework.class_subclasses callc - from smb import SMBHandler as SMBHandler # lgtm [py/unused-import] + from smb import SMBHandler as SMBHandler # lgtm [py/unused-import] except ImportError: # If we fail to import this, it means that SMB handling won't be available pass From 503999ddcafc6eee23d53a0e08c3ebad3139892e Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Sun, 24 Nov 2024 13:04:58 +0100 Subject: [PATCH 0201/1352] update black workflow (formatter not a linter) --- .github/workflows/black.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml index e29ab6f29..d755d9402 100644 --- a/.github/workflows/black.yml +++ b/.github/workflows/black.yml @@ -1,4 +1,4 @@ -name: Black python linter +name: Black python formatter on: [push, pull_request] From ab19b52d5b85a6fc7275bf8108fa74e966c72694 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Wed, 27 Nov 2024 11:58:14 +0100 Subject: [PATCH 0202/1352] run `ruff check --fix` --- volatility3/framework/automagic/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index c044fdd93..f22cae012 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -3,7 +3,7 @@ # import logging -from typing import Optional, Tuple, Type +from typing import Optional, Tuple from volatility3.framework import constants, interfaces from volatility3.framework.automagic import symbol_cache, symbol_finder From d9c370c6ae94ba7ff94075279f65608034b91830 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Mon, 9 Dec 2024 15:01:32 +0100 Subject: [PATCH 0203/1352] format with black --- volatility3/framework/__init__.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index b60ae5576..d5e2c50b4 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -143,9 +143,7 @@ def import_files(base_module, ignore_errors: bool = False) -> List[str]: def _filter_files(filename: str): """Ensures that a filename traversed is an importable python file""" - return (filename.endswith((".py", ".pyc"))) and not filename.startswith( - "__" - ) + return (filename.endswith((".py", ".pyc"))) and not filename.startswith("__") def import_file(module: str, path: str, ignore_errors: bool = False) -> List[str]: From c6c3b35f52a33d8a4c7ddb57245d73c6270e08f3 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Thu, 12 Dec 2024 09:21:36 +0100 Subject: [PATCH 0204/1352] run `ruff check . --unsafe-fixes --fix` --- volatility3/framework/plugins/windows/mftscan.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index feea78ece..c4d05e634 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -275,19 +275,17 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): display_data = True if display_data: - for record in cls.parse_data_record( + yield from cls.parse_data_record( mft_record, attr, record_map, return_first_record - ): - yield record + ) def _generator(self): - for record in self.enumerate_mft_records( + yield from self.enumerate_mft_records( self.context, self.config_path, self.config["primary"], self.parse_mft_records, - ): - yield record + ) def generate_timeline(self): for row in self._generator(): From 44e8ac645fe08de903df830b15eca32d006d8f50 Mon Sep 17 00:00:00 2001 From: Arthur Deierlein Date: Tue, 17 Dec 2024 22:59:04 +0100 Subject: [PATCH 0205/1352] chore: make ruff happy the import is not needed, was previously used for type annotations --- .../framework/plugins/windows/indirect_system_calls.py | 6 ------ 1 file changed, 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index f09851b30..dac0f9c4a 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -13,12 +13,6 @@ from volatility3.plugins.windows import pslist, direct_system_calls vollog = logging.getLogger(__name__) -try: - import capstone -except ImportError: - # The generator of DirectSystemCalls will bail with a warning if capstone is not installed - pass - class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): _required_framework_version = (2, 4, 0) From 0d7c2906eecadcc083e4919176350f113e6d8931 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Tue, 17 Dec 2024 16:01:51 -0600 Subject: [PATCH 0206/1352] #1324 - update pedump error messages --- volatility3/framework/plugins/windows/pedump.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 5b4bb07d7..d9ab39b4a 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -224,11 +224,11 @@ class PEDump(interfaces.plugins.PluginInterface): ) if self.config["kernel_module"] and self.config["pid"]: - vollog.error("Only --kernel_module or --pid should be set. Not both") + vollog.error("Only 'kernel-module' or 'pid' should be set, not both") return if not self.config["kernel_module"] and not self.config["pid"]: - vollog.error("--kernel_module or --pid must be set") + vollog.error("Either 'kernel-module' or 'pid' argument must be set") return if self.config["kernel_module"]: From e035faa32392bc27d20f4b7b0c01feb0e9da2210 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 09:55:13 +1100 Subject: [PATCH 0207/1352] bump framework minor version --- volatility3/framework/constants/_version.py | 2 +- volatility3/framework/plugins/linux/capabilities.py | 2 +- volatility3/framework/plugins/linux/envars.py | 2 +- volatility3/framework/plugins/linux/psaux.py | 2 +- volatility3/framework/plugins/linux/pslist.py | 2 +- volatility3/framework/plugins/linux/psscan.py | 2 +- volatility3/framework/plugins/linux/pstree.py | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 55ef19e4b..93e9c8432 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 12 # Number of changes that only add to the interface +VERSION_MINOR = 13 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index a06ee4c1b..afd91c48e 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -49,7 +49,7 @@ class CapabilitiesData: class Capabilities(plugins.PluginInterface): """Lists process capabilities""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 13, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index a3eb21cf5..aec3eeb14 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -16,7 +16,7 @@ vollog = logging.getLogger(__name__) class Envars(plugins.PluginInterface): """Lists processes with their environment variables""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 13, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/psaux.py b/volatility3/framework/plugins/linux/psaux.py index 5a4d75c70..60424a990 100644 --- a/volatility3/framework/plugins/linux/psaux.py +++ b/volatility3/framework/plugins/linux/psaux.py @@ -14,7 +14,7 @@ from volatility3.plugins.linux import pslist class PsAux(plugins.PluginInterface): """Lists processes with their command line arguments""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 13, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index edfc0688c..a6d2e6538 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -17,7 +17,7 @@ from volatility3.plugins.linux import elfs class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular linux memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 13, 0) _version = (3, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index 55e3778ab..2b20ce583 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -27,7 +27,7 @@ class DescExitStateEnum(Enum): class PsScan(interfaces.plugins.PluginInterface): """Scans for processes present in a particular linux image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 13, 0) _version = (1, 1, 0) @classmethod diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index 7ea9df3d6..c80cfbec7 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -12,7 +12,7 @@ class PsTree(interfaces.plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 13, 0) _version = (1, 1, 0) @classmethod From 9c587b037885489442c55525add1ab6bfb69b852 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 10:12:32 +1100 Subject: [PATCH 0208/1352] linux: testcases: improve existent testcases code and checks --- test/test_volatility.py | 89 ++++++++++++++++++----------------------- 1 file changed, 40 insertions(+), 49 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index b5910e1c8..300ab572c 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -334,84 +334,84 @@ def test_windows_vadyarascan_yara_string(image, volatility, python): def test_linux_pslist(image, volatility, python): rc, out, _err = runvol_plugin("linux.pslist.PsList", image, volatility, python) - out = out.lower() + assert rc == 0 + out = out.lower() assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) assert out.find(b"watchdog") != -1 assert out.count(b"\n") > 10 - assert rc == 0 def test_linux_check_idt(image, volatility, python): rc, out, _err = runvol_plugin( "linux.check_idt.Check_idt", image, volatility, python ) - out = out.lower() + assert rc == 0 + out = out.lower() assert out.count(b"__kernel__") >= 10 assert out.count(b"\n") > 10 - assert rc == 0 def test_linux_check_syscall(image, volatility, python): rc, out, _err = runvol_plugin( "linux.check_syscall.Check_syscall", image, volatility, python ) - out = out.lower() + assert rc == 0 + out = out.lower() assert out.find(b"sys_close") != -1 assert out.find(b"sys_open") != -1 assert out.count(b"\n") > 100 - assert rc == 0 def test_linux_lsmod(image, volatility, python): rc, out, _err = runvol_plugin("linux.lsmod.Lsmod", image, volatility, python) - out = out.lower() - assert out.count(b"\n") > 10 assert rc == 0 + out = out.lower() + assert out.count(b"\n") > 10 def test_linux_lsof(image, volatility, python): rc, out, _err = runvol_plugin("linux.lsof.Lsof", image, volatility, python) - out = out.lower() + assert rc == 0 + out = out.lower() assert out.count(b"socket:") >= 10 assert out.count(b"\n") > 35 - assert rc == 0 def test_linux_proc_maps(image, volatility, python): rc, out, _err = runvol_plugin("linux.proc.Maps", image, volatility, python) - out = out.lower() + assert rc == 0 + out = out.lower() assert out.count(b"anonymous mapping") >= 10 assert out.count(b"\n") > 100 - assert rc == 0 def test_linux_tty_check(image, volatility, python): rc, out, _err = runvol_plugin( "linux.tty_check.tty_check", image, volatility, python ) - out = out.lower() + assert rc == 0 + out = out.lower() assert out.find(b"__kernel__") != -1 assert out.count(b"\n") >= 5 - assert rc == 0 def test_linux_sockstat(image, volatility, python): rc, out, _err = runvol_plugin("linux.sockstat.Sockstat", image, volatility, python) + assert rc == 0 assert out.count(b"AF_UNIX") >= 354 assert out.count(b"AF_BLUETOOTH") >= 5 assert out.count(b"AF_INET") >= 32 assert out.count(b"AF_INET6") >= 20 assert out.count(b"AF_PACKET") >= 1 assert out.count(b"AF_NETLINK") >= 43 - assert rc == 0 def test_linux_library_list(image, volatility, python): @@ -423,49 +423,48 @@ def test_linux_library_list(image, volatility, python): pluginargs=["--pids", "2363"], ) + assert rc == 0 assert re.search( rb"NetworkManager\s2363\s0x7f52cdda0000\s/lib/x86_64-linux-gnu/libnss_files.so.2", out, ) assert out.count(b"\n") > 10 - assert rc == 0 def test_linux_pstree(image, volatility, python): rc, out, _err = runvol_plugin("linux.pstree.PsTree", image, volatility, python) - out = out.lower() + assert rc == 0 + out = out.lower() assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) assert out.count(b"\n") > 10 - assert rc == 0 def test_linux_pidhashtable(image, volatility, python): rc, out, _err = runvol_plugin( "linux.pidhashtable.PIDHashTable", image, volatility, python ) - out = out.lower() + assert rc == 0 + out = out.lower() assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) assert out.count(b"\n") > 10 - assert rc == 0 def test_linux_bash(image, volatility, python): rc, out, _err = runvol_plugin("linux.bash.Bash", image, volatility, python) - out = out.lower() - assert out.count(b"\n") > 10 assert rc == 0 + assert out.count(b"\n") > 10 def test_linux_boottime(image, volatility, python): rc, out, _err = runvol_plugin("linux.boottime.Boottime", image, volatility, python) - out = out.lower() - assert out.count(b"utc") >= 1 assert rc == 0 + out = out.lower() + assert out.count(b"utc") >= 1 def test_linux_capabilities(image, volatility, python): @@ -482,36 +481,33 @@ def test_linux_capabilities(image, volatility, python): # However, we can still check that the plugin requirements are met. return None - out = out.lower() - - assert out.count(b"\n") > 10 assert rc == 0 + assert out.count(b"\n") > 10 def test_linux_check_creds(image, volatility, python): - rc, _out, _err = runvol_plugin( + rc, out, _err = runvol_plugin( "linux.check_creds.Check_creds", image, volatility, python ) # linux-sample-1.bin has no processes sharing credentials. # This validates that plugin requirements are met and exceptions are not raised. assert rc == 0 + assert out.count(b"\n") >= 4 def test_linux_elfs(image, volatility, python): rc, out, _err = runvol_plugin("linux.elfs.Elfs", image, volatility, python) - out = out.lower() - assert out.count(b"\n") > 10 assert rc == 0 + assert out.count(b"\n") > 10 def test_linux_envars(image, volatility, python): rc, out, _err = runvol_plugin("linux.envars.Envars", image, volatility, python) - out = out.lower() - assert out.count(b"\n") > 10 assert rc == 0 + assert out.count(b"\n") > 10 def test_linux_kthreads(image, volatility, python): @@ -528,44 +524,42 @@ def test_linux_kthreads(image, volatility, python): # However, we can still check that the plugin requirements are met. return None - out = out.lower() - - assert out.count(b"\n") > 10 assert rc == 0 + assert out.count(b"\n") >= 4 def test_linux_malfind(image, volatility, python): - rc, _out, _err = runvol_plugin("linux.malfind.Malfind", image, volatility, python) + rc, out, _err = runvol_plugin("linux.malfind.Malfind", image, volatility, python) # linux-sample-1.bin has no process memory ranges with potential injected code. # This validates that plugin requirements are met and exceptions are not raised. assert rc == 0 + assert out.count(b"\n") >= 4 def test_linux_mountinfo(image, volatility, python): rc, out, _err = runvol_plugin( "linux.mountinfo.MountInfo", image, volatility, python ) - out = out.lower() - assert out.count(b"\n") > 10 assert rc == 0 + assert out.count(b"\n") > 10 def test_linux_psaux(image, volatility, python): rc, out, _err = runvol_plugin("linux.psaux.PsAux", image, volatility, python) - out = out.lower() - assert out.count(b"\n") > 50 assert rc == 0 + assert out.count(b"\n") > 50 def test_linux_ptrace(image, volatility, python): - rc, _out, _err = runvol_plugin("linux.ptrace.Ptrace", image, volatility, python) + rc, out, _err = runvol_plugin("linux.ptrace.Ptrace", image, volatility, python) - # linux-sample-1.bin has no processes being ptreaced. + # linux-sample-1.bin has no processes being ptraced. # This validates that plugin requirements are met and exceptions are not raised. assert rc == 0 + assert out.count(b"\n") >= 4 def test_linux_vmaregexscan(image, volatility, python): @@ -576,10 +570,9 @@ def test_linux_vmaregexscan(image, volatility, python): python, pluginargs=["--pid", "1", "--pattern", "\\x7fELF"], ) - out = out.lower() - assert out.count(b"\n") > 10 assert rc == 0 + assert out.count(b"\n") > 10 def test_linux_vmayarascan_yara_rule(image, volatility, python): @@ -613,9 +606,8 @@ def test_linux_vmayarascan_yara_rule(image, volatility, python): with contextlib.suppress(FileNotFoundError): os.remove(filename) - out = out.lower() - assert out.count(b"\n") > 4 assert rc == 0 + assert out.count(b"\n") > 4 def test_linux_vmayarascan_yara_string(image, volatility, python): @@ -626,10 +618,9 @@ def test_linux_vmayarascan_yara_string(image, volatility, python): python, pluginargs=["--pid", "1", "--yara-string", "ELF"], ) - out = out.lower() - assert out.count(b"\n") > 10 assert rc == 0 + assert out.count(b"\n") > 10 def test_linux_page_cache_files(image, volatility, python): @@ -640,8 +631,8 @@ def test_linux_page_cache_files(image, volatility, python): python, pluginargs=["--find", "/etc/passwd"], ) - out = out.lower() + assert rc == 0 assert out.count(b"\n") > 4 # inode_num inode_addr ... file_path From 69d291c644910b14c9ff07df83b24f23601f945d Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 10:16:59 +1100 Subject: [PATCH 0209/1352] linux: testcases: add 10 final test cases to achieve full plugin coverage --- test/test_volatility.py | 123 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 123 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index 300ab572c..4b0455596 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -640,7 +640,130 @@ def test_linux_page_cache_files(image, volatility, python): rb"146829\s0x88001ab5c270.*?/etc/passwd", out, ) + + +def test_linux_page_cache_inodepages(image, volatility, python): + + inode_address = hex(0x88001AB5C270) + inode_dump_filename = f"inode_{inode_address}.dmp" + try: + rc, out, _err = runvol_plugin( + "linux.pagecache.InodePages", + image, + volatility, + python, + pluginargs=["--inode", inode_address, "--dump"], + ) + + assert rc == 0 + assert out.count(b"\n") > 4 + + # PageVAddr PagePAddr MappingAddr .. DumpSafe + assert re.search( + rb"0xea000054c5f8\s0x18389000\s0x88001ab5c3b0.*?True", + out, + ) + assert os.path.exists(inode_dump_filename) + inode_contents = open(inode_dump_filename, "rb").read() + assert inode_contents.count(b"\n") > 30 + assert inode_contents.count(b"root:x:0:0:root:/root:/bin/bash") > 0 + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(inode_dump_filename) + + +def test_linux_check_afinfo(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.check_afinfo.Check_afinfo", image, volatility, python + ) + + # linux-sample-1.bin has no suspicious results. + # This validates that plugin requirements are met and exceptions are not raised. assert rc == 0 + assert out.count(b"\n") >= 4 + + +def test_linux_check_modules(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.check_modules.Check_modules", image, volatility, python + ) + + # linux-sample-1.bin has no suspicious results. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +def test_linux_ebpf_progs(image, volatility, python): + rc, out, err = runvol_plugin( + "linux.ebpf.EBPF", + image, + volatility, + python, + globalargs=["-vvv"], + ) + + if rc != 0 and err.count(b"Unsupported kernel") > 0: + # The linux-sample-1.bin kernel implementation isn't supported. + # However, we can still check that the plugin requirements are met. + return None + + assert rc == 0 + assert out.count(b"\n") > 4 + + +def test_linux_iomem(image, volatility, python): + rc, out, _err = runvol_plugin("linux.iomem.IOMem", image, volatility, python) + + assert rc == 0 + assert out.count(b"\n") > 100 + + +def test_linux_keyboard_notifiers(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.keyboard_notifiers.Keyboard_notifiers", image, volatility, python + ) + + # linux-sample-1.bin has no suspicious results for this plugin. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +def test_linux_kmesg(image, volatility, python): + rc, out, _err = runvol_plugin("linux.kmsg.Kmsg", image, volatility, python) + + assert rc == 0 + assert out.count(b"\n") > 100 + + +def test_linux_netfilter(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.netfilter.Netfilter", image, volatility, python + ) + + # linux-sample-1.bin has no suspicious results for this plugin. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +def test_linux_psscan(image, volatility, python): + rc, out, _err = runvol_plugin("linux.psscan.PsScan", image, volatility, python) + + assert rc == 0 + assert out.count(b"\n") > 100 + + +def test_linux_hidden_modules(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.hidden_modules.Hidden_modules", image, volatility, python + ) + + # linux-sample-1.bin has no hidden modules. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 # MAC From 9c0dcad7b13cca5b3d75b1977ad4ad4a963bb0f9 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 10:42:54 +1100 Subject: [PATCH 0210/1352] linux: page cache inodepages testcase: explicitly close the file to improve clarity for AI processing --- test/test_volatility.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 4b0455596..5bce07481 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -664,7 +664,8 @@ def test_linux_page_cache_inodepages(image, volatility, python): out, ) assert os.path.exists(inode_dump_filename) - inode_contents = open(inode_dump_filename, "rb").read() + with open(inode_dump_filename, "rb") as fp: + inode_contents = fp.read() assert inode_contents.count(b"\n") > 30 assert inode_contents.count(b"root:x:0:0:root:/root:/bin/bash") > 0 finally: From e8a73dfb2d5ae368c4af758739b5593643b6bd41 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 11:29:28 +1100 Subject: [PATCH 0211/1352] linux: envars plugin: Add function to retrieve environment variables for a specific task. Code improvements. --- volatility3/framework/plugins/linux/envars.py | 147 ++++++++++-------- 1 file changed, 84 insertions(+), 63 deletions(-) diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index aec3eeb14..bb6f52a7a 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -3,8 +3,9 @@ # import logging +from typing import Iterable, Tuple -from volatility3.framework import exceptions, renderers +from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -17,7 +18,7 @@ class Envars(plugins.PluginInterface): """Lists processes with their environment variables""" _required_framework_version = (2, 13, 0) - _version = (1, 1, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -39,76 +40,96 @@ class Envars(plugins.PluginInterface): ), ] + @staticmethod + def get_task_env_variables( + context: interfaces.context.ContextInterface, + task: interfaces.objects.ObjectInterface, + env_area_max_size: int = 8192, + ) -> Iterable[Tuple[str, str]]: + """Yields environment variables for a given task. + + Args: + context: The plugin's operational context. + task: The task object from which to extract environment variables. + + Yields: + Tuples of (key, value) representing each environment variable. + """ + + task_name = utility.array_to_string(task.comm) + task_pid = task.pid + env_start = task.mm.env_start + env_end = task.mm.env_end + env_area_size = env_end - env_start + if not (0 < env_area_size <= env_area_max_size): + vollog.debug( + f"Task {task_pid} {task_name} appears to have environment variables of size " + f"{env_area_size} bytes which fails the sanity checking, will not extract " + "any envars." + ) + return None + + # Get process layer to read envars from + proc_layer_name = task.add_process_layer() + if proc_layer_name is None: + return None + proc_layer = context.layers[proc_layer_name] + + # Ensure the entire buffer is readable to prevent relying on exception handling + if not proc_layer.is_valid(env_start, env_area_size): + # Not mapped / swapped out + vollog.debug( + f"Unable to read environment variables for {task_pid} {task_name} starting at " + f" virtual address 0x{env_start:x} for {env_area_size} bytes, will not " + "extract any envars." + ) + return None + + # Read the full task environment variable buffer. + envar_data = proc_layer.read(env_start, env_area_size) + + # Parse envar data, envars are null terminated, keys and values are separated by '=' + envar_data = envar_data.rstrip(b"\x00") + for envar_pair in envar_data.split(b"\x00"): + try: + env_key, env_value = envar_pair.decode().split("=", 1) + except ValueError: + # Some legitimate programs, like 'avahi-daemon', avoid reallocating the args + # and instead exploit the fact that the environment variables area is contiguous + # to the args. This allows them to include a longer process name in the listing, + # causing overwrites and incorrect results. In such cases, it's better to abort + # the current task rather than displaying misleading or incorrect output. + break + + yield env_key, env_value + def _generator(self, tasks): """Generates a listing of processes along with environment variables""" # walk the process list and return the envars for task in tasks: - pid = task.pid - - # get process name as string - name = utility.array_to_string(task.comm) - ppid = task.get_parent_pid() - - # kernel threads never have an mm as they do not have userland mappings - try: - mm = task.mm - except exceptions.InvalidAddressException: - # no mm so cannot get envars - vollog.debug( - f"Unable to access mm for task {pid} {name} it is likely a kernel thread, will not extract any envars." - ) - mm = None + if task.is_kernel_thread: continue - # if mm exists attempt to get envars - if mm: - # get process layer to read envars from - proc_layer_name = task.add_process_layer() - if proc_layer_name is None: - vollog.debug( - f"Unable to construct process layer for task {pid} {name}, will not extract any envars." - ) - continue - proc_layer = self.context.layers[proc_layer_name] + task_pid = task.pid + task_name = utility.array_to_string(task.comm) + task_ppid = task.get_parent_pid() - # get the size of the envars with sanity checking - envars_size = task.mm.env_end - task.mm.env_start - if not (0 < envars_size <= 8192): - vollog.debug( - f"Task {pid} {name} appears to have envars of size {envars_size} bytes which fails the sanity checking, will not extract any envars." - ) - continue - - # attempt to read all envars data - try: - envar_data = proc_layer.read(task.mm.env_start, envars_size) - except exceptions.InvalidAddressException: - vollog.debug( - f"Unable to read full envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)} for {envars_size} bytes, will not extract any envars." - ) - continue - - # parse envar data, envars are null terminated, keys and values are separated by '=' - envar_data = envar_data.rstrip(b"\x00") - for envar_pair in envar_data.split(b"\x00"): - try: - key, value = envar_pair.decode().split("=", 1) - except ValueError: - vollog.debug( - f"Unable to extract envars for {pid} {name} starting at virtual offset {hex(task.mm.env_start)}, they don't appear to be '=' separated" - ) - continue - yield (0, (pid, ppid, name, key, value)) + for env_key, env_value in self.get_task_env_variables(self.context, task): + yield (0, (task_pid, task_ppid, task_name, env_key, env_value)) def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - - return renderers.TreeGrid( - [("PID", int), ("PPID", int), ("COMM", str), ("KEY", str), ("VALUE", str)], - self._generator( - pslist.PsList.list_tasks( - self.context, self.config["kernel"], filter_func=filter_func - ) - ), + tasks = pslist.PsList.list_tasks( + self.context, self.config["kernel"], filter_func=filter_func ) + + headers = [ + ("PID", int), + ("PPID", int), + ("COMM", str), + ("KEY", str), + ("VALUE", str), + ] + + return renderers.TreeGrid(headers, self._generator(tasks)) From e231d826a96f416e988b6f35d5a180e2d9342579 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 11:38:51 +1100 Subject: [PATCH 0212/1352] linux: envars plugin: Complete get_task_env_variables() docstring --- volatility3/framework/plugins/linux/envars.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index bb6f52a7a..05ce17f8a 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -51,6 +51,8 @@ class Envars(plugins.PluginInterface): Args: context: The plugin's operational context. task: The task object from which to extract environment variables. + env_area_max_size: Maximum allowable size for the environment variables area. + Tasks exceeding this size will be skipped. Default is 8192. Yields: Tuples of (key, value) representing each environment variable. From d934d4421b94c3d7285cc1594830bf84c4846373 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 12:02:14 +1100 Subject: [PATCH 0213/1352] linux: get_parent_pid: Fix parent ID to correctly mimic getppid() syscall behavior by using TGID instead of PID --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 7b025450c..3c26805b7 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -641,7 +641,7 @@ class task_struct(generic.GenericIntelProcess): """ if self.real_parent and self.real_parent.is_readable(): - ppid = self.real_parent.pid + ppid = self.real_parent.tgid else: ppid = 0 From 2de553e1c17eab61cc566308cdabe9f9ba60b4ed Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 15:25:07 +1100 Subject: [PATCH 0214/1352] linux: cred: add user identifiers to the cred object extension --- .../symbols/linux/extensions/__init__.py | 31 +++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 7b025450c..2c6d9147d 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2079,13 +2079,40 @@ class cred(objects.StructType): return int(value) @property - def euid(self): + def uid(self) -> int: + """Returns the real user ID + + Returns: + The real user ID value + """ + return self._get_cred_int_value("uid") + + @property + def gid(self) -> int: + """Returns the real user ID + + Returns: + The real user ID value + """ + return self._get_cred_int_value("gid") + + @property + def euid(self) -> int: """Returns the effective user ID + Returns: + The effective user ID value + """ + return self._get_cred_int_value("euid") + + @property + def egid(self) -> int: + """Returns the effective group ID + Returns: int: the effective user ID value """ - return self._get_cred_int_value("euid") + return self._get_cred_int_value("egid") class kernel_cap_struct(objects.StructType): From 448ba24eac7bb11aba30d9f3e4d0dedcd9246d43 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 15:53:07 +1100 Subject: [PATCH 0215/1352] linux: pslist: add user/group , real/effective identifiers to the output: uid,gid, euid and egid. We reimplemented get_task_fields() using a dataclass, reducing the size of the function's interface and preventing unbounded growth. This change simplifies future modifications and enhances maintainability. --- volatility3/framework/plugins/linux/pslist.py | 86 +++++++++++++------ 1 file changed, 61 insertions(+), 25 deletions(-) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index a6d2e6538..2244b91ce 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -2,7 +2,9 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime -from typing import Any, Callable, Iterable, List, Tuple +import dataclasses +import contextlib +from typing import Any, Callable, Iterable, List, Optional from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements @@ -14,11 +16,25 @@ from volatility3.plugins import timeliner from volatility3.plugins.linux import elfs +@dataclasses.dataclass +class TaskFields: + offset: int + user_pid: int + user_tid: int + user_ppid: int + name: str + uid: Optional[int] + gid: Optional[int] + euid: Optional[int] + egid: Optional[int] + creation_time: Optional[datetime.datetime] + + class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular linux memory image.""" _required_framework_version = (2, 13, 0) - _version = (3, 1, 0) + _version = (4, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -82,7 +98,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def get_task_fields( cls, task: interfaces.objects.ObjectInterface, decorate_comm: bool = False - ) -> Tuple[int, int, int, int, str, datetime.datetime]: + ) -> TaskFields: """Extract the fields needed for the final output Args: @@ -91,21 +107,34 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): and of Kernel threads in square brackets. Defaults to False. Returns: - A tuple with the fields to show in the plugin output. + A TaskFields object with the fields to show in the plugin output. """ - pid = task.tgid - tid = task.pid - ppid = task.get_parent_pid() name = utility.array_to_string(task.comm) - start_time = task.get_create_time() if decorate_comm: if task.is_kernel_thread: name = f"[{name}]" elif task.is_user_thread: name = f"{{{name}}}" - task_fields = (task.vol.offset, pid, tid, ppid, name, start_time) - return task_fields + # This function may be called with a partially initialized/uninitialized task. + # Ensure it always returns a valid TaskFields object, ready for use in a plugin. + valid_cred = task.cred and task.cred.is_readable() + creation_time = None + with contextlib.suppress(Exception): + creation_time = task.get_create_time() + + return TaskFields( + offset=task.vol.offset, + user_pid=task.tgid, + user_tid=task.pid, + user_ppid=task.get_parent_pid(), + name=name, + uid=task.cred.uid if valid_cred else None, + gid=task.cred.gid if valid_cred else None, + euid=task.cred.euid if valid_cred else None, + egid=task.cred.egid if valid_cred else None, + creation_time=creation_time, + ) def _get_file_output(self, task: interfaces.objects.ObjectInterface) -> str: """Extract the elf for the process if requested @@ -179,17 +208,19 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): else: file_output = "Disabled" - offset, pid, tid, ppid, name, creation_time = self.get_task_fields( - task, decorate_comm - ) + task_fields = self.get_task_fields(task, decorate_comm) yield 0, ( - format_hints.Hex(offset), - pid, - tid, - ppid, - name, - creation_time or renderers.NotAvailableValue(), + format_hints.Hex(task_fields.offset), + task_fields.user_pid, + task_fields.user_tid, + task_fields.user_ppid, + task_fields.name, + task_fields.uid, + task_fields.gid, + task_fields.euid, + task_fields.egid, + task_fields.creation_time or renderers.NotAvailableValue(), file_output, ) @@ -238,6 +269,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ("TID", int), ("PPID", int), ("COMM", str), + ("UID", int), + ("GID", int), + ("EUID", int), + ("EGID", int), ("CREATION TIME", datetime.datetime), ("File output", str), ] @@ -251,10 +286,11 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): for task in self.list_tasks( self.context, self.config["kernel"], filter_func, include_threads=True ): - offset, user_pid, user_tid, _user_ppid, name, creation_time = ( - self.get_task_fields(task) + task_fields = self.get_task_fields(task) + description = f"Process {task_fields.user_pid}/{task_fields.user_tid} {task_fields.name} ({task_fields.offset})" + + yield ( + description, + timeliner.TimeLinerType.CREATED, + task_fields.creation_time, ) - - description = f"Process {user_pid}/{user_tid} {name} ({offset})" - - yield (description, timeliner.TimeLinerType.CREATED, creation_time) From 8e12cf02e3720c3c58df6a3fb66930278d797b38 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 15:56:55 +1100 Subject: [PATCH 0216/1352] linux: psscan: reimplemented to make use of pslist.get_task_fields() --- volatility3/framework/plugins/linux/psscan.py | 49 +++++++------------ 1 file changed, 18 insertions(+), 31 deletions(-) diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index c93f06088..ba68c4856 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -2,15 +2,15 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import Iterable, List, Tuple +from typing import Iterable, List import struct from enum import Enum from volatility3.framework import renderers, interfaces, symbols, constants, exceptions from volatility3.framework.configuration import requirements -from volatility3.framework.objects import utility from volatility3.framework.layers import scanners from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) @@ -28,7 +28,7 @@ class PsScan(interfaces.plugins.PluginInterface): """Scans for processes present in a particular linux image.""" _required_framework_version = (2, 13, 0) - _version = (1, 1, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -38,34 +38,11 @@ class PsScan(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + ), ] - def _get_task_fields( - self, task: interfaces.objects.ObjectInterface - ) -> Tuple[int, int, int, str, str]: - """Extract the fields needed for the final output - - Args: - task: A task object from where to get the fields. - Returns: - A tuple with the fields to show in the plugin output. - """ - pid = task.tgid - tid = task.pid - ppid = task.get_parent_pid() - name = utility.array_to_string(task.comm) - exit_state = DescExitStateEnum(task.exit_state).name - - task_fields = ( - format_hints.Hex(task.vol.offset), - pid, - tid, - ppid, - name, - exit_state, - ) - return task_fields - def _generator(self): """Generates the tasks found from scanning.""" @@ -75,8 +52,18 @@ class PsScan(interfaces.plugins.PluginInterface): for task in self.scan_tasks( self.context, vmlinux_module_name, vmlinux.layer_name ): - row = self._get_task_fields(task) - yield (0, row) + task_fields = pslist.PsList.get_task_fields(task) + exit_state = DescExitStateEnum(task.exit_state).name + fields = ( + format_hints.Hex(task_fields.offset), + task_fields.user_pid, + task_fields.user_tid, + task_fields.user_ppid, + task_fields.name, + exit_state, + ) + + yield (0, fields) @classmethod def scan_tasks( From 40bdbf62daec2047f7c0e1bc06a5feb85b10ca77 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 16:00:14 +1100 Subject: [PATCH 0217/1352] linux: pidhashtable: Update to use TaskFields from pslist.get_task_fields(). Fix some type annotations --- .../framework/plugins/linux/pidhashtable.py | 22 ++++++++++--------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/linux/pidhashtable.py b/volatility3/framework/plugins/linux/pidhashtable.py index 2d210c233..060b3928e 100644 --- a/volatility3/framework/plugins/linux/pidhashtable.py +++ b/volatility3/framework/plugins/linux/pidhashtable.py @@ -3,7 +3,7 @@ # import logging -from typing import List +from typing import List, Iterable from volatility3.framework import renderers, interfaces, constants from volatility3.framework.symbols import linux @@ -19,7 +19,7 @@ class PIDHashTable(plugins.PluginInterface): """Enumerates processes through the PID hash table""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 2) + _version = (1, 0, 3) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -30,7 +30,7 @@ class PIDHashTable(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) @@ -218,7 +218,7 @@ class PIDHashTable(plugins.PluginInterface): return None - def get_tasks(self) -> interfaces.objects.ObjectInterface: + def get_tasks(self) -> Iterable[interfaces.objects.ObjectInterface]: """Enumerates processes through the PID hash table Yields: @@ -231,14 +231,16 @@ class PIDHashTable(plugins.PluginInterface): yield from sorted(pid_func(), key=lambda t: (t.tgid, t.pid)) - def _generator( - self, decorate_comm: bool = False - ) -> interfaces.objects.ObjectInterface: + def _generator(self, decorate_comm: bool = False): for task in self.get_tasks(): - offset, pid, tid, ppid, name, _creation_time = ( - pslist.PsList.get_task_fields(task, decorate_comm) + task_fields = pslist.PsList.get_task_fields(task, decorate_comm) + fields = ( + format_hints.Hex(task_fields.offset), + task_fields.user_pid, + task_fields.user_tid, + task_fields.user_ppid, + task_fields.name, ) - fields = format_hints.Hex(offset), pid, tid, ppid, name yield 0, fields def run(self): From f3cf182206cd00fd70742c304ce48dbfe80ba246 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 16:00:50 +1100 Subject: [PATCH 0218/1352] linux: pstree: Update to use TaskFields from pslist.get_task_fields() --- volatility3/framework/plugins/linux/pstree.py | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index c80cfbec7..74e172139 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -13,7 +13,7 @@ class PsTree(interfaces.plugins.PluginInterface): ID.""" _required_framework_version = (2, 13, 0) - _version = (1, 1, 0) + _version = (1, 1, 1) @classmethod def get_requirements(cls): @@ -25,7 +25,7 @@ class PsTree(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", @@ -101,13 +101,17 @@ class PsTree(interfaces.plugins.PluginInterface): def yield_processes(pid): task = self._tasks[pid] - offset, pid, tid, ppid, name, _creation_time = ( - pslist.PsList.get_task_fields(task, decorate_comm) + task_fields = pslist.PsList.get_task_fields(task, decorate_comm) + fields = ( + format_hints.Hex(task_fields.offset), + task_fields.user_pid, + task_fields.user_tid, + task_fields.user_ppid, + task_fields.name, ) - fields = format_hints.Hex(offset), pid, tid, ppid, name - yield (self._levels[tid] - 1, fields) + yield (self._levels[task_fields.user_tid] - 1, fields) - for child_pid in sorted(self._children.get(tid, [])): + for child_pid in sorted(self._children.get(task_fields.user_tid, [])): yield from yield_processes(child_pid) for pid, level in self._levels.items(): From e92b55ac862ad1f8df2a7a10bbf2b542eb26b6cb Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 16:03:46 +1100 Subject: [PATCH 0219/1352] linux: Update version requirements in all plugins dependent on pslist --- volatility3/framework/plugins/linux/bash.py | 4 ++-- volatility3/framework/plugins/linux/boottime.py | 4 ++-- volatility3/framework/plugins/linux/capabilities.py | 4 ++-- volatility3/framework/plugins/linux/check_creds.py | 4 ++-- volatility3/framework/plugins/linux/elfs.py | 4 ++-- volatility3/framework/plugins/linux/envars.py | 4 ++-- volatility3/framework/plugins/linux/kthreads.py | 4 ++-- volatility3/framework/plugins/linux/library_list.py | 4 ++-- volatility3/framework/plugins/linux/lsof.py | 4 ++-- volatility3/framework/plugins/linux/malfind.py | 4 ++-- volatility3/framework/plugins/linux/mountinfo.py | 4 ++-- volatility3/framework/plugins/linux/proc.py | 4 ++-- volatility3/framework/plugins/linux/psaux.py | 4 ++-- volatility3/framework/plugins/linux/ptrace.py | 4 ++-- volatility3/framework/plugins/linux/sockstat.py | 4 ++-- volatility3/framework/plugins/linux/vmaregexscan.py | 4 ++-- volatility3/framework/plugins/linux/vmayarascan.py | 4 ++-- 17 files changed, 34 insertions(+), 34 deletions(-) diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 77a433a3b..056e3cd51 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -22,7 +22,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): """Recovers bash command history from memory.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -33,7 +33,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/boottime.py b/volatility3/framework/plugins/linux/boottime.py index 56de52883..c57bdd65a 100644 --- a/volatility3/framework/plugins/linux/boottime.py +++ b/volatility3/framework/plugins/linux/boottime.py @@ -15,7 +15,7 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) """Shows the time the system was started""" _required_framework_version = (2, 11, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -26,7 +26,7 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index afd91c48e..1d0c60c11 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -50,7 +50,7 @@ class Capabilities(plugins.PluginInterface): """Lists process capabilities""" _required_framework_version = (2, 13, 0) - _version = (1, 1, 0) + _version = (1, 1, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -61,7 +61,7 @@ class Capabilities(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pids", diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index 4916b67d2..96f77ce4d 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -12,7 +12,7 @@ class Check_creds(interfaces.plugins.PluginInterface): """Checks if any processes are sharing credential structures""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + _version = (2, 0, 2) @classmethod def get_requirements(cls): @@ -23,7 +23,7 @@ class Check_creds(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index 9f3bd274b..2fd740941 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -25,7 +25,7 @@ class Elfs(plugins.PluginInterface): """Lists all memory mapped ELF files for all processes.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 2) + _version = (2, 0, 3) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -36,7 +36,7 @@ class Elfs(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index aec3eeb14..9f29ef74e 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -17,7 +17,7 @@ class Envars(plugins.PluginInterface): """Lists processes with their environment variables""" _required_framework_version = (2, 13, 0) - _version = (1, 1, 0) + _version = (1, 1, 1) @classmethod def get_requirements(cls): @@ -29,7 +29,7 @@ class Envars(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index b9ced73f3..40e992069 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -20,7 +20,7 @@ class Kthreads(plugins.PluginInterface): """Enumerates kthread functions""" _required_framework_version = (2, 11, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -34,7 +34,7 @@ class Kthreads(plugins.PluginInterface): name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/library_list.py b/volatility3/framework/plugins/linux/library_list.py index 7ec1f7f7f..e251b5689 100644 --- a/volatility3/framework/plugins/linux/library_list.py +++ b/volatility3/framework/plugins/linux/library_list.py @@ -21,7 +21,7 @@ class LibraryList(interfaces.plugins.PluginInterface): """Enumerate libraries loaded into processes""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls): @@ -32,7 +32,7 @@ class LibraryList(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pids", diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 802954f43..daa8e5a3d 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -110,7 +110,7 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists open files for each processes.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + _version = (2, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -121,7 +121,7 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 0b10e60c6..e45688e97 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -18,7 +18,7 @@ class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -29,7 +29,7 @@ class Malfind(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index 65775c4aa..b4f80e4f5 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -36,7 +36,7 @@ class MountInfo(plugins.PluginInterface): """Lists mount points on processes mount namespaces""" _required_framework_version = (2, 2, 0) - _version = (1, 2, 2) + _version = (1, 2, 3) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -47,7 +47,7 @@ class MountInfo(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 893eea71e..441c6bc93 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -21,7 +21,7 @@ class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) MAXSIZE_DEFAULT = 1024 * 1024 * 1024 # 1 Gb @@ -35,7 +35,7 @@ class Maps(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/psaux.py b/volatility3/framework/plugins/linux/psaux.py index 60424a990..a544c9d67 100644 --- a/volatility3/framework/plugins/linux/psaux.py +++ b/volatility3/framework/plugins/linux/psaux.py @@ -15,7 +15,7 @@ class PsAux(plugins.PluginInterface): """Lists processes with their command line arguments""" _required_framework_version = (2, 13, 0) - _version = (1, 1, 0) + _version = (1, 1, 1) @classmethod def get_requirements(cls): @@ -27,7 +27,7 @@ class PsAux(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/ptrace.py b/volatility3/framework/plugins/linux/ptrace.py index 271c0e75e..6493f22b9 100644 --- a/volatility3/framework/plugins/linux/ptrace.py +++ b/volatility3/framework/plugins/linux/ptrace.py @@ -19,7 +19,7 @@ class Ptrace(plugins.PluginInterface): """Enumerates ptrace's tracer and tracee tasks""" _required_framework_version = (2, 10, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -30,7 +30,7 @@ class Ptrace(plugins.PluginInterface): architectures=architectures.LINUX_ARCHS, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index aee0b1e2e..7376bcbee 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -438,7 +438,7 @@ class Sockstat(plugins.PluginInterface): """Lists all network connections for all processes.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 1) + _version = (3, 0, 2) @classmethod def get_requirements(cls): @@ -455,7 +455,7 @@ class Sockstat(plugins.PluginInterface): name="lsof", plugin=lsof.Lsof, version=(2, 0, 0) ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/vmaregexscan.py b/volatility3/framework/plugins/linux/vmaregexscan.py index 4446fc550..8fb96da1e 100644 --- a/volatility3/framework/plugins/linux/vmaregexscan.py +++ b/volatility3/framework/plugins/linux/vmaregexscan.py @@ -21,7 +21,7 @@ class VmaRegExScan(plugins.PluginInterface): """Scans all virtual memory areas for tasks using RegEx.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) MAXSIZE_DEFAULT = 128 @@ -35,7 +35,7 @@ class VmaRegExScan(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 650fcf078..4db23e50b 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -18,7 +18,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): """Scans all virtual memory areas for tasks using yara.""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -31,7 +31,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.PluginRequirement( name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) From ddb4db5eab4d5e6a9e9ea40b81339be89a8be4cc Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 18 Dec 2024 16:22:27 +1100 Subject: [PATCH 0220/1352] linux: pslist: Handle cases where credential IDs are unavailable due to an invalid credential pointer --- volatility3/framework/plugins/linux/pslist.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 2244b91ce..641a27b92 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -216,10 +216,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): task_fields.user_tid, task_fields.user_ppid, task_fields.name, - task_fields.uid, - task_fields.gid, - task_fields.euid, - task_fields.egid, + task_fields.uid or renderers.NotAvailableValue(), + task_fields.gid or renderers.NotAvailableValue(), + task_fields.euid or renderers.NotAvailableValue(), + task_fields.egid or renderers.NotAvailableValue(), task_fields.creation_time or renderers.NotAvailableValue(), file_output, ) From 3da14b3873a3f19e291e21b79735ae4a8c5794a8 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Wed, 18 Dec 2024 06:40:19 +0000 Subject: [PATCH 0221/1352] Use generator expressions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PEP 289 – Generator Expressions. --- volatility3/cli/text_renderer.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 937ba4ef4..b1944ae5a 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -176,7 +176,7 @@ class QuickTextRenderer(CLIRenderer): format_hints.HexBytes: optional(hex_bytes_as_text), format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), interfaces.renderers.Disassembly: optional(display_disassembly), - bytes: optional(lambda x: " ".join([f"{b:02x}" for b in x])), + bytes: optional(lambda x: " ".join(f"{b:02x}" for b in x)), datetime.datetime: optional(lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z")), "default": optional(lambda x: f"{x}"), } @@ -256,7 +256,7 @@ class CSVRenderer(CLIRenderer): format_hints.HexBytes: optional(hex_bytes_as_text), format_hints.MultiTypeData: optional(multitypedata_as_text), interfaces.renderers.Disassembly: optional(display_disassembly), - bytes: optional(lambda x: " ".join([f"{b:02x}" for b in x])), + bytes: optional(lambda x: " ".join(f"{b:02x}" for b in x)), datetime.datetime: optional(lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z")), "default": optional(lambda x: f"{x}"), } @@ -450,7 +450,7 @@ class JsonRenderer(CLIRenderer): format_hints.HexBytes: quoted_optional(hex_bytes_as_text), interfaces.renderers.Disassembly: quoted_optional(display_disassembly), format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), - bytes: optional(lambda x: " ".join([f"{b:02x}" for b in x])), + bytes: optional(lambda x: " ".join(f"{b:02x}" for b in x)), datetime.datetime: lambda x: ( x.isoformat() if not isinstance(x, interfaces.renderers.BaseAbsentValue) From 860a8146fbd529da524bac2282fb00a31b3568bc Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Wed, 18 Dec 2024 06:44:23 +0000 Subject: [PATCH 0222/1352] Use floor division --- volatility3/framework/layers/msf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/msf.py b/volatility3/framework/layers/msf.py index 8d84a774b..03e144e25 100644 --- a/volatility3/framework/layers/msf.py +++ b/volatility3/framework/layers/msf.py @@ -225,7 +225,7 @@ class PdbMSFStream(linear.LinearlyMappedLayer): returned = 0 page_size = self._pdb_layer.page_size while length > 0: - page = math.floor((offset + returned) / page_size) + page = (offset + returned) // page_size page_position = (offset + returned) % page_size chunk_size = min(page_size - page_position, length) if page >= self._pages_len: From d7f678879d8982b1222e6f5676caed4b0e5a9f70 Mon Sep 17 00:00:00 2001 From: TheMythologist Date: Wed, 18 Dec 2024 15:17:26 +0800 Subject: [PATCH 0223/1352] Minor improvements for `mypy` --- pyproject.toml | 3 ++- volatility3/cli/__init__.py | 6 ++--- volatility3/cli/text_filter.py | 2 +- volatility3/cli/volshell/generic.py | 10 ++++---- volatility3/cli/volshell/linux.py | 6 ++--- volatility3/cli/volshell/mac.py | 6 ++--- volatility3/cli/volshell/windows.py | 6 ++--- volatility3/framework/__init__.py | 7 +++--- volatility3/framework/automagic/stacker.py | 4 +++- .../framework/automagic/symbol_cache.py | 9 +++++++ .../framework/configuration/requirements.py | 24 +++++++++---------- volatility3/framework/contexts/__init__.py | 2 +- volatility3/framework/interfaces/automagic.py | 2 +- .../framework/interfaces/configuration.py | 7 +++--- volatility3/framework/interfaces/context.py | 14 +++++++++-- volatility3/framework/interfaces/layers.py | 2 +- volatility3/framework/interfaces/objects.py | 1 + volatility3/framework/interfaces/renderers.py | 4 ++-- volatility3/framework/interfaces/symbols.py | 1 + .../framework/layers/scanners/__init__.py | 2 +- volatility3/framework/objects/__init__.py | 6 ++--- volatility3/framework/plugins/linux/pslist.py | 6 +++-- volatility3/framework/plugins/mac/pslist.py | 6 +++-- volatility3/framework/plugins/timeliner.py | 4 +++- .../framework/plugins/windows/modules.py | 4 ++-- .../framework/plugins/windows/pedump.py | 2 +- .../framework/plugins/windows/poolscanner.py | 2 +- .../framework/plugins/windows/pslist.py | 6 ++--- .../framework/plugins/windows/psscan.py | 2 +- .../plugins/windows/registry/printkey.py | 10 ++++---- .../plugins/windows/scheduled_tasks.py | 1 - volatility3/framework/renderers/__init__.py | 2 +- volatility3/framework/symbols/__init__.py | 8 +++---- .../framework/symbols/generic/__init__.py | 6 ++--- volatility3/framework/symbols/intermed.py | 4 ++-- .../symbols/linux/extensions/__init__.py | 2 +- volatility3/framework/symbols/mac/__init__.py | 4 ++-- .../symbols/mac/extensions/__init__.py | 2 +- volatility3/framework/symbols/metadata.py | 2 +- .../symbols/windows/extensions/__init__.py | 4 +++- .../symbols/windows/extensions/pool.py | 2 +- .../framework/symbols/windows/pdbconv.py | 4 +++- .../framework/symbols/windows/pdbutil.py | 14 +++++------ 43 files changed, 127 insertions(+), 94 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 7035f7a15..cc09922e9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -32,6 +32,7 @@ dev = [ "jsonschema>=4.23.0,<5", "pyinstaller>=6.11.0,<7", "pyinstaller-hooks-contrib>=2024.9", + "types-jsonschema>=4.23.0,<5", ] test = [ @@ -68,7 +69,7 @@ include = ["volatility3*"] mypy_path = "./stubs" show_traceback = true -[tool.mypy.overrides] +[[tool.mypy.overrides]] ignore_missing_imports = true [tool.ruff] diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index da046de57..6172a17f3 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -19,7 +19,7 @@ import os import sys import tempfile import traceback -from typing import Any, Dict, List, Tuple, Type, Union +from typing import Any, Dict, List, Optional, Tuple, Type, Union from urllib import parse, request try: @@ -64,7 +64,7 @@ class PrintedProgress: def __init__(self): self._max_message_len = 0 - def __call__(self, progress: Union[int, float], description: str = None): + def __call__(self, progress: Union[int, float], description: Optional[str] = None): """A simple function for providing text-based feedback. .. warning:: Only for development use. @@ -81,7 +81,7 @@ class PrintedProgress: class MuteProgress(PrintedProgress): """A dummy progress handler that produces no output when called.""" - def __call__(self, progress: Union[int, float], description: str = None): + def __call__(self, progress: Union[int, float], description: Optional[str] = None): pass diff --git a/volatility3/cli/text_filter.py b/volatility3/cli/text_filter.py index 955d647f5..6bd6878a5 100644 --- a/volatility3/cli/text_filter.py +++ b/volatility3/cli/text_filter.py @@ -74,7 +74,7 @@ class ColumnFilter: """Identifies whether an item is found in the appropriate column""" try: if self.regex: - return re.search(self.pattern, f"{item}") + return bool(re.search(self.pattern, f"{item}")) return self.pattern in f"{item}" except OSError: return False diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 93a75ca19..12f5499f6 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -240,7 +240,7 @@ class Volshell(interfaces.plugins.PluginInterface): return None return self.context.modules[self.current_kernel_name] - def change_layer(self, layer_name: str = None): + def change_layer(self, layer_name: Optional[str] = None): """Changes the current default layer""" if not layer_name: layer_name = self.current_layer @@ -250,7 +250,7 @@ class Volshell(interfaces.plugins.PluginInterface): self.__current_layer = layer_name sys.ps1 = f"({self.current_layer}) >>> " - def change_symbol_table(self, symbol_table_name: str = None): + def change_symbol_table(self, symbol_table_name: Optional[str] = None): """Changes the current_symbol_table""" if not symbol_table_name: print("No symbol table provided, not changing current symbol table") @@ -262,7 +262,7 @@ class Volshell(interfaces.plugins.PluginInterface): self.__current_symbol_table = symbol_table_name print(f"Current Symbol Table: {self.current_symbol_table}") - def change_kernel(self, kernel_name: str = None): + def change_kernel(self, kernel_name: Optional[str] = None): if not kernel_name: print("No kernel module name provided, not changing current kernel") if kernel_name not in self.context.modules: @@ -347,7 +347,7 @@ class Volshell(interfaces.plugins.PluginInterface): object: Union[ str, interfaces.objects.ObjectInterface, interfaces.objects.Template ], - offset: int = None, + offset: Optional[int] = None, ): """Display Type describes the members of a particular object in alphabetical order""" if not isinstance( @@ -479,7 +479,7 @@ class Volshell(interfaces.plugins.PluginInterface): if treegrid is not None: self.render_treegrid(treegrid) - def display_symbols(self, symbol_table: str = None): + def display_symbols(self, symbol_table: Optional[str] = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: print("No symbol table provided") diff --git a/volatility3/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py index c5e555ec7..41b86f78b 100644 --- a/volatility3/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Any, List, Tuple, Union +from typing import Any, List, Optional, Tuple, Union from volatility3.cli.volshell import generic from volatility3.framework import constants, interfaces @@ -61,7 +61,7 @@ class Volshell(generic.Volshell): object: Union[ str, interfaces.objects.ObjectInterface, interfaces.objects.Template ], - offset: int = None, + offset: Optional[int] = None, ): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): @@ -69,7 +69,7 @@ class Volshell(generic.Volshell): object = self.current_symbol_table + constants.BANG + object return super().display_type(object, offset) - def display_symbols(self, symbol_table: str = None): + def display_symbols(self, symbol_table: Optional[str] = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: symbol_table = self.current_symbol_table diff --git a/volatility3/cli/volshell/mac.py b/volatility3/cli/volshell/mac.py index 2b32ad677..0ed35eb27 100644 --- a/volatility3/cli/volshell/mac.py +++ b/volatility3/cli/volshell/mac.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Any, List, Tuple, Union +from typing import Any, List, Optional, Tuple, Union from volatility3.cli.volshell import generic from volatility3.framework import constants, interfaces @@ -63,7 +63,7 @@ class Volshell(generic.Volshell): object: Union[ str, interfaces.objects.ObjectInterface, interfaces.objects.Template ], - offset: int = None, + offset: Optional[int] = None, ): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): @@ -71,7 +71,7 @@ class Volshell(generic.Volshell): object = self.current_symbol_table + constants.BANG + object return super().display_type(object, offset) - def display_symbols(self, symbol_table: str = None): + def display_symbols(self, symbol_table: Optional[str] = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: symbol_table = self.current_symbol_table diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index 5c2190c02..303d4d5c3 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Any, List, Tuple, Union +from typing import Any, List, Optional, Tuple, Union from volatility3.cli.volshell import generic from volatility3.framework import constants, interfaces @@ -60,7 +60,7 @@ class Volshell(generic.Volshell): object: Union[ str, interfaces.objects.ObjectInterface, interfaces.objects.Template ], - offset: int = None, + offset: Optional[int] = None, ): """Display Type describes the members of a particular object in alphabetical order""" if isinstance(object, str): @@ -68,7 +68,7 @@ class Volshell(generic.Volshell): object = self.current_symbol_table + constants.BANG + object return super().display_type(object, offset) - def display_symbols(self, symbol_table: str = None): + def display_symbols(self, symbol_table: Optional[str] = None): """Prints an alphabetical list of symbols for a symbol table""" if symbol_table is None: symbol_table = self.current_symbol_table diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index c9a2c92ea..754939460 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -12,7 +12,7 @@ import inspect import logging import os import traceback -from typing import Any, Dict, Generator, List, Tuple, Type, TypeVar +from typing import Any, Dict, Generator, List, Optional, Tuple, Type, TypeVar from volatility3.framework import constants, interfaces @@ -58,7 +58,7 @@ class NonInheritable: self.default_value = value self.cls = cls - def __get__(self, obj: Any, get_type: Type = None) -> Any: + def __get__(self, obj: Any, get_type: Type = Optional[None]) -> Any: if type is self.cls: if hasattr(self.default_value, "__get__"): return self.default_value.__get__(obj, get_type) @@ -185,8 +185,7 @@ def _zipwalk(path: str): zip_results[os.path.join(path, os.path.dirname(file.filename))] = ( dirlist ) - for value in zip_results: - yield value, zip_results[value] + yield from zip_results.items() def list_plugins() -> Dict[str, Type[interfaces.plugins.PluginInterface]]: diff --git a/volatility3/framework/automagic/stacker.py b/volatility3/framework/automagic/stacker.py index c251d3c46..596864264 100644 --- a/volatility3/framework/automagic/stacker.py +++ b/volatility3/framework/automagic/stacker.py @@ -166,7 +166,9 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): cls, context: interfaces.context.ContextInterface, initial_layer: str, - stack_set: List[Type[interfaces.automagic.StackerLayerInterface]] = None, + stack_set: Optional[ + List[Type[interfaces.automagic.StackerLayerInterface]] + ] = None, progress_callback: constants.ProgressCallback = None, ): """Stacks as many possible layers on top of the initial layer as can be done. diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index 9fad506ae..065eb6d43 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -104,9 +104,11 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): for subclazz in framework.class_subclasses(IdentifierProcessor): self._classifiers[subclazz.operating_system] = subclazz + @abstractmethod def add_identifier(self, location: str, operating_system: str, identifier: str): """Adds an identifier to the store""" + @abstractmethod def find_location( self, identifier: bytes, operating_system: Optional[str] ) -> Optional[str]: @@ -120,15 +122,18 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): The location of the symbols file that matches the identifier """ + @abstractmethod def get_local_locations(self) -> Iterable[str]: """Returns a list of all the local locations""" + @abstractmethod def update(self): """Locates all files under the symbol directories. Updates the cache with additions, modifications and removals. This also updates remote locations based on a cache timeout. """ + @abstractmethod def get_identifier_dictionary( self, operating_system: Optional[str] = None, local_only: bool = False ) -> Dict[bytes, str]: @@ -142,12 +147,15 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): A dictionary of identifiers mapped to a location """ + @abstractmethod def get_identifier(self, location: str) -> Optional[bytes]: """Returns an identifier based on a specific location or None""" + @abstractmethod def get_identifiers(self, operating_system: Optional[str]) -> List[bytes]: """Returns all identifiers for a particular operating system""" + @abstractmethod def get_location_statistics( self, location: str ) -> Optional[Tuple[int, int, int, int]]: @@ -157,6 +165,7 @@ class CacheManagerInterface(interfaces.configuration.VersionableInterface): A tuple of base_types, types, enums, symbols, or None is location not found """ + @abstractmethod def get_hash(self, location: str) -> Optional[str]: """Returns the hash of the JSON from within a location ISF""" diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 0cfaf5693..812b8ec59 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -11,7 +11,7 @@ expect to be in the context (such as particular layers or symboltables). import abc import logging import os -from typing import Any, ClassVar, Dict, List, Optional, Tuple, Type +from typing import Any, ClassVar, Dict, List, Optional, Set, Tuple, Type from urllib import parse, request from volatility3.framework import constants, interfaces @@ -314,11 +314,11 @@ class TranslationLayerRequirement( def __init__( self, name: str, - description: str = None, + description: Optional[str] = None, default: interfaces.configuration.ConfigSimpleType = None, optional: bool = False, - oses: List = None, - architectures: List = None, + oses: Optional[List] = None, + architectures: Optional[List[str]] = None, ) -> None: """Constructs a Translation Layer Requirement. @@ -526,18 +526,18 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): description: Optional[str] = None, default: bool = False, optional: bool = False, - component: Type[interfaces.configuration.VersionableInterface] = None, + component: Optional[Type[interfaces.configuration.VersionableInterface]] = None, version: Optional[Tuple[int, ...]] = None, ) -> None: if version is None: raise TypeError("Version cannot be None") + if component is None: + raise TypeError("Component cannot be None") if description is None: description = f"Version {'.'.join(str(x) for x in version)} dependency on {component.__module__}.{component.__name__} unmet" super().__init__( name=name, description=description, default=default, optional=optional ) - if component is None: - raise TypeError("Component cannot be None") self._component: Type[interfaces.configuration.VersionableInterface] = component self._version = version @@ -546,7 +546,7 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): context: interfaces.context.ContextInterface, config_path: str, accumulator: Optional[ - List[interfaces.configuration.VersionableInterface] + Set[interfaces.configuration.VersionableInterface] ] = None, ) -> Dict[str, interfaces.configuration.RequirementInterface]: # Mypy doesn't appreciate our classproperty implementation, self._plugin.version has no type @@ -580,7 +580,7 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): ) if result: - result.update({config_path: self}) + result[config_path] = self return result context.config[interfaces.configuration.path_join(config_path, self.name)] = ( @@ -604,10 +604,10 @@ class PluginRequirement(VersionRequirement): def __init__( self, name: str, - description: str = None, + description: Optional[str] = None, default: bool = False, optional: bool = False, - plugin: Type[interfaces.plugins.PluginInterface] = None, + plugin: Optional[Type[interfaces.plugins.PluginInterface]] = None, version: Optional[Tuple[int, ...]] = None, ) -> None: super().__init__( @@ -627,7 +627,7 @@ class ModuleRequirement( def __init__( self, name: str, - description: str = None, + description: Optional[str] = None, default: bool = False, architectures: Optional[List[str]] = None, optional: bool = False, diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index 5111b168a..f527544c0 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -229,7 +229,7 @@ class Module(interfaces.context.ModuleInterface): def object( self, object_type: str, - offset: int = None, + offset: Optional[int] = None, native_layer_name: Optional[str] = None, absolute: bool = False, **kwargs, diff --git a/volatility3/framework/interfaces/automagic.py b/volatility3/framework/interfaces/automagic.py index 0867b1608..4ac386fc0 100644 --- a/volatility3/framework/interfaces/automagic.py +++ b/volatility3/framework/interfaces/automagic.py @@ -42,7 +42,7 @@ class AutomagicInterface( priority = 10 """An ordering to indicate how soon this automagic should be run""" - exclusion_list = [] + exclusion_list: List[str] = [] """A list of plugin categories (typically operating systems) which the plugin will not operate on""" def __init__( diff --git a/volatility3/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py index cbbf7e342..2e4f580a7 100644 --- a/volatility3/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -82,7 +82,7 @@ class HierarchicalDict(collections.abc.Mapping): def __init__( self, - initial_dict: Dict[str, "SimpleTypeRequirement"] = None, + initial_dict: Optional[Dict[str, "SimpleTypeRequirement"]] = None, separator: str = CONFIG_SEPARATOR, ) -> None: """ @@ -328,7 +328,7 @@ class RequirementInterface(metaclass=ABCMeta): def __init__( self, name: str, - description: str = None, + description: Optional[str] = None, default: ConfigSimpleType = None, optional: bool = False, ) -> None: @@ -618,7 +618,7 @@ class ConstructableRequirementInterface(RequirementInterface): self, context: "interfaces.context.ContextInterface", config_path: str, - requirement_dict: Dict[str, object] = None, + requirement_dict: Optional[Dict[str, object]] = None, ) -> Optional["interfaces.objects.ObjectInterface"]: """Constructs the class, handing args and the subrequirements as parameters to __init__""" @@ -652,6 +652,7 @@ class ConstructableRequirementInterface(RequirementInterface): class ConfigurableRequirementInterface(RequirementInterface): """Simple Abstract class to provide build_required_config.""" + @abstractmethod def build_configuration( self, context: "interfaces.context.ContextInterface", diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index 8b5e816e8..a87e0f1e8 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -85,7 +85,7 @@ class ContextInterface(metaclass=ABCMeta): object_type: Union[str, "interfaces.objects.Template"], layer_name: str, offset: int, - native_layer_name: str = None, + native_layer_name: Optional[str] = None, **arguments, ) -> "interfaces.objects.ObjectInterface": """Object factory, takes a context, symbol, offset and optional @@ -114,6 +114,7 @@ class ContextInterface(metaclass=ABCMeta): """ return copy.deepcopy(self) + @abstractmethod def module( self, module_name: str, @@ -232,7 +233,7 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): def object( self, object_type: str, - offset: int = None, + offset: Optional[int] = None, native_layer_name: Optional[str] = None, absolute: bool = False, **kwargs, @@ -277,27 +278,35 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): symbol = self.get_symbol(name) return self.offset + symbol.address + @abstractmethod def get_type(self, name: str) -> "interfaces.objects.Template": """Returns a type from the module's symbol table.""" + @abstractmethod def get_symbol(self, name: str) -> "interfaces.symbols.SymbolInterface": """Returns a symbol object from the module's symbol table.""" + @abstractmethod def get_enumeration(self, name: str) -> "interfaces.objects.Template": """Returns an enumeration from the module's symbol table.""" + @abstractmethod def has_type(self, name: str) -> bool: """Determines whether a type is present in the module's symbol table.""" + @abstractmethod def has_symbol(self, name: str) -> bool: """Determines whether a symbol is present in the module's symbol table.""" + @abstractmethod def has_enumeration(self, name: str) -> bool: """Determines whether an enumeration is present in the module's symbol table.""" + @abstractmethod def symbols(self) -> List: """Lists the symbols contained in the symbol table for this module""" + @abstractmethod def get_symbols_by_absolute_location(self, offset: int, size: int = 0) -> List[str]: """Returns the symbols within table_name (or this module if not specified) that live at the specified absolute offset provided.""" @@ -343,6 +352,7 @@ class ModuleContainer(collections.abc.Mapping): def __iter__(self): return iter(self._modules) + @abstractmethod def free_module_name(self, prefix: str = "module") -> str: """Returns an unused table name to ensure no collision occurs when inserting a symbol table.""" diff --git a/volatility3/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py index 56798aca9..a90a78667 100644 --- a/volatility3/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -210,7 +210,7 @@ class DataLayerInterface( context: interfaces.context.ContextInterface, scanner: ScannerInterface, progress_callback: constants.ProgressCallback = None, - sections: Iterable[Tuple[int, int]] = None, + sections: Optional[Iterable[Tuple[int, int]]] = None, ) -> Iterable[Any]: """Scans a Translation layer by chunk. diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 51d25510d..23c90b13b 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -374,6 +374,7 @@ class Template: f"{self.__class__.__name__} object has no attribute {attr}" ) + @abc.abstractmethod def __call__( self, context: "interfaces.context.ContextInterface", diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index 7105274c0..e26164ee7 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -183,7 +183,7 @@ class TreeGrid(metaclass=ABCMeta): @abstractmethod def populate( self, - function: VisitorSignature = None, + function: Optional[VisitorSignature] = None, initial_accumulator: Any = None, fail_on_errors: bool = True, ) -> Optional[Exception]: @@ -235,7 +235,7 @@ class TreeGrid(metaclass=ABCMeta): node: Optional[TreeNode], function: VisitorSignature, initial_accumulator: _Type, - sort_key: ColumnSortKey = None, + sort_key: Optional[ColumnSortKey] = None, ) -> None: """Visits all the nodes in a tree, calling function on each one. diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index ead91fb4d..b8712e38d 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -256,6 +256,7 @@ class SymbolSpaceInterface(collections.abc.Mapping): """An interface for the container that holds all the symbol-containing tables for use within a context.""" + @abstractmethod def free_table_name(self, prefix: str = "layer") -> str: """Returns an unused table name to ensure no collision occurs when inserting a symbol table.""" diff --git a/volatility3/framework/layers/scanners/__init__.py b/volatility3/framework/layers/scanners/__init__.py index f54b44ff4..be9f1c39a 100644 --- a/volatility3/framework/layers/scanners/__init__.py +++ b/volatility3/framework/layers/scanners/__init__.py @@ -72,7 +72,7 @@ class MultiStringScanner(layers.ScannerInterface): return None for char in value: - trie[char] = trie.get(char, {}) + trie.setdefault(char, {}) trie = trie[char] # Mark the end of a string diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index 5846da070..869d4dae6 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -152,7 +152,7 @@ class PrimitiveObject(interfaces.objects.ObjectInterface): type_name: str, object_info: interfaces.objects.ObjectInformation, data_format: DataFormatInfo, - new_value: TUnion[int, float, bool, bytes, str] = None, + new_value: Optional[TUnion[int, float, bool, bytes, str]] = None, **kwargs, ) -> "PrimitiveObject": """Creates the appropriate class and returns it so that the native type @@ -601,7 +601,7 @@ class Enumeration(interfaces.objects.ObjectInterface, int): inverse_choices[v] = k return inverse_choices - def lookup(self, value: int = None) -> str: + def lookup(self, value: Optional[int] = None) -> str: """Looks up an individual value and returns the associated name. If multiple identifiers map to the same value, the first matching identifier will be returned @@ -690,7 +690,7 @@ class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence): type_name: str, object_info: interfaces.objects.ObjectInformation, count: int = 0, - subtype: templates.ObjectTemplate = None, + subtype: Optional[templates.ObjectTemplate] = None, ) -> None: super().__init__(context=context, type_name=type_name, object_info=object_info) self._vol["count"] = count diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index a6d2e6538..82b8dcc67 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import datetime -from typing import Any, Callable, Iterable, List, Tuple +from typing import Any, Callable, Iterable, List, Optional, Tuple from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements @@ -58,7 +58,9 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ] @classmethod - def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[Any], bool]: + def create_pid_filter( + cls, pid_list: Optional[List[int]] = None + ) -> Callable[[Any], bool]: """Constructs a filter function for process IDs. Args: diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index 74d044ba9..8c5e5c1a5 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -4,7 +4,7 @@ import datetime import logging -from typing import Callable, Dict, Iterable, List +from typing import Callable, Dict, Iterable, List, Optional from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -82,7 +82,9 @@ class PsList(interfaces.plugins.PluginInterface): return list_tasks @classmethod - def create_pid_filter(cls, pid_list: List[int] = None) -> Callable[[int], bool]: + def create_pid_filter( + cls, pid_list: Optional[List[int]] = None + ) -> Callable[[int], bool]: def filter_func(_): return False diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index 4e483922b..0f4064d79 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -54,7 +54,9 @@ class Timeliner(interfaces.plugins.PluginInterface): self.automagics: Optional[List[interfaces.automagic.AutomagicInterface]] = None @classmethod - def get_usable_plugins(cls, selected_list: List[str] = None) -> List[Type]: + def get_usable_plugins( + cls, selected_list: Optional[List[str]] = None + ) -> List[Type]: # Initialize for the run plugin_list = list(framework.class_subclasses(TimeLinerInterface)) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index a3677ad34..85eb474a8 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import Generator, Iterable, List +from typing import Generator, Iterable, List, Optional from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -133,7 +133,7 @@ class Modules(interfaces.plugins.PluginInterface): context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, - pids: List[int] = None, + pids: Optional[List[int]] = None, ) -> Generator[str, None, None]: """Build a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 85d5d14d1..678652624 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -96,7 +96,7 @@ class PEDump(interfaces.plugins.PluginInterface): pe_table_name: str, ldr_entry: interfaces.objects.ObjectInterface, open_method: Type[interfaces.plugins.FileHandlerInterface], - layer_name: str = None, + layer_name: Optional[str] = None, prefix: str = "", ) -> Optional[str]: """Extracts the PE file referenced an LDR_DATA_TABLE_ENTRY (DLL, kernel module) instance diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 8c56d202d..efde09638 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -183,7 +183,7 @@ class PoolScanner(plugins.PluginInterface): @staticmethod def builtin_constraints( - symbol_table: str, tags_filter: List[bytes] = None + symbol_table: str, tags_filter: Optional[List[bytes]] = None ) -> List[PoolConstraint]: """Get built-in PoolConstraints given a list of pool tags. diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index f262aeae6..579a235d8 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -4,7 +4,7 @@ import datetime import logging -from typing import Callable, Iterator, List, Type +from typing import Callable, Iterator, List, Optional, Type from volatility3.framework import renderers, interfaces, layers, exceptions, constants from volatility3.framework.configuration import requirements @@ -114,7 +114,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def create_pid_filter( - cls, pid_list: List[int] = None, exclude: bool = False + cls, pid_list: Optional[List[int]] = None, exclude: bool = False ) -> Callable[[interfaces.objects.ObjectInterface], bool]: """A factory for producing filter functions that filter based on a list of process IDs. @@ -171,7 +171,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def create_name_filter( - cls, name_list: List[str] = None, exclude: bool = False + cls, name_list: Optional[List[str]] = None, exclude: bool = False ) -> Callable[[interfaces.objects.ObjectInterface], bool]: """A factory for producing filter functions that filter based on a list of process names. diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 86eb47300..cdf344ee6 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -89,7 +89,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): cls, context: interfaces.context.ContextInterface, layer_name: str, - offset: int = None, + offset: Optional[int] = None, physical: bool = True, exclude: bool = False, ) -> Callable[[interfaces.objects.ObjectInterface], bool]: diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 4fe3f97fb..ed926805b 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -4,7 +4,7 @@ import datetime import logging -from typing import List, Sequence, Iterable, Tuple, Union +from typing import List, Optional, Sequence, Iterable, Tuple, Union from volatility3.framework import objects, renderers, exceptions, interfaces, constants from volatility3.framework.configuration import requirements @@ -51,7 +51,7 @@ class PrintKey(interfaces.plugins.PluginInterface): def key_iterator( cls, hive: RegistryHive, - node_path: Sequence[objects.StructType] = None, + node_path: Optional[Sequence[objects.StructType]] = None, recurse: bool = False, ) -> Iterable[ Tuple[ @@ -121,7 +121,7 @@ class PrintKey(interfaces.plugins.PluginInterface): def _printkey_iterator( self, hive: RegistryHive, - node_path: Sequence[objects.StructType] = None, + node_path: Optional[Sequence[objects.StructType]] = None, recurse: bool = False, ): """Method that wraps the more generic key_iterator, to provide output @@ -242,8 +242,8 @@ class PrintKey(interfaces.plugins.PluginInterface): self, layer_name: str, symbol_table: str, - hive_offsets: List[int] = None, - key: str = None, + hive_offsets: Optional[List[int]] = None, + key: Optional[str] = None, recurse: bool = False, ): for hive in hivelist.HiveList.list_hives( diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 277a0d856..6dd5613c4 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -270,7 +270,6 @@ class _ScheduledTasksReader(io.BytesIO): return val def read_aligned_bstring_expand_sz(self) -> Optional[str]: - # type: () -> Optional[str] sz = self.read_aligned_u4() if sz is None: return None diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index 39ce1135d..112e93751 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -214,7 +214,7 @@ class TreeGrid(interfaces.renderers.TreeGrid): def populate( self, - function: interfaces.renderers.VisitorSignature = None, + function: Optional[interfaces.renderers.VisitorSignature] = None, initial_accumulator: Any = None, fail_on_errors: bool = True, ) -> Optional[Exception]: diff --git a/volatility3/framework/symbols/__init__.py b/volatility3/framework/symbols/__init__.py index a8753bd4d..87f2288d7 100644 --- a/volatility3/framework/symbols/__init__.py +++ b/volatility3/framework/symbols/__init__.py @@ -53,10 +53,10 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface): self._resolved: Dict[str, interfaces.objects.Template] = {} self._resolved_symbols: Dict[str, interfaces.objects.Template] = {} - def clear_symbol_cache(self, table_name: str = None) -> None: + def clear_symbol_cache(self, table_name: Optional[str] = None) -> None: """Clears the symbol cache for the specified table name. If no table name is specified, the caches of all symbol tables are cleared.""" - table_list: List[interfaces.symbols.BaseSymbolTableInterface] = list() + table_list: List[interfaces.symbols.BaseSymbolTableInterface] = [] if table_name is None: table_list = list(self._dict.values()) else: @@ -81,7 +81,7 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface): yield table + constants.BANG + symbol_name def get_symbols_by_location( - self, offset: int, size: int = 0, table_name: str = None + self, offset: int, size: int = 0, table_name: Optional[str] = None ) -> Iterable[str]: """Returns all symbols that exist at a specific relative address.""" table_list: Iterable[interfaces.symbols.BaseSymbolTableInterface] = ( @@ -128,7 +128,7 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface): self, producer: str, validator: Callable[[Optional[Tuple], Optional[datetime.datetime]], bool], - tables: List[str] = None, + tables: Optional[List[str]] = None, ) -> bool: """Verifies the producer metadata and version of tables diff --git a/volatility3/framework/symbols/generic/__init__.py b/volatility3/framework/symbols/generic/__init__.py index 9d6da5aa4..7dd00fa75 100644 --- a/volatility3/framework/symbols/generic/__init__.py +++ b/volatility3/framework/symbols/generic/__init__.py @@ -4,7 +4,7 @@ import random import string -from typing import Union +from typing import Optional, Union from volatility3.framework import objects, interfaces @@ -14,8 +14,8 @@ class GenericIntelProcess(objects.StructType): self, context: interfaces.context.ContextInterface, dtb: Union[int, interfaces.objects.ObjectInterface], - config_prefix: str = None, - preferred_name: str = None, + config_prefix: Optional[str] = None, + preferred_name: Optional[str] = None, ) -> str: """Constructs a new layer based on the process's DirectoryTableBase.""" diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 8a28d732f..5b4aa22b8 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -86,7 +86,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): config_path: str, name: str, isf_url: str, - native_types: interfaces.symbols.NativeTableInterface = None, + native_types: Optional[interfaces.symbols.NativeTableInterface] = None, table_mapping: Optional[Dict[str, str]] = None, validate: bool = True, class_types: Optional[ @@ -319,7 +319,7 @@ class ISFormatTable(interfaces.symbols.SymbolTableInterface, metaclass=ABCMeta): config_path: str, name: str, json_object: Any, - native_types: interfaces.symbols.NativeTableInterface = None, + native_types: Optional[interfaces.symbols.NativeTableInterface] = None, table_mapping: Optional[Dict[str, str]] = None, ) -> None: self._json_object = json_object diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 7b025450c..4e2e80bc6 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -308,7 +308,7 @@ class module(generic.GenericIntelProcess): class task_struct(generic.GenericIntelProcess): def add_process_layer( - self, config_prefix: str = None, preferred_name: str = None + self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None ) -> Optional[str]: """Constructs a new layer based on the process's DTB. diff --git a/volatility3/framework/symbols/mac/__init__.py b/volatility3/framework/symbols/mac/__init__.py index ee6dd10a3..dc54a8371 100644 --- a/volatility3/framework/symbols/mac/__init__.py +++ b/volatility3/framework/symbols/mac/__init__.py @@ -1,7 +1,7 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Iterator, Any, Iterable, List, Tuple, Set +from typing import Iterator, Any, Iterable, List, Optional, Tuple, Set from volatility3.framework import interfaces, objects, exceptions, constants from volatility3.framework.symbols import intermed @@ -97,7 +97,7 @@ class MacUtilities(interfaces.configuration.VersionableInterface): context: interfaces.context.ContextInterface, handlers: Iterator[Any], target_address, - kernel_module_name: str = None, + kernel_module_name: Optional[str] = None, ): mod_name = "UNKNOWN" symbol_name = "N/A" diff --git a/volatility3/framework/symbols/mac/extensions/__init__.py b/volatility3/framework/symbols/mac/extensions/__init__.py index d2573fb95..cc700f209 100644 --- a/volatility3/framework/symbols/mac/extensions/__init__.py +++ b/volatility3/framework/symbols/mac/extensions/__init__.py @@ -18,7 +18,7 @@ class proc(generic.GenericIntelProcess): return self.task.dereference().cast("task") def add_process_layer( - self, config_prefix: str = None, preferred_name: str = None + self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None ) -> Optional[str]: """Constructs a new layer based on the process's DTB. diff --git a/volatility3/framework/symbols/metadata.py b/volatility3/framework/symbols/metadata.py index 7e069e518..ea635f1f1 100644 --- a/volatility3/framework/symbols/metadata.py +++ b/volatility3/framework/symbols/metadata.py @@ -25,7 +25,7 @@ class ProducerMetadata(interfaces.symbols.MetadataInterface): return self._json_data.get("version", "") @property - def version(self) -> Optional[Tuple[int]]: + def version(self) -> Optional[Tuple[int, ...]]: """Returns the version of the ISF file producer""" version = self.version_string if not version: diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 600f3e23f..d63f138b6 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -692,7 +692,9 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): return True - def add_process_layer(self, config_prefix: str = None, preferred_name: str = None): + def add_process_layer( + self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None + ): """Constructs a new layer based on the process's DirectoryTableBase.""" parent_layer = self._context.layers[self.vol.layer_name] diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index 5a7847986..de5c8271b 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -362,7 +362,7 @@ class OBJECT_HEADER(objects.StructType): return True def get_object_type( - self, type_map: Dict[int, str], cookie: int = None + self, type_map: Dict[int, str], cookie: Optional[int] = None ) -> Optional[str]: """Across all Windows versions, the _OBJECT_HEADER embeds details on the type of object (i.e. process, file) but the way its embedded diff --git a/volatility3/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py index ea2884bb2..248ef7d0c 100644 --- a/volatility3/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -984,7 +984,9 @@ if __name__ == "__main__": def __init__(self): self._max_message_len = 0 - def __call__(self, progress: Union[int, float], description: str = None): + def __call__( + self, progress: Union[int, float], description: Optional[str] = None + ): """A simple function for providing text-based feedback. .. warning:: Only for development use. diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 1a8644fa8..b5e8ca70a 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -36,7 +36,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): layer_name: str, offset: int, symbol_table_class: str = "volatility3.framework.symbols.intermed.IntermediateSymbolTable", - config_path: str = None, + config_path: Optional[str] = None, progress_callback: constants.ProgressCallback = None, ) -> Optional[str]: """Produces the name of a symbol table loaded from the offset for an MZ header @@ -388,8 +388,8 @@ class PDBUtility(interfaces.configuration.VersionableInterface): config_path: str, layer_name: str, pdb_name: str, - module_offset: int = None, - module_size: int = None, + module_offset: Optional[int] = None, + module_size: Optional[int] = None, ) -> str: """Creates symbol table for a module in the specified layer_name. @@ -418,8 +418,8 @@ class PDBUtility(interfaces.configuration.VersionableInterface): config_path: str, layer_name: str, pdb_name: str, - module_offset: int = None, - module_size: int = None, + module_offset: Optional[int] = None, + module_size: Optional[int] = None, create_module: bool = False, ) -> Tuple[Optional[str], Optional[str]]: if module_offset is None: @@ -478,8 +478,8 @@ class PDBUtility(interfaces.configuration.VersionableInterface): config_path: str, layer_name: str, pdb_name: str, - module_offset: int = None, - module_size: int = None, + module_offset: Optional[int] = None, + module_size: Optional[int] = None, ) -> str: """Creates a module in the specified layer_name based on a pdb name. From cf7aabead44aa1aee02384c57860f7e3ba1a5a84 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Wed, 18 Dec 2024 08:12:49 +0000 Subject: [PATCH 0224/1352] Change semi-colon to colon --- volatility3/framework/configuration/requirements.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 0cfaf5693..cc3ed847e 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -111,7 +111,7 @@ class ListRequirement(interfaces.configuration.RequirementInterface): Args: element_type: The (requirement) type of each element within the list - max_elements; The maximum number of acceptable elements this list can contain + max_elements: The maximum number of acceptable elements this list can contain min_elements: The minimum number of acceptable elements this list can contain """ super().__init__(*args, **kwargs) From 7464a3b883a50ee35a2e3c607d1906dd6d8c1807 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 18 Dec 2024 10:57:33 -0600 Subject: [PATCH 0225/1352] Windows Extensions: Fix potential AttributeErrors If `self.get_owner()` returns `None`, and the chained call to `is_valid()` is executed, an `AttributeError` will occur. This fixes two instances of this bug by intializing a local variable with the result of the `get_owner()` call, checking for `None`, and returning if that's the case. Also adds type-hints for these methods. --- .../symbols/windows/extensions/network.py | 30 ++++++++++++------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/network.py b/volatility3/framework/symbols/windows/extensions/network.py index 9b7573c2e..cfa2a7a30 100644 --- a/volatility3/framework/symbols/windows/extensions/network.py +++ b/volatility3/framework/symbols/windows/extensions/network.py @@ -4,7 +4,7 @@ import logging import socket -from typing import Dict, Tuple, List, Union +from typing import Dict, Tuple, List, Union, Optional from volatility3.framework import exceptions from volatility3.framework import objects, interfaces @@ -86,19 +86,29 @@ class _TCP_LISTENER(objects.StructType): except exceptions.InvalidAddressException: return None - def get_owner_pid(self): - if self.get_owner().is_valid(): - if self.get_owner().has_valid_member("UniqueProcessId"): - return self.get_owner().UniqueProcessId + def get_owner_pid(self) -> Optional[int]: + owner = self.get_owner() + + if owner is None: + return None + + if owner.is_valid(): + if owner.has_valid_member("UniqueProcessId"): + return owner.UniqueProcessId return None - def get_owner_procname(self): - if self.get_owner().is_valid(): - if self.get_owner().has_valid_member("ImageFileName"): - return self.get_owner().ImageFileName.cast( + def get_owner_procname(self) -> Optional[str]: + owner = self.get_owner() + + if owner is None: + return None + + if owner.is_valid(): + if owner.has_valid_member("ImageFileName"): + return owner.ImageFileName.cast( "string", - max_length=self.get_owner().ImageFileName.vol.count, + max_length=owner.ImageFileName.vol.count, errors="replace", ) From c865f4892c88d346d010a4d08ed75ecdb10a44c5 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Wed, 18 Dec 2024 17:36:05 +0000 Subject: [PATCH 0226/1352] Slightly modify documentation --- doc/source/glossary.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/source/glossary.rst b/doc/source/glossary.rst index a9460b1a2..33e56883a 100644 --- a/doc/source/glossary.rst +++ b/doc/source/glossary.rst @@ -123,6 +123,11 @@ Page Table possible to use them as a way to map a particular address within a (potentially larger, but sparsely populated) virtual space to a concrete (and usually contiguous) physical space, through the process of :ref:`mapping`. +.. _Plugin: + +Plugin + Plugins are the "functions" of the volatility framework. They carry out algorithms on data stored in layers using objects constructed from symbols. Broadly, plugins take in a number of TranslationLayers (the data, which is a representation of part of an image, in a specified type described by templates) and outputs a TreeGrid. + .. _Pointer: Pointer From 1e2900d587acb1b752a1c8352bcf4fc112a9ec7a Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Wed, 18 Dec 2024 17:39:03 +0000 Subject: [PATCH 0227/1352] Slightly modify documentation --- doc/source/glossary.rst | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/doc/source/glossary.rst b/doc/source/glossary.rst index 33e56883a..04f1fb090 100644 --- a/doc/source/glossary.rst +++ b/doc/source/glossary.rst @@ -61,9 +61,7 @@ Map, mapping of the :ref:`Range`). Mappings can be seen as a mathematical function, and therefore volatility 3 attempts to use mathematical functional notation where possible. Within volatility a mapping is most often used to refer to the function for translating addresses from a higher layer (domain) to a lower layer (range). - For further information, please see - `https://en.wikipedia.org/wiki/Function_(mathematics)`. - + For further information, please see `[Function (mathematics) in Wikipedia](https://en.wikipedia.org/wiki/Function_(mathematics))`. .. _Member: From 7eca407b6d8fc6123486c79121f0d6db2bf7dc8b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 18 Dec 2024 11:34:25 -0600 Subject: [PATCH 0228/1352] Windows PEDump: Revert overwritten changes When #1364 was merged, it may not have been rebased onto the changes introduced in #1422, and they ended up overwritten to the old version. This reverts those changes. --- .../framework/plugins/windows/pedump.py | 41 +++++++++---------- 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 85d5d14d1..275775ddb 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -64,30 +64,27 @@ class PEDump(interfaces.plugins.PluginInterface): """ Returns the filename of the dump file or None """ - try: - file_handle = open_method(file_name) + with open_method(file_name) as file_handle: + try: + dos_header = context.object( + pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", + offset=base, + layer_name=layer_name, + ) - dos_header = context.object( - pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", - offset=base, - layer_name=layer_name, - ) + for offset, data in dos_header.reconstruct(): + file_handle.seek(offset) + file_handle.write(data) + except ( + OSError, + exceptions.VolatilityException, + OverflowError, + ValueError, + ) as excp: + vollog.debug(f"Unable to dump PE file at offset {base}: {excp}") + return None - for offset, data in dos_header.reconstruct(): - file_handle.seek(offset) - file_handle.write(data) - except ( - OSError, - exceptions.VolatilityException, - OverflowError, - ValueError, - ) as excp: - vollog.debug(f"Unable to dump PE file at offset {base}: {excp}") - return None - finally: - file_handle.close() - - return file_handle.preferred_filename + return file_handle.preferred_filename @classmethod def dump_ldr_entry( From a9417edd2810e682474966d501786bfb8e3206ec Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Wed, 18 Dec 2024 17:49:56 +0000 Subject: [PATCH 0229/1352] Slightly modify documentation --- doc/source/glossary.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/glossary.rst b/doc/source/glossary.rst index 04f1fb090..d3bc9613a 100644 --- a/doc/source/glossary.rst +++ b/doc/source/glossary.rst @@ -61,7 +61,7 @@ Map, mapping of the :ref:`Range`). Mappings can be seen as a mathematical function, and therefore volatility 3 attempts to use mathematical functional notation where possible. Within volatility a mapping is most often used to refer to the function for translating addresses from a higher layer (domain) to a lower layer (range). - For further information, please see `[Function (mathematics) in Wikipedia](https://en.wikipedia.org/wiki/Function_(mathematics))`. + For further information, please see `Function (mathematics) in Wikipedia_`. .. _Member: From 3c26955e34d68150e5d009557a66581fd7188bb4 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 19 Dec 2024 12:02:16 +1100 Subject: [PATCH 0230/1352] xen_layer: fix potential uninitialized variable issue #1434 --- volatility3/framework/layers/xen.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/layers/xen.py b/volatility3/framework/layers/xen.py index e7aa0ccec..c0a5e1a7d 100644 --- a/volatility3/framework/layers/xen.py +++ b/volatility3/framework/layers/xen.py @@ -54,6 +54,7 @@ class XenCoreDumpLayer(elf.Elf64Layer): segments = [] self._segment_headers = [] + segment_names = None for sindex in range(ehdr.e_shnum): shdr = self.context.object( From d14c777b4f2ba75ff06e1a39d4a23fa52473a5fa Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 19 Dec 2024 14:40:51 +1100 Subject: [PATCH 0231/1352] linux: vmcoreinfo layer: Update to use the new cache-manager --- volatility3/framework/automagic/linux.py | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index bb3bf2091..ce73ee969 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -224,19 +224,6 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): @staticmethod def _check_versions() -> bool: """Verify the versions of the required modules""" - - # Check SQlite cache version - sqlitecache_version_required = (1, 0, 0) - if not requirements.VersionRequirement.matches_required( - sqlitecache_version_required, symbol_cache.SqliteCache.version - ): - vollog.info( - "SQLiteCache version not suitable: required %s found %s", - sqlitecache_version_required, - symbol_cache.SqliteCache.version, - ) - return False - # Check VMCOREINFO API version vmcoreinfo_version_required = (1, 0, 0) if not requirements.VersionRequirement.matches_required( @@ -272,11 +259,9 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): if isinstance(layer, intel.Intel): return None - identifiers_path = os.path.join( - constants.CACHE_PATH, constants.IDENTIFIERS_FILENAME + linux_banners = symbol_cache.load_cache_manager().get_identifier_dictionary( + operating_system="linux" ) - sqlite_cache = symbol_cache.SqliteCache(identifiers_path) - linux_banners = sqlite_cache.get_identifier_dictionary(operating_system="linux") if not linux_banners: # If we have no banners, don't bother scanning vollog.info( From d56f3a5537de12d4b188b2d2eeace213396feea5 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 19 Dec 2024 14:49:23 +1100 Subject: [PATCH 0232/1352] linux: vmcoreinfo layer: Add review suggestions --- volatility3/framework/automagic/linux.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index ce73ee969..c2fc3306d 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -339,8 +339,8 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): context.symbol_space.append(table) # Build the new layer - new_layer_name = context.layers.free_layer_name("IntelLayer") - config_path = join("IntelHelper", new_layer_name) + new_layer_name = context.layers.free_layer_name("primary") + config_path = join("vmcoreinfo", new_layer_name) kernel_banner = LinuxSymbolFinder.banner_config_key banner_str = banner.decode(encoding="latin-1") context.config[join(config_path, kernel_banner)] = banner_str From 7858af3d6d69e3054c1b2c3690e115257efc82b0 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 19 Dec 2024 14:51:33 +1100 Subject: [PATCH 0233/1352] linux: vmcoreinfo layer: remove unused import --- volatility3/framework/automagic/linux.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index c2fc3306d..76c7f7ab3 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -2,7 +2,6 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import os import logging from typing import Optional, Tuple From c82d432b10258136ff0777dfec1fbf5844316132 Mon Sep 17 00:00:00 2001 From: TheMythologist Date: Thu, 19 Dec 2024 12:16:55 +0800 Subject: [PATCH 0234/1352] Typing fix --- volatility3/framework/__init__.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 754939460..a1925faef 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -5,7 +5,6 @@ # Check the python version to ensure it's suitable import glob import sys -from volatility3.framework import check_python_version as check_python_version import zipfile import importlib import inspect @@ -58,7 +57,7 @@ class NonInheritable: self.default_value = value self.cls = cls - def __get__(self, obj: Any, get_type: Type = Optional[None]) -> Any: + def __get__(self, obj: Any, get_type: Optional[Type] = None) -> Any: if type is self.cls: if hasattr(self.default_value, "__get__"): return self.default_value.__get__(obj, get_type) From 7ed8b99e9845b2f982da4ef186bed137ba77af8f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 19 Dec 2024 15:50:17 +1100 Subject: [PATCH 0235/1352] linux: vmcoreinfo layer: Use the version class accessor instead of the internal class member --- volatility3/framework/automagic/linux.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 76c7f7ab3..58195744b 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -226,12 +226,12 @@ class LinuxIntelVMCOREINFOStacker(interfaces.automagic.StackerLayerInterface): # Check VMCOREINFO API version vmcoreinfo_version_required = (1, 0, 0) if not requirements.VersionRequirement.matches_required( - vmcoreinfo_version_required, linux.VMCoreInfo._version + vmcoreinfo_version_required, linux.VMCoreInfo.version ): vollog.info( "VMCOREINFO version not suitable: required %s found %s", vmcoreinfo_version_required, - linux.VMCoreInfo._version, + linux.VMCoreInfo.version, ) return False From 95e103d9ea6c556e93872f35cc1a83d8453ab94f Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 19 Dec 2024 10:35:34 +0000 Subject: [PATCH 0236/1352] Remove commented out import --- volatility3/framework/plugins/windows/shimcachemem.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 59f33510d..b8e9b5bd7 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -17,8 +17,6 @@ from volatility3.framework.symbols.windows.extensions import pe, shimcache from volatility3.plugins import timeliner from volatility3.plugins.windows import modules, pslist, vadinfo -# from volatility3.plugins.windows import pslist, vadinfo, modules - vollog = logging.getLogger(__name__) From c56d9334f82f90e90d46e1026e43d5e209cf9466 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 19 Dec 2024 12:00:27 +0000 Subject: [PATCH 0237/1352] Tweak comment --- volatility3/framework/plugins/windows/pe_symbols.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 002577241..21e657ab3 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -158,7 +158,7 @@ class PESymbolFinder: class PDBSymbolFinder(PESymbolFinder): """ - PESymbolFinder implementation for PDB modules + PESymbolFinder implementation for PDB modules """ def _do_get_address(self, name: str) -> Optional[int]: @@ -195,7 +195,7 @@ class PDBSymbolFinder(PESymbolFinder): class ExportSymbolFinder(PESymbolFinder): """ - PESymbolFinder implementation for PDB modules + PESymbolFinder implementation for PDB modules """ def _get_name(self, export: pefile.ExportData) -> Optional[str]: @@ -300,7 +300,7 @@ class PESymbols(interfaces.plugins.PluginInterface): base_address: int, ) -> Optional[pefile.PE]: """ - Attempts to pefile object from the bytes of the PE file + Attempts to create a pefile object from the bytes of the PE file Args: pe_table_name: name of the pe types table From 0e0c959cd0f3d4a7d14f5cd19a683609b64808f6 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 19 Dec 2024 12:21:20 +0000 Subject: [PATCH 0238/1352] Swap two letters in a typo --- volatility3/framework/plugins/windows/psxview.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index e3ec216dd..b5ddd2ee5 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -25,7 +25,7 @@ class PsXView(plugins.PluginInterface): identify processes that are trying to hide themselves. I recommend using -r pretty if you are looking at this plugin's output in a terminal.""" - # I've omitted the desktop thread scanning method because Volatility3 doesn't appear to have the funcitonality + # I've omitted the desktop thread scanning method because Volatility3 doesn't appear to have the functionality # which the original plugin used to do it. # The sessions method is omitted because it begins with the list of processes found by Pslist anyway. From a11131b3d4767ec15619bab8084c4914ad528f75 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 19 Dec 2024 14:59:58 +0000 Subject: [PATCH 0239/1352] Update how to write a simple plugin --- doc/source/simple-plugin.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index 39670a62d..84b921114 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -52,7 +52,7 @@ to be able to run properly. Any that are defined as optional need not necessari version = (2, 0, 0))] -This is a classmethod, because it is called before the specific plugin object has been instantiated (in order to know how +This is a classmethod, so it can be called before the specific plugin object has been instantiated (in order to know how to instantiate the plugin). At the moment these requirements are fairly straightforward: :: From 4fe3db50df1a53d80d79ac100fdfaf577146fa86 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 19 Dec 2024 16:32:30 +0000 Subject: [PATCH 0240/1352] Reorder requirements by type --- .../framework/plugins/windows/dlllist.py | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 57f19f620..35b9fb2dc 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -19,7 +19,7 @@ vollog = logging.getLogger(__name__) class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): - """Lists the loaded modules in a particular windows memory image.""" + """Lists the loaded DLLs in a particular windows memory image.""" _required_framework_version = (2, 0, 0) _version = (3, 0, 0) @@ -39,6 +39,9 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(1, 1, 0) ), + requirements.VersionRequirement( + name="pedump", component=pedump.PEDump, version=(1, 0, 0) + ), requirements.VersionRequirement( name="info", component=info.Info, version=(1, 0, 0) ), @@ -53,16 +56,16 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): description="Process offset in the physical address space", optional=True, ), - requirements.StringRequirement( - name="name", - description="Specify a regular expression to match dll name(s)", - optional=True, - ), requirements.IntRequirement( name="base", description="Specify a base virtual address in process memory", optional=True, ), + requirements.StringRequirement( + name="name", + description="Specify a regular expression to match dll name(s)", + optional=True, + ), requirements.BooleanRequirement( name="ignore-case", description="Specify case insensitivity for the regular expression name matching", @@ -75,9 +78,6 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): default=False, optional=True, ), - requirements.VersionRequirement( - name="pedump", component=pedump.PEDump, version=(1, 0, 0) - ), ] def _generator(self, procs): @@ -90,12 +90,15 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kuser = info.Info.get_kuser_structure( self.context, kernel.layer_name, kernel.symbol_table_name ) + nt_major_version = int(kuser.NtMajorVersion) nt_minor_version = int(kuser.NtMinorVersion) + # LoadTime only applies to versions higher or equal to Window 7 (6.1 and higher) dll_load_time_field = (nt_major_version > 6) or ( nt_major_version == 6 and nt_minor_version >= 1 ) + for proc in procs: proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() @@ -114,7 +117,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): mod_re = re.compile(self.config["name"], flags) except re.error: vollog.debug( - "Error parsing regular expression: %s", self.config["name"] + f"Error parsing regular expression: {self.config["name"]}" ) return None From 59a5e85b504c48a381fb65f8fc2b42a84bf1bc9a Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 19 Dec 2024 17:36:42 +0000 Subject: [PATCH 0241/1352] Reorder requirements by type --- volatility3/framework/plugins/windows/dlllist.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 35b9fb2dc..65e337dfc 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -117,7 +117,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): mod_re = re.compile(self.config["name"], flags) except re.error: vollog.debug( - f"Error parsing regular expression: {self.config["name"]}" + f'Error parsing regular expression: {self.config["name"]}' ) return None @@ -138,7 +138,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): if dll_load_time_field: # Versions prior to 6.1 won't have the LoadTime attribute - # and 32bit version shouldn't have the Quadpart according to MSDN + # and 32-bit version shouldn't have the Quadpart according to MSDN try: DllLoadTime = conversion.wintime_to_datetime( entry.LoadTime.QuadPart From 8b35031d0f443184953d80263f2689e4dd0a059f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 20 Dec 2024 00:37:31 +0000 Subject: [PATCH 0242/1352] Volshell: Bump linux.pslist plugin requirement --- volatility3/cli/volshell/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py index c5e555ec7..72193201c 100644 --- a/volatility3/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -20,7 +20,7 @@ class Volshell(generic.Volshell): name="kernel", description="Linux kernel module" ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), requirements.IntRequirement( name="pid", description="Process ID", optional=True From 658d40335a15bc40d2ecb5679198d759858492b5 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 20 Dec 2024 13:06:14 +1100 Subject: [PATCH 0243/1352] testcases: Add basic volshell testcases for each OS image --- .github/workflows/test.yaml | 5 ++++ test/test_volatility.py | 51 +++++++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index dfc42499d..e07673175 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -42,6 +42,11 @@ jobs: - name: Testing... run: | + # VolShell + pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v + pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v + + # Volatility pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_windows -v pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_linux -v diff --git a/test/test_volatility.py b/test/test_volatility.py index 5bce07481..8ef6d8b70 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -54,13 +54,56 @@ def runvol_plugin(plugin, img, volatility, python, pluginargs=[], globalargs=[]) return runvol(args, volatility, python) +def runvolshell(img, volshell, python, volshellargs=[], globalargs=[]): + args = ( + globalargs + + [ + "--single-location", + img, + "-q", + ] + + volshellargs + ) + + return runvol(args, volshell, python) + + # # TESTS # + +def basic_volshell_test(image, volatility, python): + # Basic VolShell test to verify requirements and ensure VolShell runs without crashing + + # FIXME: When the minimum Python version includes 3.12, replace the following with: + # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... + fd, filename = tempfile.mkstemp(suffix=".txt") + try: + with os.fdopen(fd, "w") as f: + f.write("exit()") + + rc, out, _err = runvolshell( + img=image, + volshell=volatility, + python=python, + volshellargs=["--script", filename], + ) + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(filename) + + assert rc == 0 + assert out.count(b"\n") >= 4 + + # WINDOWS +def test_windows_volshell(image, volatility, python): + basic_volshell_test(image, volatility, python) + + def test_windows_pslist(image, volatility, python): rc, out, _err = runvol_plugin("windows.pslist.PsList", image, volatility, python) out = out.lower() @@ -332,6 +375,10 @@ def test_windows_vadyarascan_yara_string(image, volatility, python): # LINUX +def test_linux_volshell(image, volatility, python): + basic_volshell_test(image, volatility, python) + + def test_linux_pslist(image, volatility, python): rc, out, _err = runvol_plugin("linux.pslist.PsList", image, volatility, python) @@ -770,6 +817,10 @@ def test_linux_hidden_modules(image, volatility, python): # MAC +def test_mac_volshell(image, volatility, python): + basic_volshell_test(image, volatility, python) + + def test_mac_pslist(image, volatility, python): rc, out, _err = runvol_plugin("mac.pslist.PsList", image, volatility, python) out = out.lower() From 90766f466f581561e17b2cc5e2c7d8eca56c56e6 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 20 Dec 2024 13:21:24 +1100 Subject: [PATCH 0244/1352] testcases: exclude volshell test from the volatility set --- .github/workflows/test.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index e07673175..ce2722457 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -47,8 +47,8 @@ jobs: pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v # Volatility - pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_windows -v - pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k test_linux -v + pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k "test_windows and not test_windows_volshell" -v + pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v - name: Clean up post-test run: | From e6e0754fa523f9c0edb6a6e449bdbf08a16fa712 Mon Sep 17 00:00:00 2001 From: TheMythologist Date: Fri, 20 Dec 2024 10:46:54 +0800 Subject: [PATCH 0245/1352] Remove mypy overrides section --- pyproject.toml | 3 --- 1 file changed, 3 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index cc09922e9..d695a4eac 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -69,9 +69,6 @@ include = ["volatility3*"] mypy_path = "./stubs" show_traceback = true -[[tool.mypy.overrides]] -ignore_missing_imports = true - [tool.ruff] line-length = 88 target-version = "py38" From c317a45eb56a5da26ee50e2edc0d2e8c6821d262 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 20 Dec 2024 14:31:40 +1100 Subject: [PATCH 0246/1352] testcases: Add missing operating system argument --- test/test_volatility.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 8ef6d8b70..f8a32fef3 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -73,7 +73,7 @@ def runvolshell(img, volshell, python, volshellargs=[], globalargs=[]): # -def basic_volshell_test(image, volatility, python): +def basic_volshell_test(image, volatility, python, globalargs): # Basic VolShell test to verify requirements and ensure VolShell runs without crashing # FIXME: When the minimum Python version includes 3.12, replace the following with: @@ -88,6 +88,7 @@ def basic_volshell_test(image, volatility, python): volshell=volatility, python=python, volshellargs=["--script", filename], + globalargs=globalargs, ) finally: with contextlib.suppress(FileNotFoundError): @@ -101,7 +102,7 @@ def basic_volshell_test(image, volatility, python): def test_windows_volshell(image, volatility, python): - basic_volshell_test(image, volatility, python) + basic_volshell_test(image, volatility, python, globalargs=["-w"]) def test_windows_pslist(image, volatility, python): @@ -376,7 +377,7 @@ def test_windows_vadyarascan_yara_string(image, volatility, python): def test_linux_volshell(image, volatility, python): - basic_volshell_test(image, volatility, python) + basic_volshell_test(image, volatility, python, globalargs=["-l"]) def test_linux_pslist(image, volatility, python): @@ -818,7 +819,7 @@ def test_linux_hidden_modules(image, volatility, python): def test_mac_volshell(image, volatility, python): - basic_volshell_test(image, volatility, python) + basic_volshell_test(image, volatility, python, globalargs=["-m"]) def test_mac_pslist(image, volatility, python): From d546c983f3012f3060aca2b2721fedcc48321370 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 20 Dec 2024 14:33:36 +1100 Subject: [PATCH 0247/1352] testcases: Fix runvol* default list arguments --- test/test_volatility.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index f8a32fef3..47ef9769f 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -39,7 +39,9 @@ def runvol(args, volatility, python): return p.returncode, stdout, stderr -def runvol_plugin(plugin, img, volatility, python, pluginargs=[], globalargs=[]): +def runvol_plugin(plugin, img, volatility, python, pluginargs=None, globalargs=None): + pluginargs = pluginargs or [] + globalargs = globalargs or [] args = ( globalargs + [ @@ -54,7 +56,9 @@ def runvol_plugin(plugin, img, volatility, python, pluginargs=[], globalargs=[]) return runvol(args, volatility, python) -def runvolshell(img, volshell, python, volshellargs=[], globalargs=[]): +def runvolshell(img, volshell, python, volshellargs=None, globalargs=None): + volshellargs = volshellargs or [] + globalargs = globalargs or [] args = ( globalargs + [ From ef977efe62af8e4cc5baa96e8a20fb713ee7494f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 20 Dec 2024 14:50:35 +1100 Subject: [PATCH 0248/1352] testcases: Improve volshell basic testcase calling ps() on each of them --- test/test_volatility.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 47ef9769f..bb7c9a851 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -80,12 +80,18 @@ def runvolshell(img, volshell, python, volshellargs=None, globalargs=None): def basic_volshell_test(image, volatility, python, globalargs): # Basic VolShell test to verify requirements and ensure VolShell runs without crashing + volshell_commands = [ + "print(ps())", + "exit()", + ] + # FIXME: When the minimum Python version includes 3.12, replace the following with: # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... fd, filename = tempfile.mkstemp(suffix=".txt") try: + volshell_script = "\n".join(volshell_commands) with os.fdopen(fd, "w") as f: - f.write("exit()") + f.write(volshell_script) rc, out, _err = runvolshell( img=image, @@ -101,12 +107,15 @@ def basic_volshell_test(image, volatility, python, globalargs): assert rc == 0 assert out.count(b"\n") >= 4 + return out + # WINDOWS def test_windows_volshell(image, volatility, python): - basic_volshell_test(image, volatility, python, globalargs=["-w"]) + out = basic_volshell_test(image, volatility, python, globalargs=["-w"]) + assert out.count(b" 40 def test_windows_pslist(image, volatility, python): @@ -381,7 +390,8 @@ def test_windows_vadyarascan_yara_string(image, volatility, python): def test_linux_volshell(image, volatility, python): - basic_volshell_test(image, volatility, python, globalargs=["-l"]) + out = basic_volshell_test(image, volatility, python, globalargs=["-l"]) + assert out.count(b" 100 def test_linux_pslist(image, volatility, python): From 89564cca66a14f9a1707a6d3e056ef56e605b4f0 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Fri, 20 Dec 2024 05:48:42 +0000 Subject: [PATCH 0249/1352] Revert one f-string As part of the ruff linting we did recently all vollog messages should have explicitly been reverted back to %-formatting. --- volatility3/framework/plugins/windows/dlllist.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 65e337dfc..1dafb6bf5 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -117,7 +117,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): mod_re = re.compile(self.config["name"], flags) except re.error: vollog.debug( - f'Error parsing regular expression: {self.config["name"]}' + "Error parsing regular expression: %s", self.config["name"] ) return None From 15eb80b600e6a2114e232355a04cb1bbf5ce8972 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 20 Dec 2024 13:11:35 +0100 Subject: [PATCH 0250/1352] fix unbound page variable access --- volatility3/framework/plugins/windows/malfind.py | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 510719352..14362776b 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -120,8 +120,7 @@ class Malfind(interfaces.plugins.PluginInterface): vadinfo.winnt_protections, ) write_exec = "EXECUTE" in protection_string and "WRITE" in protection_string - dirty_page_check = False - + dirty_page = None if not write_exec: """ # Inspect "PAGE_EXECUTE_READ" VAD pages to detect @@ -135,12 +134,12 @@ class Malfind(interfaces.plugins.PluginInterface): try: # If we have a dirty page in a non writable "EXECUTE" region, it is suspicious. if proc_layer.is_dirty(page): - dirty_page_check = True + dirty_page = page break except exceptions.InvalidAddressException: # Abort as it is likely that other addresses in the same range will also fail. break - if not dirty_page_check: + if dirty_page is None: continue else: continue @@ -152,10 +151,10 @@ class Malfind(interfaces.plugins.PluginInterface): if cls.is_vad_empty(proc_layer, vad): continue - if dirty_page_check: + if dirty_page is not None: # Useful information to investigate the page content with volshell afterwards. vollog.warning( - f"[proc_id {proc_id}] Found suspicious DIRTY + {protection_string} page at {hex(page)}", + f"[proc_id {proc_id}] Found suspicious DIRTY + {protection_string} page at {hex(dirty_page)}", ) data = proc_layer.read(vad.get_start(), 64, pad=True) yield vad, data From 675ef6deea00cf4659bca50e0004dea3be43e8c1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 20 Dec 2024 15:01:09 +0000 Subject: [PATCH 0251/1352] Generic: Fix up potential issue with isfinfo Fixes #1436 --- volatility3/framework/plugins/isfinfo.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py index 78e78fb9e..1c2ac52e9 100644 --- a/volatility3/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -132,6 +132,7 @@ class IsfInfo(plugins.PluginInterface): valid = check_valid(data) except (UnicodeDecodeError, json.decoder.JSONDecodeError): vollog.warning(f"Invalid ISF: {entry}") + continue yield ( 0, ( From f6f4c7b986c8c2adf7a73211f7aeb1375b00f255 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 20 Dec 2024 15:11:42 +0000 Subject: [PATCH 0252/1352] Layers: Fix MSF page len on a possibly uninitialized variable Fixes #1441 --- volatility3/framework/layers/msf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/msf.py b/volatility3/framework/layers/msf.py index 03e144e25..2b4fae963 100644 --- a/volatility3/framework/layers/msf.py +++ b/volatility3/framework/layers/msf.py @@ -194,7 +194,7 @@ class PdbMSFStream(linear.LinearlyMappedLayer): ) -> None: super().__init__(context, config_path, name, metadata) self._base_layer = self.config["base_layer"] - self._pages = self.config.get("pages", None) + self._pages = self.config.get("pages", []) self._pages_len = len(self._pages) if not self._pages: raise PDBFormatException(name, "Invalid/no pages specified") From eaca7b31bba1c9d8f934ad3e607fced26797abfd Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 20 Dec 2024 15:16:17 +0000 Subject: [PATCH 0253/1352] Layers: Fix vmware layer without a suitable meta Fixes #1442 --- volatility3/framework/layers/vmware.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/layers/vmware.py b/volatility3/framework/layers/vmware.py index 622ff0250..39fb21b63 100644 --- a/volatility3/framework/layers/vmware.py +++ b/volatility3/framework/layers/vmware.py @@ -57,6 +57,10 @@ class VmwareLayer(segmented.SegmentedLayer): ) meta_layer = self.context.layers.get(self._meta_layer, None) + if meta_layer is None: + raise exceptions.LayerException( + self._meta_layer, "VMware: Meta layer not found" + ) header_size = struct.calcsize(self.header_structure) data = meta_layer.read(0, header_size) magic, unknown, groupCount = struct.unpack(self.header_structure, data) From cc8fbd5b6824231d5f7bfb53a66560cb2e3fe3b1 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Fri, 20 Dec 2024 17:34:52 +0000 Subject: [PATCH 0254/1352] Tweak a comment --- volatility3/framework/plugins/windows/svclist.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index ea73247ce..a5825e1fe 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -41,7 +41,7 @@ class SvcList(svcscan.SvcScan): @classmethod def _get_exe_range(cls, proc) -> Optional[Tuple[int, int]]: """ - Returns a tuple of starting,ending address for + Returns a tuple of starting address and size of the the VAD containing services.exe """ From bed03dfbc7024d97c289b0c26f98d0627e105eee Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 21 Dec 2024 06:15:35 +0000 Subject: [PATCH 0255/1352] Refactor check of BasicType The intention is either a BasicType or a list where each element is only a BasicType (and not a list). --- volatility3/cli/volshell/generic.py | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 08132608b..a4b141c2d 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -554,11 +554,15 @@ class Volshell(interfaces.plugins.PluginInterface): del kwargs[argname] for keyword, val in kwargs.items(): - if not isinstance(val, (interfaces.configuration.BasicTypes, list)): - if all(isinstance(x, interfaces.configuration.BasicTypes) for x in val): - raise TypeError( - "Configurable values must be simple types (int, bool, str, bytes)" - ) + BasicType_or_list_of_BasicType = False # excludes list of lists + if isinstance(val, interfaces.configuration.BasicTypes): + BasicType_or_list_of_BasicType = True + if all(isinstance(x, interfaces.configuration.BasicTypes) for x in val): + BasicType_or_list_of_BasicType = True + if not BasicType_or_list_of_BasicType: + raise TypeError( + "Configurable values must be simple types (int, bool, str, bytes)" + ) self.context.config[config_path + "." + keyword] = val constructed = clazz(self.context, config_path, **constructor_args) From 88eb2aa88648180439e4d5311c9bf49ef2ae9363 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 21 Dec 2024 13:22:04 +0100 Subject: [PATCH 0256/1352] switch pillow to pyproject.toml --- pyproject.toml | 78 ++++++++++++++++++++++++++++++++++++++++++++---- requirements.txt | 29 ------------------ 2 files changed, 72 insertions(+), 35 deletions(-) delete mode 100644 requirements.txt diff --git a/pyproject.toml b/pyproject.toml index 2e1636a43..c8b2971e1 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -8,13 +8,55 @@ authors = [ ] requires-python = ">=3.8.0" license = { text = "VSL" } -dynamic = ["dependencies", "optional-dependencies", "version"] +dynamic = ["version"] + +dependencies = [ + "pefile>=2024.8.26", +] + +[project.optional-dependencies] +full = [ + "yara-python>=4.5.1,<5", + "capstone>=5.0.3,<6", + "pycryptodome>=3.21.0,<4", + "leechcorepyc>=2.19.2,<3; sys_platform != 'darwin'", + # https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst + # 10.0.0 dropped support for Python3.7 + # 11.0.0 dropped support for Python3.8, which is still supported by Volatility3 + "pillow>=10.0.0,<11.0.0", +] + +cloud = [ + "gcsfs>=2024.10.0", + "s3fs>=2024.10.0", +] + +dev = [ + "volatility3[full,cloud]", + "jsonschema>=4.23.0,<5", + "pyinstaller>=6.11.0,<7", + "pyinstaller-hooks-contrib>=2024.9", +] + +test = [ + "volatility3[dev]", + "pytest>=8.3.3,<9", + "capstone>=5.0.3,<6", + "yara-x>=0.10.0,<1", +] + +docs = [ + "volatility3[dev]", + "sphinx>=8.0.0,<7", + "sphinx-autodoc-typehints>=2.5.0,<3", + "sphinx-rtd-theme>=3.0.1,<4", +] [project.urls] -Homepage = "https://github.com/volatilityfoundation/volatility3/" -"Bug Tracker" = "https://github.com/volatilityfoundation/volatility3/issues" -Documentation = "https://volatility3.readthedocs.io/" -"Source Code" = "https://github.com/volatilityfoundation/volatility3" +homepage = "https://github.com/volatilityfoundation/volatility3/" +documentation = "https://volatility3.readthedocs.io/" +repository = "https://github.com/volatilityfoundation/volatility3" +issues = "https://github.com/volatilityfoundation/volatility3/issues" [project.scripts] vol = "volatility3.cli:main" @@ -22,11 +64,35 @@ volshell = "volatility3.cli.volshell:main" [tool.setuptools.dynamic] version = { attr = "volatility3.framework.constants._version.PACKAGE_VERSION" } -dependencies = { file = "requirements-minimal.txt" } [tool.setuptools.packages.find] include = ["volatility3*"] +[tool.mypy] +mypy_path = "./stubs" +show_traceback = true + +[tool.mypy.overrides] +ignore_missing_imports = true + +[tool.ruff] +line-length = 88 +target-version = "py38" + +[tool.ruff.lint] +select = [ + "F", # pyflakes + "E", # pycodestyle errors + "W", # pycodestyle warnings + "G", # flake8-logging-format + "PIE", # flake8-pie + "UP", # pyupgrade +] + +ignore = [ + "E501", # ignore due to conflict with formatter +] + [build-system] requires = ["setuptools>=68"] build-backend = "setuptools.build_meta" diff --git a/requirements.txt b/requirements.txt deleted file mode 100644 index 21c8f9a76..000000000 --- a/requirements.txt +++ /dev/null @@ -1,29 +0,0 @@ -# Include the minimal requirements --r requirements-minimal.txt - -# The following packages are optional. -# If certain packages are not necessary, place a comment (#) at the start of the line. - -# This is required for the yara plugins -yara-python>=3.8.0 - -# This is required for several plugins that perform malware analysis and disassemble code. -# It can also improve accuracy of Windows 8 and later memory samples. -# FIXME: Version 6.0.0 is incompatible (#1336) so we'll need an adaptor at some point -capstone>=3.0.5,<6.0.0 - -# This is required by plugins that decrypt passwords, password hashes, etc. -pycryptodome - -# This is required for memory acquisition via leechcore/pcileech. -leechcorepyc>=2.4.0; sys_platform != 'darwin' - -# This is required for memory analysis on a Amazon/MinIO S3 and Google Cloud object storage -gcsfs>=2023.1.0 -s3fs>=2023.1.0 - -# This is required by plugins that manipulate pixels and images. -# https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst -# 10.0.0 dropped support for Python3.7 -# 11.0.0 dropped support for Python3.8, which is still supported by Volatility3 -pillow>=10.0.0,<11.0.0 \ No newline at end of file From f6a54c5c48b6ba47a334956cb7994fecfcf14f0c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 21 Dec 2024 13:31:29 +0100 Subject: [PATCH 0257/1352] ruff fix --- volatility3/framework/plugins/linux/graphics/fbdev.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 60e00d033..7144e081a 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -218,7 +218,7 @@ class Fbdev(interfaces.plugins.PluginInterface): fourcc = linux.LinuxUtilities.convert_fourcc_code(fb_info.var.grayscale) warn_msg = f"""Framebuffer "{id}" uses a FOURCC pixel format "{fourcc}" that isn't natively supported. You can try using ffmpeg to decode the raw buffer. Example usage: -"ffmpeg -pix_fmts" to list supported formats, then +"ffmpeg -pix_fmts" to list supported formats, then "ffmpeg -f rawvideo -video_size {fb_info.var.xres_virtual}x{fb_info.var.yres_virtual} -i .raw -pix_fmt output.png".""" vollog.warning(warn_msg) From a84d3611130b1ba42e1e3c317bc6f633adc669ab Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 21 Dec 2024 12:18:23 -0600 Subject: [PATCH 0258/1352] Add the suspended threads plugin from DEF CON 2024 --- .../plugins/windows/suspended_threads.py | 147 ++++++++++++++++++ 1 file changed, 147 insertions(+) create mode 100644 volatility3/framework/plugins/windows/suspended_threads.py diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py new file mode 100644 index 000000000..2cc0673d7 --- /dev/null +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -0,0 +1,147 @@ +import logging + +from typing import Dict +from functools import partial + +from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +import volatility3.plugins.windows.pslist as pslist +import volatility3.plugins.windows.threads as threads +import volatility3.plugins.windows.pe_symbols as pe_symbols + +from volatility3.framework.objects import utility + +vollog = logging.getLogger(__name__) + + +class SuspendedThreads(interfaces.plugins.PluginInterface): + """Enumerates suspended threads.""" + + _required_framework_version = (2, 13, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls): + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="pe_symbols", component=pe_symbols.PESymbols, version=(1, 0, 0) + ), + requirements.VersionRequirement( + name="threads", component=threads.Threads, version=(1, 0, 0) + ), + ] + + def _generator(self): + """ + The goal of this plugin is to report on threads that are suspended + + Legitimate programs can start threads suspended but then will later resume them + + Subsets of malware techniques, such as EDR evasion and process hollowing, + create suspended threads and do not resume them. These are the threads that this + plugin is designed to catch. + + See the whitepaper from our DEF CON 2024 presentation for more details: + + https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf + """ + kernel = self.context.modules[self.config["kernel"]] + + vads_cache: Dict[int, pe_symbols.PESymbols.ranges_type] = {} + + proc_modules = None + + # walk the threads of each process checking for suspended threads + for proc in pslist.PsList.list_processes( + context=self.context, + layer_name=kernel.layer_name, + symbol_table=kernel.symbol_table_name, + ): + for thread in threads.Threads.list_threads(kernel, proc): + try: + # we only care if the thread is suspended + if thread.Tcb.SuspendCount == 0: + continue + + # 4 == terminated + if thread.Tcb.State == 4: + continue + + owner_proc = thread.owning_process() + owner_proc_pid = thread.Cid.UniqueProcess + owner_proc_name = utility.array_to_string(owner_proc.ImageFileName) + thread_tid = thread.Cid.UniqueThread + thread_start_addr = thread.StartAddress + thread_win32_addr = thread.Win32StartAddress + except exceptions.InvalidAddressException: + continue + + # Nothing useful to report if a process doesn't have VADs.. Also a sign of smear/terminated + vads = pe_symbols.PESymbols.get_vads_for_process_cache(vads_cache, owner_proc) + if not vads: + continue + + # Only compute this if needed as its expensive and 99.9% of samples + # will not have suspended threads + if not proc_modules: + proc_modules = pe_symbols.PESymbols.get_process_modules( + self.context, kernel.layer_name, kernel.symbol_table_name, None + ) + + path_and_symbol = partial( + pe_symbols.PESymbols.path_and_symbol_for_address, + self.context, + self.config_path, + proc_modules, + ) + + start_file, start_sym = path_and_symbol(vads, thread_start_addr) + win32_file, win32_sym = path_and_symbol(vads, thread_win32_addr) + + # the only false positive found in mass scanning of samples + if start_file and start_file.endswith("\\WorkFoldersShell.dll"): + continue + + if win32_file and win32_file.endswith("\\WorkFoldersShell.dll"): + continue + + yield ( + 0, + ( + owner_proc_name, + owner_proc_pid, + thread_tid, + start_file or renderers.NotAvailableValue(), + start_sym or renderers.NotAvailableValue(), + format_hints.Hex(thread_start_addr), + win32_file or renderers.NotAvailableValue(), + win32_sym or renderers.NotAvailableValue(), + format_hints.Hex(thread_win32_addr), + ), + ) + + def run(self): + return renderers.TreeGrid( + [ + ("Process", str), + ("PID", int), + ("TID", int), + ("StartFile", str), + ("StartSymbol", str), + ("StartAddress", format_hints.Hex), + ("Win32StartFile", str), + ("Win32StartSymbol", str), + ("Win32StartAddress", format_hints.Hex), + ], + self._generator(), + ) + From d31ac276edb29721847f248c13953696c4a98a9c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 21 Dec 2024 12:22:33 -0600 Subject: [PATCH 0259/1352] Add the suspended threads plugin from DEF CON 2024 --- volatility3/framework/plugins/windows/suspended_threads.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 2cc0673d7..6ddfecca7 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -86,7 +86,9 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): continue # Nothing useful to report if a process doesn't have VADs.. Also a sign of smear/terminated - vads = pe_symbols.PESymbols.get_vads_for_process_cache(vads_cache, owner_proc) + vads = pe_symbols.PESymbols.get_vads_for_process_cache( + vads_cache, owner_proc + ) if not vads: continue @@ -144,4 +146,3 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): ], self._generator(), ) - From b9fa217d7980042aa7264efbdafee6ce4daa930f Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 21 Dec 2024 18:48:12 +0000 Subject: [PATCH 0260/1352] Add a required framework version Added _required_framework_version and set it to the same value (2, 0, 0) as its plugin requirement of svcscan. Also tweaked one comment. --- volatility3/framework/plugins/windows/svclist.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index a5825e1fe..8a64084c5 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -18,6 +18,7 @@ vollog = logging.getLogger(__name__) class SvcList(svcscan.SvcScan): """Lists services contained with the services.exe doubly linked list of services""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) def __init__(self, *args, **kwargs): @@ -41,7 +42,7 @@ class SvcList(svcscan.SvcScan): @classmethod def _get_exe_range(cls, proc) -> Optional[Tuple[int, int]]: """ - Returns a tuple of starting address and size of the + Returns a tuple of starting address and size of the VAD containing services.exe """ From 104f430b2c49cb5887ab90d5574eb515f5d1b8a8 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 21 Dec 2024 20:04:02 +0000 Subject: [PATCH 0261/1352] Plugins: Update vmayarascan and vadyarascan --- .../framework/plugins/linux/vmayarascan.py | 61 ++++++++++------- .../framework/plugins/windows/vadyarascan.py | 66 +++++++++---------- 2 files changed, 68 insertions(+), 59 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 9fe06b0c8..9f6a7a9b8 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging from typing import Iterable, List, Tuple from volatility3.framework import interfaces, renderers @@ -10,12 +11,14 @@ from volatility3.framework.renderers import format_hints from volatility3.plugins import yarascan from volatility3.plugins.linux import pslist +vollog = logging.getLogger(__name__) + class VmaYaraScan(interfaces.plugins.PluginInterface): """Scans all virtual memory areas for tasks using yara.""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -33,6 +36,9 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) + ), requirements.ModuleRequirement( name="kernel", description="Linux kernel", @@ -50,6 +56,8 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): # use yarascan to parse the yara options provided and create the rules rules = yarascan.YaraScan.process_yara_options(dict(self.config)) + sanity_check = 1024 * 1024 * 1024 # 1 GB + # filter based on the pid option if provided filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for task in pslist.PsList.list_tasks( @@ -66,29 +74,36 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): # get the proc_layer object from the context proc_layer = self.context.layers[proc_layer_name] - for start, end in self.get_vma_maps(task): - for match in rules.match( - data=proc_layer.read(start, end - start, True) + max_vma_size = 0 + vma_maps_to_scan = [] + for start, size in self.get_vma_maps(task): + if size > sanity_check: + vollog.debug( + f"VMA at 0x{start:x} over sanity-check size, not scanning" + ) + continue + max_vma_size = max(max_vma_size, size) + vma_maps_to_scan.append((start, size)) + + if not vma_maps_to_scan: + vollog.warning(f"No VMAs were found for task {task.tgid}, not scanning") + continue + + scanner = yarascan.YaraScanner(rules=rules) + scanner.chunk_size = max_vma_size + + # scan the VMA data (in one contiguous block) with the yarascanner + for start, size in vma_maps_to_scan: + for offset, rule_name, name, value in scanner( + proc_layer.read(start, size, pad=True), start ): - if yarascan.YaraScan.yara_returns_instances(): - for match_string in match.strings: - for instance in match_string.instances: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - match.rule, - match_string.identifier, - instance.matched_data, - ) - else: - for offset, name, value in match.strings: - yield 0, ( - format_hints.Hex(offset + start), - task.tgid, - match.rule, - name, - value, - ) + yield 0, ( + format_hints.Hex(offset), + task.tgid, + rule_name, + name, + value, + ) @staticmethod def get_vma_maps( diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index efcc70d07..2e9cc44ea 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -32,6 +32,9 @@ class VadYaraScan(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) + ), requirements.PluginRequirement( name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) ), @@ -66,49 +69,40 @@ class VadYaraScan(interfaces.plugins.PluginInterface): ): layer_name = task.add_process_layer() layer = self.context.layers[layer_name] + + max_vad_size = 0 + vad_maps_to_scan = [] + for start, size in self.get_vad_maps(task): if size > sanity_check: vollog.debug( f"VAD at 0x{start:x} over sanity-check size, not scanning" ) continue + max_vad_size = max(max_vad_size, size) + vad_maps_to_scan.append((start, size)) - data = layer.read(start, size, True) - if not yarascan.YaraScan._yara_x: - for match in rules.match(data=data): - if yarascan.YaraScan.yara_returns_instances(): - for match_string in match.strings: - for instance in match_string.instances: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - match.rule, - match_string.identifier, - instance.matched_data, - ) - else: - for offset, name, value in match.strings: - yield 0, ( - format_hints.Hex(offset + start), - task.UniqueProcessId, - match.rule, - name, - value, - ) - else: - for match in rules.scan(data).matching_rules: - for match_string in match.patterns: - for instance in match_string.matches: - yield 0, ( - format_hints.Hex(instance.offset + start), - task.UniqueProcessId, - f"{match.namespace}.{match.identifier}", - match_string.identifier, - data[ - instance.offset : instance.offset - + instance.length - ], - ) + if not vad_maps_to_scan: + vollog.warning( + f"No VADs were found for task {task.UniqueProcessID}, not scanning" + ) + continue + + scanner = yarascan.YaraScanner(rules=rules) + scanner.chunk_size = max_vad_size + + # scan the VAD data (in one contiguous block) with the yarascanner + for start, size in vad_maps_to_scan: + for offset, rule_name, name, value in scanner( + layer.read(start, size, pad=True), start + ): + yield 0, ( + format_hints.Hex(offset), + task.UniqueProcessId, + rule_name, + name, + value, + ) @staticmethod def get_vad_maps( From ea273fe878fd5724f1801fd709a805bfa92d7ce0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 21 Dec 2024 23:23:37 +0000 Subject: [PATCH 0262/1352] Volshell: Fix up shuffled imports --- volatility3/cli/volshell/generic.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 90d73b4ac..2321408fe 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -11,6 +11,11 @@ import sys from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Union from urllib import parse, request +from volatility3.cli import text_renderer, volshell +from volatility3.framework import exceptions, interfaces, objects, plugins, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import intel, physical, resources, scanners + try: import capstone @@ -18,11 +23,6 @@ try: except ImportError: has_capstone = False -from volatility3.cli import text_renderer, volshell -from volatility3.framework import exceptions, interfaces, objects, plugins, renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.layers import intel, physical, resources, scanners - class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" From 7caf8c572a4629a2a235a974e6dfff112ccabecd Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 22 Dec 2024 14:03:26 +0100 Subject: [PATCH 0263/1352] PIL import graceful exit --- .../framework/plugins/linux/graphics/fbdev.py | 21 +++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 7144e081a..28cae8000 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -4,9 +4,6 @@ import logging import io -# Image manipulation functions are kept in the plugin, -# to prevent a general exit on missing PIL (pillow) dependency. -from PIL import Image from dataclasses import dataclass from typing import Type, List, Dict, Tuple from volatility3.framework import constants, exceptions, interfaces @@ -16,6 +13,15 @@ from volatility3.framework.objects import utility from volatility3.framework.constants import architectures from volatility3.framework.symbols import linux +# Image manipulation functions are kept in the plugin, +# to prevent a general exit on missing PIL (pillow) dependency. +try: + from PIL import Image + + has_pil = True +except ImportError: + has_pil = False + vollog = logging.getLogger(__name__) @@ -101,7 +107,7 @@ class Fbdev(interfaces.plugins.PluginInterface): context: interfaces.context.ContextInterface, kernel_name: str, fb: Framebuffer, - ) -> Image.Image: + ): """Convert raw framebuffer pixels to an image. Args: @@ -238,6 +244,13 @@ You can try using ffmpeg to decode the raw buffer. Example usage: return fb def _generator(self): + + if not has_pil: + vollog.error( + "PIL (pillow) module is required to use this plugin. Please install it manually or through pyproject.toml." + ) + return None + kernel_name = self.config["kernel"] kernel = self.context.modules[kernel_name] From 1fef570022eb0ae13924ed321e5c09a24fe72563 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 22 Dec 2024 14:15:45 +0100 Subject: [PATCH 0264/1352] restrict output to PNG, unify file handling --- .../framework/plugins/linux/graphics/fbdev.py | 28 +++++++++---------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 28cae8000..e82827944 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -160,15 +160,13 @@ class Fbdev(interfaces.plugins.PluginInterface): kernel_name: str, open_method: Type[interfaces.plugins.FileHandlerInterface], fb: Framebuffer, - convert_to_image: bool, - image_format: str = "PNG", + convert_to_png_image: bool, ) -> str: - """Dump a Framebuffer raw buffer to disk. + """Dump a Framebuffer buffer to disk. Args: fb: the relevant Framebuffer object convert_to_image: a boolean specifying if the buffer should be converted to an image - image_format: the target PIL image format (defaults to PNG) Returns: The filename of the dumped buffer. @@ -176,19 +174,19 @@ class Fbdev(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_name] kernel_layer = context.layers[kernel.layer_name] base_filename = f"{fb.id}_{fb.xres_virtual}x{fb.yres_virtual}_{fb.bpp}bpp" - if convert_to_image: - image = cls.convert_fb_raw_buffer_to_image(context, kernel_name, fb) - output = io.BytesIO() - image.save(output, image_format) - file_handle = open_method(f"{base_filename}.{image_format.lower()}") - file_handle.write(output.getvalue()) + if convert_to_png_image: + image_object = cls.convert_fb_raw_buffer_to_image(context, kernel_name, fb) + raw_io_output = io.BytesIO() + image_object.save(raw_io_output, "PNG") + final_fb_buffer = raw_io_output.getvalue() + filename = f"{base_filename}.png" else: - raw_pixels = kernel_layer.read(fb.fb_info.screen_base, fb.size) - file_handle = open_method(f"{base_filename}.raw") - file_handle.write(raw_pixels) + final_fb_buffer = kernel_layer.read(fb.fb_info.screen_base, fb.size) + filename = f"{base_filename}.raw" - file_handle.close() - return file_handle.preferred_filename + with open_method(filename) as f: + f.write(final_fb_buffer) + return f.preferred_filename @classmethod def parse_fb_info( From 8d213284e642c545f44502d0fab3f026bc4fa0ff Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 22 Dec 2024 14:23:04 +0100 Subject: [PATCH 0265/1352] handle NotAvailableValue in filename --- volatility3/framework/plugins/linux/graphics/fbdev.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index e82827944..7f7deee4e 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -173,7 +173,8 @@ class Fbdev(interfaces.plugins.PluginInterface): """ kernel = context.modules[kernel_name] kernel_layer = context.layers[kernel.layer_name] - base_filename = f"{fb.id}_{fb.xres_virtual}x{fb.yres_virtual}_{fb.bpp}bpp" + id = "N-A" if isinstance(fb.id, NotAvailableValue) else fb.id + base_filename = f"{id}_{fb.xres_virtual}x{fb.yres_virtual}_{fb.bpp}bpp" if convert_to_png_image: image_object = cls.convert_fb_raw_buffer_to_image(context, kernel_name, fb) raw_io_output = io.BytesIO() @@ -207,8 +208,7 @@ class Fbdev(interfaces.plugins.PluginInterface): - struct fb_var_screeninfo stores device independent changeable information about a frame buffer device, its current format and video mode, as well as other miscellaneous parameters. """ - # NotAvailableValue() messes with the filename output on disk - id = utility.array_to_string(fb_info.fix.id) or "N-A" + id = utility.array_to_string(fb_info.fix.id) or NotAvailableValue() color_fields = None # 0 = color, 1 = grayscale, >1 = FOURCC From f3d7647433a727a5bb7bc8c91fa3803ad44a6bf4 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 22 Dec 2024 15:48:29 +0100 Subject: [PATCH 0266/1352] unify Tainting parsing capabilities --- .../framework/symbols/linux/__init__.py | 121 ++++++++++++++++++ .../symbols/linux/extensions/__init__.py | 74 ++--------- 2 files changed, 131 insertions(+), 64 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 0230a9c48..832b1de9b 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -11,6 +11,7 @@ from volatility3.framework import constants, exceptions, interfaces, objects from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux import extensions +from volatility3.framework.constants import linux as linux_constants class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): @@ -830,3 +831,123 @@ class PageCache: page = self.vmlinux.object("page", offset=page_addr, absolute=True) if page: yield page + + +class Tainting: + """Tainted kernel and modules parsing capabilities. + + Relevant kernel functions: + - modules: module_flags_taint + - kernel: print_tainted + """ + + def __init__( + self, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + ): + self.kernel = context.modules[kernel_module_name] + + @property + def kernel_taint_flags_list( + self, + ) -> Optional[List[interfaces.objects.ObjectInterface]]: + if self.kernel.has_symbol("taint_flags"): + return list(self.kernel.object_from_symbol("taint_flags")) + return None + + def _module_flags_taint_pre_4_10_rc1( + self, taints: int, is_module: bool = False + ) -> str: + """Convert the module's taints value to a 1-1 character mapping. + Relies on statically defined taints mappings in the framework. + + Args: + taints: The taints value, represented by an integer + is_module: Indicates if the taints value is associated with a built-in/LKM module + + Returns: + The raw taints string. + """ + taints_string = "" + for char, taint_flag in linux_constants.TAINT_FLAGS.items(): + if is_module and is_module != taint_flag.module: + continue + + if taints & taint_flag.shift: + taints_string += char + + return taints_string + + def _module_flags_taint_post_4_10_rc1( + self, taints: int, is_module: bool = False + ) -> str: + """Convert the module's taints value to a 1-1 character mapping. + Relies on kernel symbol embedded taints definitions. + + struct taint_flag { + char c_true; /* character printed when tainted */ + char c_false; /* character printed when not tainted */ + bool module; /* also show as a per-module taint flag */ + }; + + Args: + taints: The taints value, represented by an integer + is_module: Indicates if the taints value is associated with a built-in/LKM module + + Returns: + The raw taints string. + """ + taints_string = "" + for i, taint_flag in enumerate(self.kernel_taint_flags_list): + if is_module and is_module != taint_flag.module: + continue + c_true = chr(taint_flag.c_true) + c_false = chr(taint_flag.c_false) + if taints & (1 << i): + taints_string += c_true + elif c_false != " ": + taints_string += c_false + + return taints_string + + def get_taints_as_plain_string(self, taints: int, is_module: bool = False) -> str: + """Convert the taints value to a 1-1 character mapping. + + Args: + taints: The taints value, represented by an integer + is_module: Indicates if the taints value is associated with a built-in/LKM module + s + Returns: + The raw taints string. + + Documentation: + - module_flags_taint kernel function + """ + + if self.kernel_taint_flags_list: + return self._module_flags_taint_post_4_10_rc1(taints, is_module) + return self._module_flags_taint_pre_4_10_rc1(taints, is_module) + + def get_taints_parsed(self, taints: int, is_module: bool = False) -> List[str]: + """Convert the taints string to a 1-1 descriptor mapping. + + Args: + taints: The taints value, represented by an integer + is_module: Indicates if the taints value is associated with a built-in/LKM module + + Returns: + A comprehensive (user-friendly) taint descriptor list. + + Documentation: + - module_flags_taint kernel function + """ + comprehensive_taints = [] + for character in self.get_taints_as_plain_string(taints, is_module): + taint_flag = linux_constants.TAINT_FLAGS.get(character) + if not taint_flag: + comprehensive_taints.append(f"") + elif taint_flag.when_present: + comprehensive_taints.append(taint_flag.desc) + + return comprehensive_taints diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 0ecf731f4..075a83ae8 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -279,76 +279,29 @@ class module(generic.GenericIntelProcess): return None - def _module_flags_taints_pre_4_10_rc1(self) -> str: - """Convert the module's taints value to a 1-1 character mapping. - Relies on statically defined taints mappings in the framework. - - Returns: - The raw taints string. - """ - taints_string = "" - for char, taint_flag in linux_constants.TAINT_FLAGS.items(): - if taint_flag.module and self.taints & taint_flag.shift: - taints_string += char - - return taints_string - - def _module_flags_taints_post_4_10_rc1(self) -> str: - """Convert the module's taints value to a 1-1 character mapping. - Relies on kernel symbol embedded taints definitions. - - struct taint_flag { - char c_true; /* character printed when tainted */ - char c_false; /* character printed when not tainted */ - bool module; /* also show as a per-module taint flag */ - }; - - Returns: - The raw taints string. - """ - taints_string = "" - for i, taint_flag in enumerate(self.taint_flags_list): - c_true = chr(taint_flag.c_true) - c_false = chr(taint_flag.c_false) - if taint_flag.module and (self.taints & (1 << i)): - taints_string += c_true - elif taint_flag.module and c_false != " ": - taints_string += c_false - - return taints_string - def get_taints_as_plain_string(self) -> str: """Convert the module's taints value to a 1-1 character mapping. + Convenient wrapper around framework's Tainting capabilities. Returns: The raw taints string. - - Documentation: - - module_flags_taint kernel function """ - - if self.taint_flags_list: - return self._module_flags_taints_post_4_10_rc1() - return self._module_flags_taints_pre_4_10_rc1() + return linux.Tainting( + self._context, + linux.LinuxUtilities.get_module_from_volobj_type(self._context, self).name, + ).get_taints_as_plain_string(self.taints, True) def get_taints_parsed(self) -> List[str]: """Convert the module's taints string to a 1-1 descriptor mapping. + Convenient wrapper around framework's Tainting capabilities. Returns: A comprehensive (user-friendly) taint descriptor list. - - Documentation: - - module_flags_taint kernel function """ - comprehensive_taints = [] - for character in self.get_taints_as_plain_string(): - taint_flag = linux_constants.TAINT_FLAGS.get(character) - if not taint_flag: - comprehensive_taints.append(f"") - elif taint_flag.when_present: - comprehensive_taints.append(taint_flag.desc) - - return comprehensive_taints + return linux.Tainting( + self._context, + linux.LinuxUtilities.get_module_from_volobj_type(self._context, self).name, + ).get_taints_parsed(self.taints, True) @property def section_symtab(self): @@ -376,13 +329,6 @@ class module(generic.GenericIntelProcess): return self.strtab raise AttributeError("Unable to get strtab") - @property - def taint_flags_list(self) -> Optional[List[interfaces.objects.ObjectInterface]]: - kernel = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) - if kernel.has_symbol("taint_flags"): - return list(kernel.object_from_symbol("taint_flags")) - return None - class task_struct(generic.GenericIntelProcess): def add_process_layer( From 9d4dd010a7eb6212effc43dd8d57f86e127684f2 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Mon, 23 Dec 2024 15:28:40 +0000 Subject: [PATCH 0267/1352] Reformat how to write a simple plugin --- doc/source/simple-plugin.rst | 93 ++++++++++++++++++++++-------------- 1 file changed, 58 insertions(+), 35 deletions(-) diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index 84b921114..aa8ec3a7e 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -41,15 +41,24 @@ to be able to run properly. Any that are defined as optional need not necessari @classmethod def get_requirements(cls): - return [requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), - requirements.ListRequirement(name = 'pid', - element_type = int, - description = "Process IDs to include (all other processes are excluded)", - optional = True), - requirements.PluginRequirement(name = 'pslist', - plugin = pslist.PsList, - version = (2, 0, 0))] + return [ + requirements.ModuleRequirement( + name = 'kernel', + description = 'Windows kernel', + architectures = ["Intel32", "Intel64"] + ), + requirements.ListRequirement( + name = 'pid', + element_type = int, + description = "Process IDs to include (all other processes are excluded)", + optional = True + ), + requirements.PluginRequirement( + name = 'pslist', + plugin = pslist.PsList, + version = (2, 0, 0) + ), + ] This is a classmethod, so it can be called before the specific plugin object has been instantiated (in order to know how @@ -57,8 +66,11 @@ to instantiate the plugin). At the moment these requirements are fairly straigh :: - requirements.ModuleRequirement(name = 'kernel', description = 'Windows kernel', - architectures = ["Intel32", "Intel64"]), + requirements.ModuleRequirement( + name = 'kernel', + description = 'Windows kernel', + architectures = ["Intel32", "Intel64"] + ), This requirement specifies the need for a particular submodule. Each module requires a :py:class:`TranslationLayer ` and a @@ -85,9 +97,11 @@ not be requested directly from the user. :: - requirements.TranslationLayerRequirement(name = 'primary', - description = 'Memory layer for the kernel', - architectures = ["Intel32", "Intel64"]), + requirements.TranslationLayerRequirement( + name = 'primary', + description = 'Memory layer for the kernel', + architectures = ["Intel32", "Intel64"] + ), This requirement indicates that the plugin will operate on a single :py:class:`TranslationLayer `. The name of the @@ -110,8 +124,10 @@ not be requested directly from the user. :: - requirements.SymbolTableRequirement(name = "nt_symbols", - description = "Windows kernel symbols"), + requirements.SymbolTableRequirement( + name = "nt_symbols", + description = "Windows kernel symbols" + ), This requirement specifies the need for a particular :py:class:`SymbolTable ` @@ -127,10 +143,12 @@ not be requested directly from the user. :: - requirements.ListRequirement(name = 'pid', - description = 'Filter on specific process IDs', - element_type = int, - optional = True), + requirements.ListRequirement( + name = 'pid', + description = 'Filter on specific process IDs', + element_type = int, + optional = True + ), The next requirement is a List Requirement, populated by integers. The description will be presented to the user to describe what the value represents. The optional flag indicates that the plugin can function without the ``pid`` value @@ -138,9 +156,11 @@ being defined within the configuration tree at all. :: - requirements.PluginRequirement(name = 'pslist', - plugin = pslist.PsList, - version = (2, 0, 0))] + requirements.PluginRequirement( + name = 'pslist', + plugin = pslist.PsList, + version = (2, 0, 0) + ) This requirement indicates that the plugin will make use of another plugin's code, and specifies the version requirements on that plugin. The version is specified in terms of Semantic Versioning meaning that, to be compatible, the major @@ -180,16 +200,21 @@ that will be output as part of the :py:class:`~volatility3.framework.interfaces. filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) kernel = self.context.modules[self.config['kernel']] - return renderers.TreeGrid([("PID", int), - ("Process", str), - ("Base", format_hints.Hex), - ("Size", format_hints.Hex), - ("Name", str), - ("Path", str)], - self._generator(pslist.PsList.list_processes(self.context, - kernel.layer_name, - kernel.symbol_table_name, - filter_func = filter_func))) + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Base", format_hints.Hex), + ("Size", format_hints.Hex), + ("Name", str), + ("Path", str), + ], + self._generator( + pslist.PsList.list_processes( + self.context, kernel.layer_name, kernel.symbol_table_name, filter_func = filter_func + ) + ) + ) In this instance, the plugin constructs a filter (using the PsList plugin's *classmethod* for creating filters). It checks the plugin's configuration for the ``pid`` value, and passes it in as a list if it finds it, or None if @@ -281,5 +306,3 @@ such as ``!_UNICODE``) and the parameters to that type. Since the cast value must populate a string typed column, it had to be a Python string (such as being cast to the native type string) and could not have been a special Structure such as ``_UNICODE``. For the format hint columns, the format hint type must be used to ensure the error checking does not fail. - - From df37f0a909255410bd5df31cd4d16bdabb1aa9e8 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Mon, 23 Dec 2024 15:34:17 +0000 Subject: [PATCH 0268/1352] Reformat how to write a simple plugin --- doc/source/simple-plugin.rst | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index aa8ec3a7e..07d9e1467 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -211,7 +211,10 @@ that will be output as part of the :py:class:`~volatility3.framework.interfaces. ], self._generator( pslist.PsList.list_processes( - self.context, kernel.layer_name, kernel.symbol_table_name, filter_func = filter_func + self.context, + kernel.layer_name, + kernel.symbol_table_name, + filter_func = filter_func ) ) ) From 0bb09191aae08b2a1b481fef4fbd565e07a7d91f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 23 Dec 2024 21:28:58 +0100 Subject: [PATCH 0269/1352] file output failure results in UnreadableValue --- .../framework/plugins/linux/graphics/fbdev.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 7f7deee4e..ab4289cf1 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -8,7 +8,12 @@ from dataclasses import dataclass from typing import Type, List, Dict, Tuple from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue +from volatility3.framework.renderers import ( + format_hints, + TreeGrid, + NotAvailableValue, + UnreadableValue, +) from volatility3.framework.objects import utility from volatility3.framework.constants import architectures from volatility3.framework.symbols import linux @@ -280,11 +285,12 @@ You can try using ffmpeg to decode the raw buffer. Example usage: file_output = self.dump_fb( self.context, kernel_name, self.open, fb, bool(fb.color_fields) ) + file_output = str(file_output) except exceptions.InvalidAddressException as excp: vollog.error( f'Layer {excp.layer_name} failed to read address {hex(excp.invalid_address)} when dumping framebuffer "{fb.id}".' ) - file_output = "Error" + file_output = UnreadableValue() try: fb_device_name = utility.pointer_to_string( @@ -303,7 +309,7 @@ You can try using ffmpeg to decode the raw buffer. Example usage: f"{fb.xres_virtual}x{fb.yres_virtual}", fb.bpp, "RUNNING" if fb.fb_info.state == 0 else "SUSPENDED", - str(file_output), + file_output, ), ) From ea2757c06ce23d9a24e01e2ce7823e4980889ee8 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 24 Dec 2024 11:45:23 +0100 Subject: [PATCH 0270/1352] minor version bump --- volatility3/framework/constants/_version.py | 2 +- volatility3/framework/plugins/linux/graphics/fbdev.py | 3 +++ volatility3/framework/symbols/linux/__init__.py | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 11edc07d8..9ca2d0a5b 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 13 # Number of changes that only add to the interface +VERSION_MINOR = 14 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index ab4289cf1..7b644eccf 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -60,6 +60,9 @@ class Fbdev(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), + requirements.VersionRequirement( + name="linuxutils", component=linux.LinuxUtilities, version=(2, 2, 0) + ), requirements.BooleanRequirement( name="dump", description="Dump framebuffers", diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index ba223f979..5aa27b964 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -76,7 +76,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" - _version = (2, 1, 1) + _version = (2, 2, 0) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) From 79fe1c50dfcda812cd9d4b307b271ddcc3c26bd9 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 24 Dec 2024 19:42:05 +0000 Subject: [PATCH 0271/1352] Tweak configuration.py Create a tuple directly and replace random.choice by random.choices. --- volatility3/framework/interfaces/configuration.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py index 2e4f580a7..a376fa813 100644 --- a/volatility3/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -53,7 +53,7 @@ ConfigSimpleType = Optional[Union[SimpleTypes, List[SimpleTypes]]] def path_join(*args) -> str: """Joins configuration paths together.""" # If a path element (particularly the first) is empty, then remove it from the list - args = tuple([arg for arg in args if arg]) + args = tuple(arg for arg in args if arg) return CONFIG_SEPARATOR.join(args) @@ -772,8 +772,7 @@ class ConfigurableInterface(metaclass=ABCMeta): str: The newly generated full configuration path """ random_config_dict = "".join( - random.SystemRandom().choice(string.ascii_uppercase + string.digits) - for _ in range(8) + random.SystemRandom().choices(string.ascii_uppercase + string.digits, k=8) ) new_config_path = path_join(base_config_path, random_config_dict) # TODO: Check that the new_config_path is empty, although it's not critical if it's not since the values are merged in From 4c430d2ec464b3e1fdf8ddd9b51fdf4525078814 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 26 Dec 2024 07:27:45 +0000 Subject: [PATCH 0272/1352] Use BasicTypes variable This removes a "float", which should be excluded. --- volatility3/framework/interfaces/configuration.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py index a376fa813..b6f4f889c 100644 --- a/volatility3/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -779,9 +779,9 @@ class ConfigurableInterface(metaclass=ABCMeta): # This should check that each k corresponds to a requirement and each v is of the appropriate type # This would require knowledge of the new configurable itself to verify, and they should do validation in the - # constructor anyway, however, to prevent bad types getting into the config tree we just verify that v is a simple type + # constructor anyway, however, to prevent bad types getting into the config tree we just verify that v is a basic type for k, v in kwargs.items(): - if not isinstance(v, (int, str, bool, float, bytes)): + if not isinstance(v, BasicTypes): raise TypeError( "Config values passed to make_subconfig can only be simple types" ) From 834b7d0f072984f232dfc7880c0214b40df424fb Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 28 Dec 2024 14:58:12 +0000 Subject: [PATCH 0273/1352] Make ETHREAD year check dynamic Change upper bound year check of ETHREAD to be a decade from now. Makes consistent with EPROCESS. --- volatility3/framework/symbols/windows/extensions/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index d63f138b6..5ec84f95f 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -519,7 +519,8 @@ class ETHREAD(objects.StructType, pool.ExecutiveObject): if not isinstance(ctime, datetime.datetime): return False - if not (1998 < ctime.year < 2030): + current_year = datetime.datetime.now().year + if not (1998 < ctime.year < current_year + 10): return False except exceptions.InvalidAddressException: From 37873f9e1593fad055b0319085694d67a9568f4b Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 28 Dec 2024 16:58:24 +0000 Subject: [PATCH 0274/1352] Remove superfluous spaces in intermed.py --- volatility3/framework/symbols/intermed.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 5b4aa22b8..6802af7d6 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -101,7 +101,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): Args: context: The volatility context for the symbol table config_path: The configuration path for the symbol table - name: The name for the symbol table (this is used in symbols e.g. table!symbol ) + name: The name for the symbol table (this is used in symbols e.g. table!symbol) isf_url: The URL pointing to the ISF file location native_types: The NativeSymbolTable that contains the native types for this symbol table table_mapping: A dictionary linking names referenced in the file with symbol tables in the context @@ -111,7 +111,7 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): """ # Check there are no obvious errors # Open the file and test the version - self._versions = dict([(x.version, x) for x in class_subclasses(ISFormatTable)]) + self._versions = dict((x.version, x) for x in class_subclasses(ISFormatTable)) with resources.ResourceAccessor().open(isf_url) as fp: reader = codecs.getreader("utf-8") json_object = json.load(reader(fp)) # type: ignore @@ -166,9 +166,9 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): format. An interface version such as Major.Minor.Patch means that Major - of the provider must be equal to that of the consumer, and the + of the provider must be equal to that of the consumer, and the provider (the JSON in this instance) must have a greater minor - (indicating that only additive changes have been made) than + (indicating that only additive changes have been made) than the consumer (in this case, the file reader). """ major, minor, patch = (int(x) for x in version.split(".")) From 1bd031b9a86677f6b234e13f93ab2ad9feeb2cc8 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 28 Dec 2024 22:42:25 +0000 Subject: [PATCH 0275/1352] Prevent infinite loops in device enumeration extensions #1483 --- .../symbols/windows/extensions/__init__.py | 39 ++++++++++++++++--- 1 file changed, 33 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index d63f138b6..6dec08c38 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -405,11 +405,24 @@ class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject): def get_attached_devices(self) -> Generator[ObjectInterface, None, None]: """Enumerate the attached device's objects""" - device = self.AttachedDevice.dereference() - while device: - yield device - device = device.AttachedDevice.dereference() + seen = set() + try: + device = self.AttachedDevice.dereference() + except exceptions.InvalidAddressException: + return + + while device: + if device.vol.offset in seen: + break + seen.add(device.vol.offset) + + yield device + + try: + device = device.AttachedDevice.dereference() + except exceptions.InvalidAddressException: + return class DRIVER_OBJECT(objects.StructType, pool.ExecutiveObject): """A class for kernel driver objects.""" @@ -421,10 +434,24 @@ class DRIVER_OBJECT(objects.StructType, pool.ExecutiveObject): def get_devices(self) -> Generator[ObjectInterface, None, None]: """Enumerate the driver's device objects""" - device = self.DeviceObject.dereference() + seen = set() + + try: + device = self.DeviceObject.dereference() + except exceptions.InvalidAddressException: + return + while device: + if device.vol.offset in seen: + return + seen.add(device.vol.offset) + yield device - device = device.NextDevice.dereference() + + try: + device = device.NextDevice.dereference() + except exceptions.InvalidAddressException: + return def is_valid(self) -> bool: """Determine if the object is valid.""" From bf7f1ca91ed88bf482b19bd2558d79aa70bb5c0e Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 28 Dec 2024 22:43:56 +0000 Subject: [PATCH 0276/1352] Prevent infinite loops in device enumeration extensions #1483 --- volatility3/framework/symbols/windows/extensions/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 6dec08c38..c38d47f73 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -424,6 +424,7 @@ class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject): except exceptions.InvalidAddressException: return + class DRIVER_OBJECT(objects.StructType, pool.ExecutiveObject): """A class for kernel driver objects.""" From e64af61efa1a37f6d5c91e34d5375219b1544ee3 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 29 Dec 2024 02:13:18 +0000 Subject: [PATCH 0277/1352] Do not analyze processes without VADs #1470 --- volatility3/framework/plugins/windows/direct_system_calls.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index b0c162f46..183e4095c 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -433,6 +433,8 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] vads = self.get_vad_maps(proc) + if not vads: + continue # for each valid process, look for malicious syscall invocations for address, vad_path in self._get_rule_hits( From 33855cf920a8ef76d2bfa414779b7cf96c8c8def Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 29 Dec 2024 02:20:02 +0000 Subject: [PATCH 0278/1352] Significantly improve the smear/error handling in the netstat plugin --- .../framework/plugins/windows/netstat.py | 157 +++++++++++++----- .../symbols/windows/extensions/network.py | 8 +- 2 files changed, 120 insertions(+), 45 deletions(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index a1521a8c6..3408c0a3a 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -111,8 +111,21 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): The list of indices at which a 1 was found. """ ret = [] + # This value is broken in many samples and was causing essentially infinite loops + # Testing showed that 8192 is the current size across all Windows versions + # We give some leeway in case it increases in later versions, while still keeping it sane + # The problematic samples had values that looked like addresses, so in the billions + if bitmap_size_in_byte > 8192 * 10: + return ret + for idx in range(bitmap_size_in_byte): - current_byte = context.layers[layer_name].read(bitmap_offset + idx, 1)[0] + try: + current_byte = context.layers[layer_name].read(bitmap_offset + idx, 1)[ + 0 + ] + except exceptions.InvalidAddressException: + continue + current_offs = idx * 8 for bit in range(8): if current_byte & (1 << bit) != 0: @@ -154,32 +167,37 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) else: # invalid argument. - return None + return vollog.debug(f"Current Port: {port}") # the given port serves as a shifted index into the port pool lists list_index = port >> 8 truncated_port = port & 0xFF - # constructing port_pool object here so callers don't have to - port_pool = context.object( - net_symbol_table + constants.BANG + "_INET_PORT_POOL", - layer_name=layer_name, - offset=port_pool_addr, - ) + try: + # constructing port_pool object here so callers don't have to + port_pool = context.object( + net_symbol_table + constants.BANG + "_INET_PORT_POOL", + layer_name=layer_name, + offset=port_pool_addr, + ) + # first, grab the given port's PortAssignment (`_PORT_ASSIGNMENT`) + inpa = port_pool.PortAssignments[list_index] - # first, grab the given port's PortAssignment (`_PORT_ASSIGNMENT`) - inpa = port_pool.PortAssignments[list_index] - - # then parse the port assignment list (`_PORT_ASSIGNMENT_LIST`) and grab the correct entry - assignment = inpa.InPaBigPoolBase.Assignments[truncated_port] + # then parse the port assignment list (`_PORT_ASSIGNMENT_LIST`) and grab the correct entry + assignment = inpa.InPaBigPoolBase.Assignments[truncated_port] + except exceptions.InvalidAddressException: + return if not assignment: - return None + return # the value within assignment.Entry is a) masked and b) points inside of the network object # first decode the pointer - netw_inside = cls._decode_pointer(assignment.Entry) + try: + netw_inside = cls._decode_pointer(assignment.Entry) + except exceptions.InvalidAddressException: + return if netw_inside: # if the value is valid, calculate the actual object address by subtracting the offset @@ -188,16 +206,30 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) yield curr_obj + try: + next_obj_address = cls._decode_pointer(curr_obj.Next) + except exceptions.InvalidAddressException: + return + # if the same port is used on different interfaces multiple objects are created # those can be found by following the pointer within the object's `Next` field until it is empty - while curr_obj.Next: - curr_obj = context.object( - obj_name, - layer_name=layer_name, - offset=cls._decode_pointer(curr_obj.Next) - ptr_offset, - ) + while next_obj_address: + try: + curr_obj = context.object( + obj_name, + layer_name=layer_name, + offset=next_obj_address - ptr_offset, + ) + except exceptions.InvalidAddressException: + return + yield curr_obj + try: + next_obj_address = cls._decode_pointer(curr_obj.Next) + except exceptions.InvalidAddressException: + return + @classmethod def get_tcpip_module( cls, @@ -243,16 +275,25 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): The hash table entries which are _not_ empty """ # we are looking for entries whose values are not their own address + # smear sanity check from mass testing + if ht_length > 4096: + return + for index in range(ht_length): current_addr = ht_offset + index * alignment - current_pointer = context.object( - net_symbol_table + constants.BANG + "pointer", - layer_name=layer_name, - offset=current_addr, - ) + try: + current_pointer = context.object( + net_symbol_table + constants.BANG + "pointer", + layer_name=layer_name, + offset=current_addr, + ) + except exceptions.InvalidAddressException: + continue + # check if addr of pointer is equal to the value pointed to if current_pointer.vol.offset == current_pointer: continue + yield current_pointer @classmethod @@ -292,11 +333,15 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): tcpip_symbol_table + constants.BANG + "PartitionCount" ).address - part_table_addr = context.object( - net_symbol_table + constants.BANG + "pointer", - layer_name=layer_name, - offset=tcpip_module_offset + part_table_symbol, - ) + try: + part_table_addr = context.object( + net_symbol_table + constants.BANG + "pointer", + layer_name=layer_name, + offset=tcpip_module_offset + part_table_symbol, + ) + except exceptions.InvalidAddressException: + vollog.debug(f"`PartitionTable` not present in memory.") + return # part_table is the actual partition table offset and consists out of a dynamic amount of _PARTITION objects part_table = context.object( @@ -304,10 +349,18 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): layer_name=layer_name, offset=part_table_addr, ) - part_count = int.from_bytes( - context.layers[layer_name].read(tcpip_module_offset + part_count_symbol, 1), - "little", - ) + + try: + part_count = int.from_bytes( + context.layers[layer_name].read( + tcpip_module_offset + part_count_symbol, 1 + ), + "little", + ) + except exceptions.InvalidAddressException: + vollog.debug(f"`PartitionCount` not present in memory.") + return + part_table.Partitions.count = part_count vollog.debug( @@ -316,9 +369,21 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): entry_offset = context.symbol_space.get_type(obj_name).relative_child_offset( "ListEntry" ) - for ctr, partition in enumerate(part_table.Partitions): + + try: + partitions = part_table.Partitions + except exceptions.InvalidAddressException: + vollog.debug("Partitions member not present in memory") + return + + for ctr, partition in enumerate(partitions): vollog.debug(f"Parsing partition {ctr}") - if partition.Endpoints.NumEntries > 0: + try: + num_entries = partition.Endpoints.NumEntries + except exceptions.InvalidAddressException: + continue + + if num_entries > 0: for endpoint_entry in cls.parse_hashtable( context, layer_name, @@ -402,6 +467,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): upp_symbol = context.symbol_space.get_symbol( tcpip_symbol_table + constants.BANG + "UdpPortPool" ).address + upp_addr = context.object( net_symbol_table + constants.BANG + "pointer", layer_name=layer_name, @@ -498,13 +564,16 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # then, towards the UDP and TCP port pools # first, find their addresses - upp_addr, tpp_addr = cls.find_port_pools( - context, - layer_name, - net_symbol_table, - tcpip_symbol_table, - tcpip_module_offset, - ) + try: + upp_addr, tpp_addr = cls.find_port_pools( + context, + layer_name, + net_symbol_table, + tcpip_symbol_table, + tcpip_module_offset, + ) + except (exceptions.SymbolError, exceptions.InvalidAddressException): + vollog.debug("Unable to reconstruct port pools") # create port pool objects at the detected address and parse the port bitmap upp_obj = context.object( diff --git a/volatility3/framework/symbols/windows/extensions/network.py b/volatility3/framework/symbols/windows/extensions/network.py index 478deab6b..e41ac6a05 100644 --- a/volatility3/framework/symbols/windows/extensions/network.py +++ b/volatility3/framework/symbols/windows/extensions/network.py @@ -219,7 +219,13 @@ class _TCP_ENDPOINT(_TCP_LISTENER): return None def is_valid(self): - if self.State not in self.State.choices.values(): + # netstat calls this before validating the object itself + try: + state = self.State + except exceptions.InvalidAddressException: + return False + + if state not in state.choices.values(): vollog.debug( f"{type(self)} 0x{self.vol.offset:x} invalid due to invalid tcp state {self.State}" ) From 61d6a92f8f32e4fe81d951fc35fd7f36e80a2146 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 29 Dec 2024 02:25:17 +0000 Subject: [PATCH 0279/1352] Significantly improve the smear/error handling in the netstat plugin --- volatility3/framework/plugins/windows/netstat.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 3408c0a3a..902be5fc8 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -340,7 +340,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): offset=tcpip_module_offset + part_table_symbol, ) except exceptions.InvalidAddressException: - vollog.debug(f"`PartitionTable` not present in memory.") + vollog.debug("`PartitionTable` not present in memory.") return # part_table is the actual partition table offset and consists out of a dynamic amount of _PARTITION objects @@ -358,7 +358,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): "little", ) except exceptions.InvalidAddressException: - vollog.debug(f"`PartitionCount` not present in memory.") + vollog.debug("`PartitionCount` not present in memory.") return part_table.Partitions.count = part_count From 65f602965b14a76dba1596e35a71ab1762257ea7 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 29 Dec 2024 02:47:48 +0000 Subject: [PATCH 0280/1352] Address feedback --- volatility3/framework/plugins/windows/suspended_threads.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 6ddfecca7..cec51ed37 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -1,7 +1,7 @@ import logging from typing import Dict -from functools import partial +import functools from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements @@ -99,7 +99,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): self.context, kernel.layer_name, kernel.symbol_table_name, None ) - path_and_symbol = partial( + path_and_symbol = functools.partial( pe_symbols.PESymbols.path_and_symbol_for_address, self.context, self.config_path, From 52a643d5b7f6c57e67acf39eed7c1feb2a0e9dbe Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 29 Dec 2024 20:29:03 +0000 Subject: [PATCH 0281/1352] Use enumerate for readability --- volatility3/framework/renderers/__init__.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index 112e93751..093edf8cc 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -83,8 +83,7 @@ class TreeNode(interfaces.renderers.TreeNode): raise TypeError( "Values must be a list of objects made up of simple types and number the same as the columns" ) - for index in range(len(self._treegrid.columns)): - column = self._treegrid.columns[index] + for index, column in enumerate(self._treegrid.columns): val = values[index] if not isinstance(val, (column.type, interfaces.renderers.BaseAbsentValue)): raise TypeError( @@ -413,8 +412,7 @@ class ColumnSortKey(interfaces.renderers.ColumnSortKey): _index = None self._type = None self.ascending = ascending - for i in range(len(treegrid.columns)): - column = treegrid.columns[i] + for i, column in enumerate(treegrid.columns): if column.name.lower() == column_name.lower(): _index = i self._type = column.type From 28ff910d6280edc0dfa21b3b0585a1ab07de9279 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Mon, 30 Dec 2024 10:58:38 +0000 Subject: [PATCH 0282/1352] Use rsplit instead of split Since we want to split rightmost only. --- volatility3/plugins/windows/registry/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/plugins/windows/registry/__init__.py b/volatility3/plugins/windows/registry/__init__.py index 8915cdfad..aeeaa87f2 100644 --- a/volatility3/plugins/windows/registry/__init__.py +++ b/volatility3/plugins/windows/registry/__init__.py @@ -15,5 +15,5 @@ import os import sys # This is necessary to ensure the core plugins are available, whilst still be overridable -parent_module, module_name = ".".join(__name__.split(".")[:-1]), __name__.split(".")[-1] +parent_module, module_name = __name__.rsplit(".", maxsplit=1) __path__ = [os.path.join(x, module_name) for x in sys.modules[parent_module].__path__] From e9d9345cef488067e7035aa485ff11ed665c4414 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 30 Dec 2024 09:37:40 -0600 Subject: [PATCH 0283/1352] Windows Cachedump: Handle uncaught InvalidAddressException --- volatility3/framework/plugins/windows/cachedump.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 6e667984a..6c730e6ae 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -8,7 +8,7 @@ from typing import Tuple from Crypto.Cipher import ARC4, AES from Crypto.Hash import HMAC -from volatility3.framework import interfaces, renderers +from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions @@ -140,9 +140,14 @@ class Cachedump(interfaces.plugins.PluginInterface): if cache_item.Name == "NL$Control": continue - data = sechive.read(cache_item.Data + 4, cache_item.DataLength) - if data is None: + try: + data = sechive.read(cache_item.Data + 4, cache_item.DataLength) + except exceptions.InvalidAddressException: continue + + if not data: + continue + ( uname_len, domain_len, From 2153b742a1dbde57b369adb34fedc5e05e5eb40c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 30 Dec 2024 18:06:04 +0000 Subject: [PATCH 0284/1352] Fix uncheck read() call and remove variable that would not be definied if exception triggers --- .../plugins/windows/skeleton_key_check.py | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index f5d7e1b3a..b103bc831 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -289,7 +289,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException as excp: vollog.debug( - f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" + f"Invalid address {excp.invalid_address} in layer {excp.layer_name}" ) return None, None @@ -431,15 +431,20 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): # we do not want to fail just because the count is not in memory # 16 was the size on samples I tested, so I chose it as the default + count = 16 + if target_address: - count = int.from_bytes( - self.context.layers[proc_layer_name].read( - target_address, 4 - ), - "little", - ) - else: - count = 16 + try: + count = int.from_bytes( + self.context.layers[proc_layer_name].read( + target_address, 4 + ), + "little", + ) + except exceptions.InvalidAddressException: + vollog.debug( + "Unable to read `cCsystems`. Defaulting to 16." + ) found_count = True From a3844e8bc54f9d597d459005830e733bd73d7256 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 30 Dec 2024 18:08:30 +0000 Subject: [PATCH 0285/1352] Fix uncheck read() call and remove variable that would not be definied if exception triggers --- volatility3/framework/plugins/windows/skeleton_key_check.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index b103bc831..6ae07381a 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -282,7 +282,6 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): for proc in proc_list: try: - proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() return proc, proc_layer_name From 5af5363c461eab6ae1661665429a1794a2a712fb Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 30 Dec 2024 13:50:05 -0600 Subject: [PATCH 0286/1352] Windows Handles: Work in fixes from @attrc These changes fix bugs encountered during regression testing related to virtual offset validation and string length checks. --- volatility3/framework/plugins/windows/handles.py | 8 ++++++++ .../framework/symbols/windows/extensions/pool.py | 11 ++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 62eceb973..e3845b376 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -226,6 +226,14 @@ class Handles(interfaces.plugins.PluginInterface): masked_offset = offset & layer_object.maximum_address for entry in table: + # This triggered a backtrace in many testing samples + # in the level == 0 path + # The code above this calls `is_valid` on the `offset` + # It is sent but then does not validate `entry` before + # sending it to `_get_item` + if not self.context.layers[virtual].is_valid(entry.vol.offset): + continue + if level > 0: yield from self._make_handle_array(entry, level - 1, depth) depth += 1 diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index de5c8271b..ff65acdeb 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -376,7 +376,16 @@ class OBJECT_HEADER(objects.StructType): try: # vista and earlier have a Type member - self._vol["object_header_object_type"] = self.Type.Name.String + length = self.Type.member("Name").Length + if length == 0 or length > 128: + string = None + else: + string = self.Type.Name.String + if len(string) == 0 or len(string) > 128: + string = None + + self._vol["object_header_object_type"] = string + except AttributeError: # windows 7 and later have a TypeIndex, but windows 10 # further encodes the index value with nt1!ObHeaderCookie From 3eeb10be2916bb7988d296c7a85785ffb5a7f25e Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 30 Dec 2024 10:10:03 -0600 Subject: [PATCH 0287/1352] Windows Registry: Handle uncaught exceptions A number of calls to `get_key` across multiple plugins are not made within a `try/except` block that handles `registry.RegistryFormatException` - the calls are either unprotected or only check for `KeyError`. This adds the required `try/except` blocks, or updates the existing ones as needed. --- volatility3/framework/plugins/windows/amcache.py | 10 +++++----- volatility3/framework/plugins/windows/hashdump.py | 2 +- volatility3/framework/plugins/windows/lsadump.py | 7 +++++-- 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 1e918d61c..46a742233 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -543,7 +543,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): amcache.get_key("Root\\InventoryDriverBinary") # type: ignore ) ) - except KeyError: + except (KeyError, registry.RegistryFormatException): # Registry key not found pass @@ -554,7 +554,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): amcache.get_key("Root\\Programs") ) # type: ignore } - except KeyError: + except (KeyError, registry.RegistryFormatException): programs = {} try: @@ -564,7 +564,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ), key=_entry_sort_key, ) - except KeyError: + except (KeyError, registry.RegistryFormatException): files = [] for program_id, file_entries in itertools.groupby( @@ -593,7 +593,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): amcache.get_key("Root\\InventoryApplication") # type: ignore ) ) - except KeyError: + except (KeyError, registry.RegistryFormatException): programs = {} try: @@ -603,7 +603,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ), key=_entry_sort_key, ) - except KeyError: + except (KeyError, registry.RegistryFormatException): files = [] for program_id, file_entries in itertools.groupby( diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 0c98ab8ca..621b0ae53 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -332,7 +332,7 @@ class Hashdump(interfaces.plugins.PluginInterface): try: if hive: result = hive.get_key(key) - except KeyError: + except (KeyError, registry.RegistryFormatException): vollog.info( f"Unable to load the required registry key {hive.get_name()}\\{key} from this memory image" ) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index da8dee325..f3925f2a2 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -8,7 +8,7 @@ from typing import Optional from Crypto.Cipher import ARC4, DES, AES from Crypto.Hash import MD5, SHA256 -from volatility3.framework import interfaces, renderers +from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions @@ -81,7 +81,10 @@ class Lsadump(interfaces.plugins.PluginInterface): if not enc_reg_value: return None - obf_lsa_key = sechive.read(enc_reg_value.Data + 4, enc_reg_value.DataLength) + try: + obf_lsa_key = sechive.read(enc_reg_value.Data + 4, enc_reg_value.DataLength) + except exceptions.InvalidAddressException: + return None if not obf_lsa_key: return None From f3294ef5f12a6b036989585b88105fde62634ce2 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 30 Dec 2024 12:58:44 -0600 Subject: [PATCH 0288/1352] Windows Registry: Handle possible exception in get_node Encountered a `SwappedInvalidAddressException` within the call to `cast` due to an underlying call to `read`. --- volatility3/framework/layers/registry.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index cc364ad50..ee7286e1e 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -140,7 +140,14 @@ class RegistryHive(linear.LinearlyMappedLayer): """Returns the appropriate Node, interpreted from the Cell based on its Signature.""" cell = self.get_cell(cell_offset) - signature = cell.cast("string", max_length=2, encoding="latin-1") + try: + signature = cell.cast("string", max_length=2, encoding="latin-1") + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to read cell signature for cell at {cell.vol.offset:x}" + ) + return cell + if signature == "nk": return cell.u.KeyNode elif signature == "sk": From 21077f909f6bda2dec6a3900c7e9ec53268b8213 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Mon, 30 Dec 2024 22:28:47 +0000 Subject: [PATCH 0289/1352] Sort imports and swap two assignments --- volatility3/cli/text_filter.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/text_filter.py b/volatility3/cli/text_filter.py index 6bd6878a5..b6f019da9 100644 --- a/volatility3/cli/text_filter.py +++ b/volatility3/cli/text_filter.py @@ -1,7 +1,8 @@ import logging -from typing import Any, List, Optional -from volatility3.framework import constants, interfaces import re +from typing import Any, List, Optional + +from volatility3.framework import constants, interfaces vollog = logging.getLogger(__name__) @@ -67,8 +68,8 @@ class ColumnFilter: ) -> None: self.column_num = column_num self.pattern = pattern - self.exclude = exclude self.regex = regex + self.exclude = exclude def find(self, item) -> bool: """Identifies whether an item is found in the appropriate column""" From 3288ac971397500f61501b86a99678592cbd4128 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 30 Dec 2024 14:01:40 -0600 Subject: [PATCH 0290/1352] Windows Handles: Handle possibly invalid memory accesses Any number of member accesses here can raise an `InvalidAddressException`; each is now checked, and `None` returned if any `InvalidAddressException` occurs. --- .../framework/plugins/windows/handles.py | 30 +++++++++++++++---- 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index e3845b376..85b16d2d4 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -68,7 +68,12 @@ class Handles(interfaces.plugins.PluginInterface): if not self.context.layers[virtual].is_valid(handle_table_entry.Object): return None fast_ref = handle_table_entry.Object.cast("_EX_FAST_REF") - object_header = fast_ref.dereference().cast("_OBJECT_HEADER") + + try: + object_header = fast_ref.dereference().cast("_OBJECT_HEADER") + except exceptions.InvalidAddressException: + return None + object_header.GrantedAccess = handle_table_entry.GrantedAccess except AttributeError: # starting with windows 8 @@ -77,16 +82,26 @@ class Handles(interfaces.plugins.PluginInterface): ) if is_64bit: - if handle_table_entry.ObjectPointerBits == 0: + try: + pointer_bits = handle_table_entry.ObjectPointerBits + except exceptions.InvalidAddressException: return None - offset = handle_table_entry.ObjectPointerBits << 4 + if pointer_bits == 0: + return None + + offset = pointer_bits << 4 else: - if handle_table_entry.InfoTable == 0: + try: + info_table = handle_table_entry.InfoTable + except exceptions.InvalidAddressException: return None - offset = handle_table_entry.InfoTable & ~7 + if info_table == 0: + return None + + offset = info_table & ~7 # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset)) object_header = self.context.object( @@ -94,7 +109,10 @@ class Handles(interfaces.plugins.PluginInterface): virtual, offset=offset, ) - object_header.GrantedAccess = handle_table_entry.GrantedAccessBits + try: + object_header.GrantedAccess = handle_table_entry.GrantedAccessBits + except exceptions.InvalidAddressException: + return None object_header.HandleValue = handle_value return object_header From 9a5365e681e971f0e58b23ed42195df09dced6e3 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 30 Dec 2024 16:59:40 -0600 Subject: [PATCH 0291/1352] Windows Handles: Fix unbound local in exception handler This fixes an unbound local used in a debug message; If the exception is raised during the dereference operation, the `objct` variable may be uninitialized. This uses the offset of `ptr` instead. --- volatility3/framework/plugins/windows/handles.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 85b16d2d4..38ccfbfbc 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -178,7 +178,7 @@ class Handles(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VVV, - f"Cannot access _OBJECT_HEADER Name at {objt.vol.offset:#x}", + f"Cannot access _OBJECT_HEADER Name at {ptr.vol.offset:#x}", ) continue From 263c87611b51f1cb9710c2ec71d1f41eb98e9c77 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 31 Dec 2024 10:43:27 -0600 Subject: [PATCH 0292/1352] Windows Registry: Handle exceptions in read calls These calls to `.read()` can raise an `InvalidAddressException`. Instead of propagating this exception to the caller, this adds debug logging, and pads the data will null bytes. Also updates the docstring for `decode_data()` to indicate that it can raise `TypeError` and `ValueError`. --- .../symbols/windows/extensions/registry.py | 31 ++++++++++++++++--- 1 file changed, 26 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index 9e2f8df3b..97dd7390d 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -276,7 +276,16 @@ class CM_KEY_VALUE(objects.StructType): return RegValueTypes(self.Type) def decode_data(self) -> Union[int, bytes]: - """Properly decodes the data associated with the value node""" + """ + Properly decodes the data associated with the value node. + + If an InvalidAddressException occurs when reading data from the + underlying RegistryHive layer, the data will be padded with null bytes + of the same length. + + Raises ValueError if the data cannot be read + Raises TypeError if the class was not instantiated on a RegistryHive layer + """ # Determine if the data is stored inline datalen = self.DataLength data = b"" @@ -310,14 +319,26 @@ class CM_KEY_VALUE(objects.StructType): and block_offset < layer.maximum_address ): amount = min(BIG_DATA_MAXLEN, datalen) - data += layer.read( - offset=layer.get_cell(block_offset).vol.offset, length=amount - ) + try: + data += layer.read( + offset=layer.get_cell(block_offset).vol.offset, + length=amount, + ) + except exceptions.InvalidAddressException: + vollog.debug( + f"Failed to read {amount:x} bytes of data, padding with {amount:x}" + ) datalen -= amount else: # Suspect Data actually points to a Cell, # but the length at the start could be negative so just adding 4 to jump past it - data = layer.read(self.Data + 4, datalen) + try: + data = layer.read(self.Data + 4, datalen) + except exceptions.InvalidAddressException: + vollog.debug( + f"Failed to read {datalen:x} bytes of data, returning {datalen:x} null bytes" + ) + data = b"\x00" * datalen if self.get_type() == RegValueTypes.REG_DWORD: if len(data) != struct.calcsize(" Date: Tue, 31 Dec 2024 11:11:57 -0600 Subject: [PATCH 0293/1352] Windows Registry: Update docstrings + exceptions This updates the docstrings on several methods to indicate that they may raise an exception. --- .../symbols/windows/extensions/registry.py | 20 +++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index 97dd7390d..e53338855 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -159,6 +159,11 @@ class CM_KEY_NODE(objects.StructType): """Extension to allow traversal of registry keys.""" def get_volatile(self) -> bool: + """ + Returns a bool indicating whether or not the key is volatile. + + Raises ValueError if the key was not instantiated on a RegistryHive layer + """ if not isinstance(self._context.layers[self.vol.layer_name], RegistryHive): raise ValueError( "Cannot determine volatility of registry key without an offset in a RegistryHive layer" @@ -166,7 +171,10 @@ class CM_KEY_NODE(objects.StructType): return bool(self.vol.offset & 0x80000000) def get_subkeys(self) -> Iterator["CM_KEY_NODE"]: - """Returns a list of the key nodes.""" + """Returns a list of the key nodes. + + Raises TypeError if the key was not instantiated on a RegistryHive layer + """ hive = self._context.layers[self.vol.layer_name] if not isinstance(hive, RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") @@ -222,7 +230,10 @@ class CM_KEY_NODE(objects.StructType): yield from self._get_subkeys_recursive(hive, subnode) def get_values(self) -> Iterator["CM_KEY_VALUE"]: - """Returns a list of the Value nodes for a key.""" + """Returns a list of the Value nodes for a key. + + Raises TypeError if the key was not instantiated on a RegistryHive layer + """ hive = self._context.layers[self.vol.layer_name] if not isinstance(hive, RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") @@ -251,6 +262,11 @@ class CM_KEY_NODE(objects.StructType): return self.Name.cast("string", max_length=namelength, encoding="latin-1") def get_key_path(self) -> str: + """ + Returns the full path to this registry key. + + Raises TypeError if the key was not instantiated on a RegistryHive layer + """ reg = self._context.layers[self.vol.layer_name] if not isinstance(reg, RegistryHive): raise TypeError("Key was not instantiated on a RegistryHive layer") From fa67f10d3183cd743ca7e44b66d152141a34b2fb Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 31 Dec 2024 11:40:41 -0600 Subject: [PATCH 0294/1352] Windows Registry: Catch RegistryInvalidIndex refs #1484 This catches uncaught exceptions when casting the cell to a string in `get_node`. --- volatility3/framework/layers/registry.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index cc364ad50..c684ccd40 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -140,7 +140,13 @@ class RegistryHive(linear.LinearlyMappedLayer): """Returns the appropriate Node, interpreted from the Cell based on its Signature.""" cell = self.get_cell(cell_offset) - signature = cell.cast("string", max_length=2, encoding="latin-1") + try: + signature = cell.cast("string", max_length=2, encoding="latin-1") + except (RegistryInvalidIndex, exceptions.InvalidAddressException): + vollog.debug( + f"Failed to get cell signature for cell (0x{cell.vol.offset:x})" + ) + return cell if signature == "nk": return cell.u.KeyNode elif signature == "sk": From c6209800bdc810627f8757881f32e1cf0cfb6f17 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 1 Jan 2025 13:23:02 +0000 Subject: [PATCH 0295/1352] Core: Fix up issues when resolving merge --- volatility3/framework/constants/_version.py | 2 +- volatility3/framework/interfaces/context.py | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 02402c5c9..694375538 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 15 # Number of changes that only add to the interface +VERSION_MINOR = 14 # Number of changes that only add to the interface VERSION_PATCH = 1 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index 30840a5b9..0b2ae0cc9 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -306,6 +306,7 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): @abstractmethod def symbols(self) -> List: """Lists the symbols contained in the symbol table for this module""" + raise NotImplementedError("Symbols property has not been implemented.") @abstractmethod def get_symbols_by_absolute_location(self, offset: int, size: int = 0) -> List[str]: From 443f7afc9c95c5738cd9eec841ca834860914759 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 1 Jan 2025 13:59:20 +0000 Subject: [PATCH 0296/1352] Core: Fix code scanning issue concerning equality --- volatility3/framework/contexts/__init__.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index a9ec4ac69..e1fb56d94 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -11,6 +11,7 @@ without them interfering with each other. import functools import hashlib import logging +import re from typing import Callable, Dict, Iterable, List, Optional, Set, Tuple, Union from volatility3.framework import constants, interfaces, symbols, exceptions @@ -387,7 +388,6 @@ class ModuleCollection(interfaces.context.ModuleContainer): contents.""" def __init__(self, modules: Optional[List[SizedModule]] = None) -> None: - self._prefix_count = {} self._modules: Dict[str, SizedModule] = {} super().__init__(modules) @@ -408,13 +408,12 @@ class ModuleCollection(interfaces.context.ModuleContainer): def free_module_name(self, prefix: str = "module") -> str: """Returns an unused module name""" - if prefix not in self._prefix_count: - self._prefix_count[prefix] = 1 + existing_names = [name for name in self if re.match(rf"^{prefix}[0-9]*$", name)] + if not existing_names: return prefix - count = self._prefix_count[prefix] + count = len(existing_names) while prefix + str(count) in self: count += 1 - self._prefix_count[prefix] = count return prefix + str(count) @property From 6be039a7e5ddf23f918f073428cbab7e3604f4e7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 1 Jan 2025 14:05:02 +0000 Subject: [PATCH 0297/1352] Core: Fix black error --- volatility3/framework/interfaces/context.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index 0b2ae0cc9..48c066e96 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -306,7 +306,7 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): @abstractmethod def symbols(self) -> List: """Lists the symbols contained in the symbol table for this module""" - raise NotImplementedError("Symbols property has not been implemented.") + raise NotImplementedError("Symbols property has not been implemented.") @abstractmethod def get_symbols_by_absolute_location(self, offset: int, size: int = 0) -> List[str]: From 9c02f0d12a13fb77db8fb326f6f68dc31fceec1f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 1 Jan 2025 15:22:09 +0000 Subject: [PATCH 0298/1352] Linux: Fix kmsf f-strings Closes #1496 --- volatility3/framework/plugins/linux/kmsg.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index d66e3b9ca..c1d09aff8 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -149,7 +149,7 @@ class ABCKmsg(ABC): # This might seem insignificant but it could cause some issues # when compared with userland tool results or when used in # timelines. - return f"{nsec / 1000000000:lu}.{(nsec % 1000000000) / 1000:06lu}" + return f"{nsec / 1000000000}.{(nsec % 1000000000) / 1000:06}" def get_timestamp_in_sec_str(self, obj) -> str: # obj could be log, printk_log or printk_info @@ -166,7 +166,7 @@ class ABCKmsg(ABC): def get_caller_text(self, caller_id): caller_name = "CPU" if caller_id & 0x80000000 else "Task" - caller = f"{caller_name}({caller_id & ~0x80000000:u})" + caller = f"{caller_name}({int(caller_id & ~0x80000000)})" return caller def get_prefix(self, obj) -> Tuple[int, int, str, str]: From ac3e76665b7a44b6c5dbc18e633814bd2371ff75 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 1 Jan 2025 15:29:07 +0000 Subject: [PATCH 0299/1352] Linux: Fix kmsg unguarded read of msg.len --- volatility3/framework/plugins/linux/kmsg.py | 34 ++++++++++++--------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index d66e3b9ca..67114c087 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -317,23 +317,27 @@ class Kmsg_3_5_to_3_11(ABCKmsg): while cur_idx < end_idx: msg_offset = log_buf_ptr + cur_idx # type: ignore msg = self.vmlinux.object(object_type=log_struct_name, offset=msg_offset) - if msg.len == 0: - # As per kernel/printk.c: - # A length == 0 for the next message indicates a wrap-around to - # the beginning of the buffer. - cur_idx = 0 - end_idx = log_next_idx - else: - facility, level, timestamp, caller = self.get_prefix(msg) - level_txt = self.get_level_text(level) - facility_txt = self.get_facility_text(facility) + try: + if msg.len == 0: + # As per kernel/printk.c: + # A length == 0 for the next message indicates a wrap-around to + # the beginning of the buffer. + cur_idx = 0 + end_idx = log_next_idx + else: + facility, level, timestamp, caller = self.get_prefix(msg) + level_txt = self.get_level_text(level) + facility_txt = self.get_facility_text(facility) - for line in self.get_log_lines(msg): - yield facility_txt, level_txt, timestamp, caller, line - for line in self.get_dict_lines(msg): - yield facility_txt, level_txt, timestamp, caller, line + for line in self.get_log_lines(msg): + yield facility_txt, level_txt, timestamp, caller, line + for line in self.get_dict_lines(msg): + yield facility_txt, level_txt, timestamp, caller, line - cur_idx += msg.len + cur_idx += msg.len + except exceptions.InvalidAddressException: + vollog.warning("Kmsg buffer msg length could not be read") + return class Kmsg_3_11_to_5_10(Kmsg_3_5_to_3_11): From c8e67e526a831dcd05b59fa0adeeda8937c4f81a Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 1 Jan 2025 22:33:25 -0600 Subject: [PATCH 0300/1352] Convert ValueError to TypeError All other methods in this class raise a `TypeError` if the hive was not instantiated on a registry layer; this changes makes this method consistent with the convention used in the others. All `except` blocks checking for `ValueError` have been audited to ensure that this doesn't break exception handling in existing code within the framework. This also includes a minor version bump because: 1. RegistryHives are currently only instantiated one way, which is through the `hivelist` plugin. `hivelist` uses the correct layers when instantiating the hives. 2. Because there is currently a single source for registry hives, and it's unlikely that a hive from that source will ever be created on the wrong layer, it's unlikely that the existing `ValueError` is being raised anywhere within the framework's code. 3. It seems unlikely that consumers of this framework would be instantiating registry hives independent of the `hivelist` plugin, given that they would effectively have to duplicate the `hivelist` code to do so. For these reasons, we're going to do a minor version bump, even though an argument can be made that this warrants a major version bump according to the SemVer rules. This is a one-off and does not indicate any change in the way that we typically update version numbers. --- volatility3/framework/constants/_version.py | 2 +- .../framework/symbols/windows/extensions/registry.py | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 9ca2d0a5b..2f0c53093 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 14 # Number of changes that only add to the interface +VERSION_MINOR = 15 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index e53338855..c9544a8ba 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -162,12 +162,10 @@ class CM_KEY_NODE(objects.StructType): """ Returns a bool indicating whether or not the key is volatile. - Raises ValueError if the key was not instantiated on a RegistryHive layer + Raises TypeError if the key was not instantiated on a RegistryHive layer """ if not isinstance(self._context.layers[self.vol.layer_name], RegistryHive): - raise ValueError( - "Cannot determine volatility of registry key without an offset in a RegistryHive layer" - ) + raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") return bool(self.vol.offset & 0x80000000) def get_subkeys(self) -> Iterator["CM_KEY_NODE"]: From ac299b0cfc1b12d431c370ce0217d39d0b5cd111 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 2 Jan 2025 17:58:51 +1100 Subject: [PATCH 0301/1352] linux: module symbols: Fixes and improve code. - Fixed an issue causing the generation of an invalid, extra symbol. - Reuse ELF sym API instead of reimplemented it - Updated the function to return the symbol index, enabling the use of additional module tables. - Ensured the ELF symbol object has `cached_strtab` set, allowing retrieval of critical symbol information like names. - Added typing hints --- .../framework/constants/linux/__init__.py | 3 + .../symbols/linux/extensions/__init__.py | 73 ++++++++++--------- .../framework/symbols/linux/extensions/elf.py | 34 +++++---- 3 files changed, 61 insertions(+), 49 deletions(-) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 6e49e6f37..f3a13f2a5 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -352,3 +352,6 @@ NSEC_PER_SEC = 1e9 MODULE_MAXIMUM_CORE_SIZE = 20000000 MODULE_MAXIMUM_CORE_TEXT_SIZE = 20000000 MODULE_MINIMUM_SIZE = 4096 + +# Kallsyms +KSYM_NAME_LEN = 512 diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 34d0fcba9..28fbb3fc5 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -213,30 +213,37 @@ class module(generic.GenericIntelProcess): ) return elf_table_name - def get_symbols(self): + def get_symbols( + self, + ) -> Iterable[Tuple[int, interfaces.objects.ObjectInterface]]: """Get symbols of the module Yields: - A symbol object + A tuple containing the ELF symbol index and the corresponding ELF symbol object """ - if not hasattr(self, "_elf_table_name"): - self._elf_table_name = self.get_elf_table_name() - if symbols.symbol_table_is_64bit(self._context, self.get_symbol_table_name()): - prefix = "Elf64_" - else: - prefix = "Elf32_" - syms = self._context.object( - self.get_symbol_table_name() + constants.BANG + "array", + if not self.section_strtab or self.num_symtab < 1: + return None + + elf_table_name = self.get_elf_table_name() + symbol_table_name = self.get_symbol_table_name() + + is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) + sym_name = "Elf64_Sym" if is_64bit else "Elf32_Sym" + sym_type = self._context.symbol_space.get_type( + elf_table_name + constants.BANG + sym_name + ) + elf_syms = self._context.object( + symbol_table_name + constants.BANG + "array", layer_name=self.vol.layer_name, offset=self.section_symtab, - subtype=self._context.symbol_space.get_type( - self._elf_table_name + constants.BANG + prefix + "Sym" - ), - count=self.num_symtab + 1, + subtype=sym_type, + count=self.num_symtab, ) - if self.section_strtab: - yield from syms + for elf_sym_num, elf_sym_obj in enumerate(elf_syms): + # Prepare the symbol object for methods like get_name() + elf_sym_obj.cached_strtab = self.section_strtab + yield elf_sym_num, elf_sym_obj def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module @@ -244,34 +251,25 @@ class module(generic.GenericIntelProcess): Yields: A tuple for each symbol containing the symbol name and its corresponding value """ - - for sym in self.get_symbols(): - sym_arr = self._context.object( - self.get_symbol_table_name() + constants.BANG + "array", - layer_name=self.vol.native_layer_name, - offset=self.section_strtab + sym.st_name, - ) - try: - sym_name = utility.array_to_string( - sym_arr, 512 - ) # 512 is the value of KSYM_NAME_LEN kernel constant - except exceptions.InvalidAddressException: + layer = self._context.layers[self.vol.layer_name] + for _sym_num, sym in self.get_symbols(): + sym_name = sym.get_name() + if not sym_name: continue - if sym_name != "": - # Normalize sym.st_value offset, which is an address pointing to the symbol value - mask = self._context.layers[self.vol.layer_name].address_mask - sym_address = sym.st_value & mask - yield (sym_name, sym_address) - def get_symbol(self, wanted_sym_name): - """Get symbol value for a given symbol name""" + # Normalize sym.st_value offset, which is an address pointing to the symbol value + sym_address = sym.st_value & layer.address_mask + yield (sym_name, sym_address) + + def get_symbol(self, wanted_sym_name) -> Optional[int]: + """Get symbol address for a given symbol name""" for sym_name, sym_address in self.get_symbols_names_and_addresses(): if wanted_sym_name == sym_name: return sym_address return None - def get_symbol_by_address(self, wanted_sym_address): + def get_symbol_by_address(self, wanted_sym_address) -> Optional[str]: """Get symbol name for a given symbol address""" for sym_name, sym_address in self.get_symbols_names_and_addresses(): if wanted_sym_address == sym_address: @@ -285,6 +283,7 @@ class module(generic.GenericIntelProcess): return self.kallsyms.symtab elif self.has_member("symtab"): return self.symtab + raise AttributeError("Unable to get symtab") @property @@ -293,6 +292,7 @@ class module(generic.GenericIntelProcess): return int(self.kallsyms.num_symtab) elif self.has_member("num_symtab"): return int(self.member("num_symtab")) + raise AttributeError("Unable to determine number of symbols") @property @@ -303,6 +303,7 @@ class module(generic.GenericIntelProcess): # Older kernels elif self.has_member("strtab"): return self.strtab + raise AttributeError("Unable to get strtab") diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index eadcbbae0..4de73d952 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -2,13 +2,14 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Dict, Tuple +from typing import Dict, Tuple, Optional import logging from volatility3.framework import constants from volatility3.framework.constants.linux import ( ELF_IDENT, ELF_CLASS, + KSYM_NAME_LEN, ) from volatility3.framework import objects, interfaces, exceptions @@ -328,22 +329,29 @@ class elf_sym(objects.StructType): def cached_strtab(self, cached_strtab): self._cached_strtab = cached_strtab - def get_name(self): + def get_name(self, max_size=KSYM_NAME_LEN) -> Optional[str]: + """Returns the symbol name + + Args: + max_size: Maximum length for a symbol name string. Defaults to KSYM_NAME_LEN (512 bytes). + + Returns: + The symbol name + """ + addr = self._cached_strtab + self.st_name - # Just get the first 255 characters, it should be enough for a symbol name - name_bytes = self._context.layers[self.vol.layer_name].read(addr, 255, pad=True) - - if name_bytes: - idx = name_bytes.find(b"\x00") - if idx != -1: - name_bytes = name_bytes[:idx] - return name_bytes.decode("utf-8", errors="ignore") - else: - # If we cannot read the name from the address space, - # we return None. + layer = self._context.layers[self.vol.layer_name] + name_bytes = layer.read(addr, max_size, pad=True) + if not name_bytes: return None + idx = name_bytes.find(b"\x00") + if idx != -1: + name_bytes = name_bytes[:idx] + + return name_bytes.decode("utf-8", errors="ignore") + class elf_phdr(objects.StructType): """An elf program header""" From 97b93abe438bf32b32067bd962a19e07d9917406 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 2 Jan 2025 11:26:21 +0000 Subject: [PATCH 0302/1352] Linux: Remove unnecessary int cast --- volatility3/framework/plugins/linux/kmsg.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index c1d09aff8..894ca575f 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -166,7 +166,7 @@ class ABCKmsg(ABC): def get_caller_text(self, caller_id): caller_name = "CPU" if caller_id & 0x80000000 else "Task" - caller = f"{caller_name}({int(caller_id & ~0x80000000)})" + caller = f"{caller_name}({caller_id & ~0x80000000})" return caller def get_prefix(self, obj) -> Tuple[int, int, str, str]: From 7278bb244f58f36b346d254512e393cde6f63871 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 14:47:18 +0100 Subject: [PATCH 0303/1352] move get_flags_list at bottom --- .../framework/symbols/linux/extensions/__init__.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 34d0fcba9..9546fcf82 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2628,6 +2628,19 @@ class page(objects.StructType): page_data = physical_layer.read(page_paddr, vmlinux_layer.page_size) return page_data + def get_flags_list(self) -> List[str]: + """Returns a list of page flags + + Returns: + List of page flags + """ + flags = [] + for name, value in self.pageflags_enum.items(): + if self.flags & (1 << value) != 0: + flags.append(name) + + return flags + class IDR(objects.StructType): IDR_BITS = 8 From b61ba66223a866a29a119eb17f44fba250ecc01e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 14:51:23 +0100 Subject: [PATCH 0304/1352] multi-architecture vmemmap_start calculation --- .../symbols/linux/extensions/__init__.py | 62 ++++++++++++------- 1 file changed, 38 insertions(+), 24 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 9546fcf82..b02f80433 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -15,7 +15,7 @@ from typing import Generator, Iterable, Iterator, Optional, Tuple, List, Union, from volatility3.framework import constants, exceptions, objects, interfaces, symbols from volatility3.framework.renderers import conversion from volatility3.framework.constants import linux as linux_constants -from volatility3.framework.layers import linear +from volatility3.framework.layers import linear, intel from volatility3.framework.objects import utility from volatility3.framework.symbols import generic, linux, intermed from volatility3.framework.symbols.linux.extensions import elf @@ -2525,16 +2525,13 @@ class address_space(objects.StructType): class page(objects.StructType): - @property - @functools.lru_cache + @functools.cached_property def pageflags_enum(self) -> Dict: """Returns 'pageflags' enumeration key/values Returns: A dictionary with the pageflags enumeration key/values """ - # FIXME: It would be even better to use @functools.cached_property instead, - # however, this requires Python +3.8 try: pageflags_enum = self._context.symbol_space.get_enumeration( self.get_symbol_table_name() + constants.BANG + "pageflags" @@ -2548,24 +2545,12 @@ class page(objects.StructType): return pageflags_enum - def get_flags_list(self) -> List[str]: - """Returns a list of page flags + @functools.cached_property + def _intel_vmemmap_start(self) -> int: + """Determine the start of the struct page array, for Intel systems. Returns: - List of page flags - """ - flags = [] - for name, value in self.pageflags_enum.items(): - if self.flags & (1 << value) != 0: - flags.append(name) - - return flags - - def to_paddr(self) -> int: - """Converts a page's virtual address to its physical address using the current physical memory model. - - Returns: - int: page physical address + int: vmemmap_start address """ vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name] @@ -2605,13 +2590,39 @@ class page(objects.StructType): "Something went wrong, we shouldn't be here" ) - page_type_size = vmlinux.get_type("page").size + return vmemmap_start + + def _intel_to_paddr(self) -> int: + """Converts a page's virtual address to its physical address using the current Intel memory model. + + Returns: + int: page physical address + """ + vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name] pagec = vmlinux_layer.canonicalize(self.vol.offset) - pfn = (pagec - vmemmap_start) // page_type_size + pfn = (pagec - self._intel_vmemmap_start) // vmlinux.get_type("page").size page_paddr = pfn * vmlinux_layer.page_size return page_paddr + def to_paddr(self) -> int: + """Converts a page's virtual address to its physical address using the current CPU memory model. + + Returns: + int: page physical address + """ + vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name] + if isinstance(vmlinux_layer, intel.Intel): + page_paddr = self._intel_to_paddr() + else: + raise exceptions.LayerException( + f"Architecture {type(vmlinux_layer)} vmemmap_start calculation isn't currently supported." + ) + + return page_paddr + def get_content(self) -> Union[str, None]: """Returns the page content @@ -2620,7 +2631,10 @@ class page(objects.StructType): """ vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name] - physical_layer = vmlinux.context.layers["memory_layer"] + physical_layer_name = self._context.layers[self.vol.layer_name].config.get( + "memory_layer", self.vol.layer_name + ) + physical_layer = self._context.layers[physical_layer_name] page_paddr = self.to_paddr() if not page_paddr: return None From dda104bd62b9f5f7b9c0208832c6d788c0ebd2ea Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 16:37:14 +0100 Subject: [PATCH 0305/1352] move out Tainting capabilities --- .../framework/symbols/linux/__init__.py | 121 ------------------ 1 file changed, 121 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 832b1de9b..0230a9c48 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -11,7 +11,6 @@ from volatility3.framework import constants, exceptions, interfaces, objects from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux import extensions -from volatility3.framework.constants import linux as linux_constants class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): @@ -831,123 +830,3 @@ class PageCache: page = self.vmlinux.object("page", offset=page_addr, absolute=True) if page: yield page - - -class Tainting: - """Tainted kernel and modules parsing capabilities. - - Relevant kernel functions: - - modules: module_flags_taint - - kernel: print_tainted - """ - - def __init__( - self, - context: interfaces.context.ContextInterface, - kernel_module_name: str, - ): - self.kernel = context.modules[kernel_module_name] - - @property - def kernel_taint_flags_list( - self, - ) -> Optional[List[interfaces.objects.ObjectInterface]]: - if self.kernel.has_symbol("taint_flags"): - return list(self.kernel.object_from_symbol("taint_flags")) - return None - - def _module_flags_taint_pre_4_10_rc1( - self, taints: int, is_module: bool = False - ) -> str: - """Convert the module's taints value to a 1-1 character mapping. - Relies on statically defined taints mappings in the framework. - - Args: - taints: The taints value, represented by an integer - is_module: Indicates if the taints value is associated with a built-in/LKM module - - Returns: - The raw taints string. - """ - taints_string = "" - for char, taint_flag in linux_constants.TAINT_FLAGS.items(): - if is_module and is_module != taint_flag.module: - continue - - if taints & taint_flag.shift: - taints_string += char - - return taints_string - - def _module_flags_taint_post_4_10_rc1( - self, taints: int, is_module: bool = False - ) -> str: - """Convert the module's taints value to a 1-1 character mapping. - Relies on kernel symbol embedded taints definitions. - - struct taint_flag { - char c_true; /* character printed when tainted */ - char c_false; /* character printed when not tainted */ - bool module; /* also show as a per-module taint flag */ - }; - - Args: - taints: The taints value, represented by an integer - is_module: Indicates if the taints value is associated with a built-in/LKM module - - Returns: - The raw taints string. - """ - taints_string = "" - for i, taint_flag in enumerate(self.kernel_taint_flags_list): - if is_module and is_module != taint_flag.module: - continue - c_true = chr(taint_flag.c_true) - c_false = chr(taint_flag.c_false) - if taints & (1 << i): - taints_string += c_true - elif c_false != " ": - taints_string += c_false - - return taints_string - - def get_taints_as_plain_string(self, taints: int, is_module: bool = False) -> str: - """Convert the taints value to a 1-1 character mapping. - - Args: - taints: The taints value, represented by an integer - is_module: Indicates if the taints value is associated with a built-in/LKM module - s - Returns: - The raw taints string. - - Documentation: - - module_flags_taint kernel function - """ - - if self.kernel_taint_flags_list: - return self._module_flags_taint_post_4_10_rc1(taints, is_module) - return self._module_flags_taint_pre_4_10_rc1(taints, is_module) - - def get_taints_parsed(self, taints: int, is_module: bool = False) -> List[str]: - """Convert the taints string to a 1-1 descriptor mapping. - - Args: - taints: The taints value, represented by an integer - is_module: Indicates if the taints value is associated with a built-in/LKM module - - Returns: - A comprehensive (user-friendly) taint descriptor list. - - Documentation: - - module_flags_taint kernel function - """ - comprehensive_taints = [] - for character in self.get_taints_as_plain_string(taints, is_module): - taint_flag = linux_constants.TAINT_FLAGS.get(character) - if not taint_flag: - comprehensive_taints.append(f"") - elif taint_flag.when_present: - comprehensive_taints.append(taint_flag.desc) - - return comprehensive_taints From 2a5f38ebad48e0d729b3b22caac84bd4209f20a2 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 16:39:07 +0100 Subject: [PATCH 0306/1352] introduce versioned Linux utilities --- .../framework/symbols/linux/utilities/__init__.py | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 volatility3/framework/symbols/linux/utilities/__init__.py diff --git a/volatility3/framework/symbols/linux/utilities/__init__.py b/volatility3/framework/symbols/linux/utilities/__init__.py new file mode 100644 index 000000000..4225d444b --- /dev/null +++ b/volatility3/framework/symbols/linux/utilities/__init__.py @@ -0,0 +1,11 @@ +from volatility3 import framework +from volatility3.framework import interfaces + + +class LinuxUtilityInterface(interfaces.configuration.VersionableInterface): + """Class with multiple useful Linux functions surrounding a specific piece of functionality.""" + + _version = (2, 1, 1) + _required_framework_version = (2, 0, 0) + + framework.require_interface_version(*_required_framework_version) From 8bc62598f4530bdf2fb99aeb725e5b8f3e0d8cd5 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 16:39:57 +0100 Subject: [PATCH 0307/1352] initial tainting utilities --- .../symbols/linux/utilities/tainting.py | 130 ++++++++++++++++++ 1 file changed, 130 insertions(+) create mode 100644 volatility3/framework/symbols/linux/utilities/tainting.py diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py new file mode 100644 index 000000000..e6d75a963 --- /dev/null +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -0,0 +1,130 @@ +from volatility3 import framework +from volatility3.framework import interfaces +from volatility3.framework.symbols.linux.utilities import LinuxUtilityInterface +from volatility3.framework.constants import linux as linux_constants +from typing import List, Optional + + +class Tainting(LinuxUtilityInterface): + """Tainted kernel and modules parsing capabilities. + + Relevant Linux kernel functions: + - modules: module_flags_taint + - kernel: print_tainted + """ + + _version = (1, 0, 0) + _required_framework_version = (2, 14, 0) + + framework.require_interface_version(*_required_framework_version) + + def __init__( + self, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + ): + self.kernel = context.modules[kernel_module_name] + + @property + def _kernel_taint_flags_list( + self, + ) -> Optional[List[interfaces.objects.ObjectInterface]]: + if self.kernel.has_symbol("taint_flags"): + return list(self.kernel.object_from_symbol("taint_flags")) + return None + + def _module_flags_taint_pre_4_10_rc1( + self, taints: int, is_module: bool = False + ) -> str: + """Convert the module's taints value to a 1-1 character mapping. + Relies on statically defined taints mappings in the framework. + + Args: + taints: The taints value, represented by an integer + is_module: Indicates if the taints value is associated with a built-in/LKM module + + Returns: + The raw taints string. + """ + taints_string = "" + for char, taint_flag in linux_constants.TAINT_FLAGS.items(): + if is_module and is_module != taint_flag.module: + continue + + if taints & taint_flag.shift: + taints_string += char + + return taints_string + + def _module_flags_taint_post_4_10_rc1( + self, taints: int, is_module: bool = False + ) -> str: + """Convert the module's taints value to a 1-1 character mapping. + Relies on kernel symbol embedded taints definitions. + + struct taint_flag { + char c_true; /* character printed when tainted */ + char c_false; /* character printed when not tainted */ + bool module; /* also show as a per-module taint flag */ + }; + + Args: + taints: The taints value, represented by an integer + is_module: Indicates if the taints value is associated with a built-in/LKM module + + Returns: + The raw taints string. + """ + taints_string = "" + for i, taint_flag in enumerate(self._kernel_taint_flags_list): + if is_module and is_module != taint_flag.module: + continue + c_true = chr(taint_flag.c_true) + c_false = chr(taint_flag.c_false) + if taints & (1 << i): + taints_string += c_true + elif c_false != " ": + taints_string += c_false + + return taints_string + + def get_taints_as_plain_string(self, taints: int, is_module: bool = False) -> str: + """Convert the taints value to a 1-1 character mapping. + + Args: + taints: The taints value, represented by an integer + is_module: Indicates if the taints value is associated with a built-in/LKM module + s + Returns: + The raw taints string. + + Documentation: + - module_flags_taint kernel function + """ + + if self._kernel_taint_flags_list: + return self._module_flags_taint_post_4_10_rc1(taints, is_module) + return self._module_flags_taint_pre_4_10_rc1(taints, is_module) + + def get_taints_parsed(self, taints: int, is_module: bool = False) -> List[str]: + """Convert the taints string to a 1-1 descriptor mapping. + + Args: + taints: The taints value, represented by an integer + is_module: Indicates if the taints value is associated with a built-in/LKM module + + Returns: + A comprehensive (user-friendly) taint descriptor list. + + Documentation: + - module_flags_taint kernel function + """ + comprehensive_taints = [] + for character in self.get_taints_as_plain_string(taints, is_module): + taint_flag = linux_constants.TAINT_FLAGS.get(character) + if not taint_flag: + comprehensive_taints.append(f"") + elif taint_flag.when_present: + comprehensive_taints.append(taint_flag.desc) + + return comprehensive_taints From 3105a31964a1a36420281bd995d983a81b161e97 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 16:40:49 +0100 Subject: [PATCH 0308/1352] leverage Tainting from separated Linux utilities --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 075a83ae8..ac07d2def 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -19,7 +19,7 @@ from volatility3.framework.layers import linear from volatility3.framework.objects import utility from volatility3.framework.symbols import generic, linux, intermed from volatility3.framework.symbols.linux.extensions import elf - +from volatility3.framework.symbols.linux.utilities import tainting vollog = logging.getLogger(__name__) @@ -286,7 +286,7 @@ class module(generic.GenericIntelProcess): Returns: The raw taints string. """ - return linux.Tainting( + return tainting.Tainting( self._context, linux.LinuxUtilities.get_module_from_volobj_type(self._context, self).name, ).get_taints_as_plain_string(self.taints, True) @@ -298,7 +298,7 @@ class module(generic.GenericIntelProcess): Returns: A comprehensive (user-friendly) taint descriptor list. """ - return linux.Tainting( + return tainting.Tainting( self._context, linux.LinuxUtilities.get_module_from_volobj_type(self._context, self).name, ).get_taints_parsed(self.taints, True) From 6e4213e321b96dd8f0b35df6c87aa8426698a42c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 16:41:37 +0100 Subject: [PATCH 0309/1352] update tainting requirements to new versioned utilities --- volatility3/framework/plugins/linux/modxview.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index d79f5e7a9..c97864a87 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -9,6 +9,7 @@ from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue from volatility3.framework.symbols.linux import extensions from volatility3.framework.constants import architectures +from volatility3.framework.symbols.linux.utilities import tainting vollog = logging.getLogger(__name__) @@ -18,7 +19,7 @@ class Modxview(interfaces.plugins.PluginInterface): spot modules presence and taints.""" _version = (1, 0, 0) - _required_framework_version = (2, 11, 0) + _required_framework_version = (2, 14, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -28,6 +29,9 @@ class Modxview(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), + requirements.VersionRequirement( + name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) + ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) ), From 0a3502697cca4dac2ac2f39896ecfaaef507ac9b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 16:42:16 +0100 Subject: [PATCH 0310/1352] 2.13.0 -> 2.14.0 bump --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 11edc07d8..9ca2d0a5b 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 13 # Number of changes that only add to the interface +VERSION_MINOR = 14 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From 89b8da8c39fe14f699d711c95a8311ec1e21331e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 2 Jan 2025 16:48:22 +0100 Subject: [PATCH 0311/1352] make self.kernel private and call parent __init__ --- .../framework/symbols/linux/utilities/tainting.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index e6d75a963..603215961 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -22,15 +22,18 @@ class Tainting(LinuxUtilityInterface): self, context: interfaces.context.ContextInterface, kernel_module_name: str, + *args, + **kwargs, ): - self.kernel = context.modules[kernel_module_name] + super().__init__(*args, **kwargs) + self._kernel = context.modules[kernel_module_name] @property def _kernel_taint_flags_list( self, ) -> Optional[List[interfaces.objects.ObjectInterface]]: - if self.kernel.has_symbol("taint_flags"): - return list(self.kernel.object_from_symbol("taint_flags")) + if self._kernel.has_symbol("taint_flags"): + return list(self._kernel.object_from_symbol("taint_flags")) return None def _module_flags_taint_pre_4_10_rc1( From d2bb5c9f31d7f01fe2e343867c0c7c1926b3ac50 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 3 Jan 2025 10:01:37 +1100 Subject: [PATCH 0312/1352] linux: fix kmsg fstring bug introduced in #1502 --- volatility3/framework/plugins/linux/kmsg.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index 894ca575f..30f67b319 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -149,7 +149,7 @@ class ABCKmsg(ABC): # This might seem insignificant but it could cause some issues # when compared with userland tool results or when used in # timelines. - return f"{nsec / 1000000000}.{(nsec % 1000000000) / 1000:06}" + return f"{nsec // 1000000000}.{(nsec % 1000000000) // 1000:06}" def get_timestamp_in_sec_str(self, obj) -> str: # obj could be log, printk_log or printk_info From 4a34b988d1e4cb02e33e555c3e2ed63d808e5028 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 3 Jan 2025 13:21:09 +0100 Subject: [PATCH 0313/1352] minor readability adjustments --- .../framework/symbols/linux/utilities/tainting.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index 603215961..f7f6c83ec 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -51,7 +51,7 @@ class Tainting(LinuxUtilityInterface): """ taints_string = "" for char, taint_flag in linux_constants.TAINT_FLAGS.items(): - if is_module and is_module != taint_flag.module: + if is_module and not taint_flag.module: continue if taints & taint_flag.shift: @@ -79,12 +79,12 @@ class Tainting(LinuxUtilityInterface): The raw taints string. """ taints_string = "" - for i, taint_flag in enumerate(self._kernel_taint_flags_list): - if is_module and is_module != taint_flag.module: + for taint_bit, taint_flag in enumerate(self._kernel_taint_flags_list): + if is_module and not taint_flag.module: continue c_true = chr(taint_flag.c_true) c_false = chr(taint_flag.c_false) - if taints & (1 << i): + if taints & (1 << taint_bit): taints_string += c_true elif c_false != " ": taints_string += c_false @@ -97,7 +97,6 @@ class Tainting(LinuxUtilityInterface): Args: taints: The taints value, represented by an integer is_module: Indicates if the taints value is associated with a built-in/LKM module - s Returns: The raw taints string. From 38c5cc168f93a4d1a5cab2a6c9b071cf32e22fc2 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 3 Jan 2025 13:23:27 +0100 Subject: [PATCH 0314/1352] bump framework req to 2.16.0 --- volatility3/framework/plugins/linux/modxview.py | 2 +- volatility3/framework/symbols/linux/utilities/tainting.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index c97864a87..042930740 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -19,7 +19,7 @@ class Modxview(interfaces.plugins.PluginInterface): spot modules presence and taints.""" _version = (1, 0, 0) - _required_framework_version = (2, 14, 0) + _required_framework_version = (2, 16, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index f7f6c83ec..fc2f94109 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -14,7 +14,7 @@ class Tainting(LinuxUtilityInterface): """ _version = (1, 0, 0) - _required_framework_version = (2, 14, 0) + _required_framework_version = (2, 16, 0) framework.require_interface_version(*_required_framework_version) From 32ca62bbb1205b11be0338e741e3046d503153a8 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Fri, 3 Jan 2025 15:20:35 +0000 Subject: [PATCH 0315/1352] Make f-string slightly more readable --- .../framework/plugins/windows/shimcachemem.py | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index b8e9b5bd7..9d968c30a 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -305,14 +305,14 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf If a number of validity checks are passed, this method will return the `SHIM_CACHE_HEAD` object. Otherwise, `None` is returned. """ - # print("checking RTL_AVL_TABLE at offset %s" % hex(offset)) + # Check RTL_AVL_TABLE at offset rtl_avl_table = context.object( symbol_table + constants.BANG + "_RTL_AVL_TABLE", layer_name, offset ) if not rtl_avl_table.is_valid(mod_page_start, mod_page_end): return None - vollog.debug(f"Candidate RTL_AVL_TABLE found at offset {hex(offset)}") + vollog.debug(f"Candidate RTL_AVL_TABLE found at offset {offset:#x}") ersrc_size = context.symbol_space.get_type( kernel_symbol_table + constants.BANG + "_ERESOURCE" @@ -324,13 +324,13 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf # 0x20 if context.symbol_space.get_type("pointer").size == 8 else 0x10 ) vollog.debug( - f"ERESOURCE size: {hex(ersrc_size)}, ERESOURCE alignment: {hex(ersrc_alignment)}" + f"ERESOURCE size: {ersrc_size:#x}, ERESOURCE alignment: {ersrc_alignment:#x}" ) eresource_rel_off = ersrc_size + ((offset - ersrc_size) % ersrc_alignment) eresource_offset = offset - eresource_rel_off - vollog.debug(f"Constructing ERESOURCE at {hex(eresource_offset)}") + vollog.debug(f"Constructing ERESOURCE at {eresource_offset:#x}") eresource = context.object( kernel_symbol_table + constants.BANG + "_ERESOURCE", layer_name, @@ -408,8 +408,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf # iterate over ahcache kernel module's .data section in search of *two* SHIM handles shim_heads = [] - vollog.debug(f"PAGE offset: {hex(mod_page_offset)}") - vollog.debug(f".data offset: {hex(data_sec_offset)}") + vollog.debug(f"PAGE offset: {mod_page_offset:#x}") + vollog.debug(f".data offset: {data_sec_offset:#x}") handle_type = context.symbol_space.get_type( shimcache_symbol_table + constants.BANG + "SHIM_CACHE_HANDLE" @@ -419,7 +419,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf data_sec_offset + data_sec_size, 8 if symbols.symbol_table_is_64bit(context, nt_symbol_table) else 4, ): - vollog.debug(f"Building shim handle pointer at {hex(offset)}") + vollog.debug(f"Building shim handle pointer at {offset:#x}") shim_handle = context.object( object_type=shimcache_symbol_table + constants.BANG + "pointer", layer_name=kernel_layer_name, @@ -430,7 +430,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf if shim_handle.is_valid(mod_page_offset, mod_page_offset + mod_page_size): if shim_handle.head is not None: vollog.debug( - f"Found valid shim handle @ {hex(shim_handle.vol.offset)}" + f"Found valid shim handle @ {shim_handle.vol.offset:#x}" ) shim_heads.append(shim_handle.head) if len(shim_heads) == 2: @@ -440,7 +440,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf vollog.debug("Failed to identify two valid SHIM_CACHE_HANDLE structures") return - # On Windows 8 x64, the frist cache contains the shim cache + # On Windows 8 x64, the first cache contains the shim cache. # On Windows 8 x86, 8.1 x86/x64, and 10, the second cache contains the shim cache. if ( not symbols.symbol_table_is_64bit(context, nt_symbol_table) From 03049f789559af5c4cdb56f343460178b52220f9 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 3 Jan 2025 18:40:52 +0000 Subject: [PATCH 0316/1352] Add missing exception handling in env var recovery. Prevent backtraces --- volatility3/framework/plugins/linux/envars.py | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index 8cdbfe493..04b75c8a8 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -5,7 +5,7 @@ import logging from typing import Iterable, Tuple -from volatility3.framework import renderers, interfaces +from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -58,10 +58,16 @@ class Envars(plugins.PluginInterface): Tuples of (key, value) representing each environment variable. """ - task_name = utility.array_to_string(task.comm) + # This ensures the `task` is valid as well as its + # memory mapping structures + try: + task_name = utility.array_to_string(task.comm) + env_start = task.mm.env_start + env_end = task.mm.env_end + except exceptions.InvalidAddressException: + return None + task_pid = task.pid - env_start = task.mm.env_start - env_end = task.mm.env_end env_area_size = env_end - env_start if not (0 < env_area_size <= env_area_max_size): vollog.debug( From 8ba60a2aaddf86e4cbd065c95d2553ce221db183 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 4 Jan 2025 16:49:02 +0000 Subject: [PATCH 0317/1352] Change add_process_layer to return None instead of throwing an exception as it was meant to be designed --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index b02f80433..df1c00e3d 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -324,9 +324,11 @@ class task_struct(generic.GenericIntelProcess): raise TypeError( "Parent layer is not a translation layer, unable to construct process layer" ) - dtb, layer_name = parent_layer.translate(pgd) - if not dtb: + try: + dtb, layer_name = parent_layer.translate(pgd) + except exceptions.InvalidAddressException: return None + if preferred_name is None: preferred_name = self.vol.layer_name + f"_Process{self.pid}" # Add the constructed layer and return the name From 5f1d318c715311ed12d67bde5a87a8a78e0d3bf0 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 5 Jan 2025 13:39:00 +0000 Subject: [PATCH 0318/1352] Tiny comment changes --- volatility3/framework/plugins/windows/cmdscan.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index 9645ee507..3dc70d649 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -67,6 +67,7 @@ class CmdScan(interfaces.plugins.PluginInterface): Args: conhost_proc: the process object for conhost.exe + size_filter: filter (keep) vads less than this size (bytes) Returns: A list of tuples of: @@ -100,7 +101,7 @@ class CmdScan(interfaces.plugins.PluginInterface): kernel_symbol_table_name: The name of the table containing the kernel symbols config_path: The config path where to find symbol files procs: list of process objects - max_history: an initial set of CommandHistorySize values + max_history: An initial set of CommandHistorySize values Returns: The conhost process object, the command history structure, a dictionary of properties for @@ -227,7 +228,6 @@ class CmdScan(interfaces.plugins.PluginInterface): "data": command_history.CommandCountMax, } ) - command_history_properties.append( { "level": 1, @@ -236,6 +236,7 @@ class CmdScan(interfaces.plugins.PluginInterface): "data": "", } ) + for ( cmd_index, bucket_cmd, @@ -352,7 +353,7 @@ class CmdScan(interfaces.plugins.PluginInterface): def _conhost_proc_filter(self, proc: interfaces.objects.ObjectInterface): """ - Used to filter to only conhost.exe processes + Used to filter only conhost.exe processes """ process_name = utility.array_to_string(proc.ImageFileName) From ab60add9933ee3863c3f2329d2c99af314b5b453 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 5 Jan 2025 17:14:21 +0000 Subject: [PATCH 0319/1352] Update case insensitive check Update link and use casefold() instead of lower(). --- volatility3/framework/layers/registry.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index c684ccd40..6d85da982 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -192,9 +192,9 @@ class RegistryHive(linear.LinearlyMappedLayer): while key_array and node_key: subkeys = node_key[-1].get_subkeys() for subkey in subkeys: - # registry keys are not case sensitive so compare lowercase - # https://msdn.microsoft.com/en-us/library/windows/desktop/ms724946(v=vs.85).aspx - if subkey.get_name().lower() == key_array[0].lower(): + # registry keys are not case sensitive so compare likewise + # https://learn.microsoft.com/en-gb/windows/win32/sysinfo/structure-of-the-registry + if subkey.get_name().casefold() == key_array[0].casefold(): node_key = node_key + [subkey] found_key, key_array = found_key + [key_array[0]], key_array[1:] break From 8f4f576e93a7594666f0e58f8ae73cce5538902c Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 5 Jan 2025 21:09:15 +0000 Subject: [PATCH 0320/1352] Update case insensitive check Update link and use casefold() instead of lower(). --- volatility3/framework/layers/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 6d85da982..21e1a938e 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -193,7 +193,7 @@ class RegistryHive(linear.LinearlyMappedLayer): subkeys = node_key[-1].get_subkeys() for subkey in subkeys: # registry keys are not case sensitive so compare likewise - # https://learn.microsoft.com/en-gb/windows/win32/sysinfo/structure-of-the-registry + # https://learn.microsoft.com/en-us/windows/win32/sysinfo/structure-of-the-registry if subkey.get_name().casefold() == key_array[0].casefold(): node_key = node_key + [subkey] found_key, key_array = found_key + [key_array[0]], key_array[1:] From 94ec7d89c09b2a276e79fc4c7561828340d5712a Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 5 Jan 2025 21:55:58 +0000 Subject: [PATCH 0321/1352] Tiny comment changes --- volatility3/framework/plugins/windows/cmdscan.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index 3dc70d649..0cd0addb2 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -67,7 +67,7 @@ class CmdScan(interfaces.plugins.PluginInterface): Args: conhost_proc: the process object for conhost.exe - size_filter: filter (keep) vads less than this size (bytes) + size_filter: size above which vads will not be returned Returns: A list of tuples of: @@ -100,7 +100,7 @@ class CmdScan(interfaces.plugins.PluginInterface): kernel_layer_name: The name of the layer on which to operate kernel_symbol_table_name: The name of the table containing the kernel symbols config_path: The config path where to find symbol files - procs: list of process objects + procs: List of process objects max_history: An initial set of CommandHistorySize values Returns: From a7b4e2fb45bef981eb54c44a5e0cef87b879058f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 6 Jan 2025 00:02:15 +0100 Subject: [PATCH 0322/1352] version check_modules --- volatility3/framework/plugins/linux/check_modules.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 9b3594c5e..0ed638d9c 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -18,6 +18,7 @@ vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" + _version = (1, 0, 0) _required_framework_version = (2, 0, 0) @classmethod From 2d262e7acf5c9aabb32240c01cd57890b7d57647 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 6 Jan 2025 00:20:56 +0100 Subject: [PATCH 0323/1352] cut unnecessary intermediate LinuxUtilityInterface --- .../framework/symbols/linux/utilities/__init__.py | 11 ----------- .../framework/symbols/linux/utilities/tainting.py | 5 ++--- 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/__init__.py b/volatility3/framework/symbols/linux/utilities/__init__.py index 4225d444b..e69de29bb 100644 --- a/volatility3/framework/symbols/linux/utilities/__init__.py +++ b/volatility3/framework/symbols/linux/utilities/__init__.py @@ -1,11 +0,0 @@ -from volatility3 import framework -from volatility3.framework import interfaces - - -class LinuxUtilityInterface(interfaces.configuration.VersionableInterface): - """Class with multiple useful Linux functions surrounding a specific piece of functionality.""" - - _version = (2, 1, 1) - _required_framework_version = (2, 0, 0) - - framework.require_interface_version(*_required_framework_version) diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index fc2f94109..29d7d2b5b 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -1,11 +1,10 @@ from volatility3 import framework from volatility3.framework import interfaces -from volatility3.framework.symbols.linux.utilities import LinuxUtilityInterface from volatility3.framework.constants import linux as linux_constants from typing import List, Optional -class Tainting(LinuxUtilityInterface): +class Tainting(interfaces.configuration.VersionableInterface): """Tainted kernel and modules parsing capabilities. Relevant Linux kernel functions: @@ -14,7 +13,7 @@ class Tainting(LinuxUtilityInterface): """ _version = (1, 0, 0) - _required_framework_version = (2, 16, 0) + _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) From 5c70356c27aedc931c03a8e633952b126ef5254b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 6 Jan 2025 00:23:16 +0100 Subject: [PATCH 0324/1352] version check_modules requirement --- volatility3/framework/plugins/linux/modxview.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 042930740..b44f84c7d 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -38,7 +38,7 @@ class Modxview(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="check_modules", plugin=check_modules.Check_modules, - version=(0, 0, 0), + version=(1, 0, 0), ), requirements.PluginRequirement( name="hidden_modules", From 302f9fdf5ba1c24d07d2fce3d0f7c87c3e6bd1f2 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 6 Jan 2025 00:24:18 +0100 Subject: [PATCH 0325/1352] cut unnecessary plugin runner functions --- .../framework/plugins/linux/modxview.py | 78 ++++++------------- 1 file changed, 25 insertions(+), 53 deletions(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index b44f84c7d..a247bc2cc 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -53,54 +53,6 @@ class Modxview(interfaces.plugins.PluginInterface): ), ] - @classmethod - def run_lsmod( - cls, context: interfaces.context.ContextInterface, kernel_name: str - ) -> List[extensions.module]: - """Wrapper for the lsmod plugin.""" - return list(lsmod.Lsmod.list_modules(context, kernel_name)) - - @classmethod - def run_check_modules( - cls, - context: interfaces.context.ContextInterface, - kernel_name: str, - ) -> List[extensions.module]: - """Wrapper for the check_modules plugin. - Here, we extract the /sys/module/ list.""" - kernel = context.modules[kernel_name] - sysfs_modules: dict = check_modules.Check_modules.get_kset_modules( - context, kernel_name - ) - - # Convert get_kset_modules() offsets back to module objects - return [ - kernel.object(object_type="module", offset=m_offset, absolute=True) - for m_offset in sysfs_modules.values() - ] - - @classmethod - def run_hidden_modules( - cls, - context: interfaces.context.ContextInterface, - kernel_name: str, - known_modules_addresses: Set[int], - ) -> List[extensions.module]: - """Wrapper for the hidden_modules plugin.""" - modules_memory_boundaries = ( - hidden_modules.Hidden_modules.get_modules_memory_boundaries( - context, kernel_name - ) - ) - return list( - hidden_modules.Hidden_modules.get_hidden_modules( - context, - kernel_name, - known_modules_addresses, - modules_memory_boundaries, - ) - ) - @classmethod def flatten_run_modules_results( cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True @@ -140,15 +92,35 @@ class Modxview(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_name] run_results = {} - run_results["lsmod"] = cls.run_lsmod(context, kernel_name) - run_results["check_modules"] = cls.run_check_modules(context, kernel_name) + # lsmod + run_results["lsmod"] = list(lsmod.Lsmod.list_modules(context, kernel_name)) + # check_modules + sysfs_modules: dict = check_modules.Check_modules.get_kset_modules( + context, kernel_name + ) + ## Convert get_kset_modules() offsets back to module objects + run_results["check_modules"] = [ + kernel.object(object_type="module", offset=m_offset, absolute=True) + for m_offset in sysfs_modules.values() + ] + # hidden_modules if run_hidden_modules: - known_module_addresses = set( + known_modules_addresses = set( context.layers[kernel.layer_name].canonicalize(module.vol.offset) for module in run_results["lsmod"] + run_results["check_modules"] ) - run_results["hidden_modules"] = cls.run_hidden_modules( - context, kernel_name, known_module_addresses + modules_memory_boundaries = ( + hidden_modules.Hidden_modules.get_modules_memory_boundaries( + context, kernel_name + ) + ) + run_results["hidden_modules"] = list( + hidden_modules.Hidden_modules.get_hidden_modules( + context, + kernel_name, + known_modules_addresses, + modules_memory_boundaries, + ) ) return run_results From 4115c26e7cc119a68aa33fff7f5b8a730b5b2c69 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 6 Jan 2025 00:24:44 +0100 Subject: [PATCH 0326/1352] bump framework req to 2.18.0 --- volatility3/framework/plugins/linux/modxview.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index a247bc2cc..34f5bac8f 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -19,7 +19,7 @@ class Modxview(interfaces.plugins.PluginInterface): spot modules presence and taints.""" _version = (1, 0, 0) - _required_framework_version = (2, 16, 0) + _required_framework_version = (2, 18, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From bd82f4f33d860cb067e379600da5bbc74f9e2247 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 6 Jan 2025 00:25:07 +0100 Subject: [PATCH 0327/1352] 2.16.0 -> 2.18.0 bump --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 24f96fa89..832b2a5ba 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 16 # Number of changes that only add to the interface +VERSION_MINOR = 18 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From d956742db98610dfa94678ffb98d53c5b6bcd161 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 6 Jan 2025 00:31:39 +0100 Subject: [PATCH 0328/1352] remove typing.Set import --- volatility3/framework/plugins/linux/modxview.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 34f5bac8f..3655200e8 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Dict, Set, Iterator +from typing import List, Dict, Iterator from volatility3.plugins.linux import lsmod, check_modules, hidden_modules from volatility3.framework import interfaces from volatility3.framework.configuration import requirements From b5bc54cfaed91f4d615790305c80ce802658dafe Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 7 Jan 2025 15:18:34 +0000 Subject: [PATCH 0329/1352] Use in-place subtraction Also tweak comments. --- volatility3/framework/renderers/conversion.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/renderers/conversion.py b/volatility3/framework/renderers/conversion.py index e48684b31..f848b2dad 100644 --- a/volatility3/framework/renderers/conversion.py +++ b/volatility3/framework/renderers/conversion.py @@ -18,7 +18,7 @@ def wintime_to_datetime( unix_time = wintime // 10000000 if unix_time == 0: return renderers.NotApplicableValue() - unix_time = unix_time - 11644473600 + unix_time -= 11644473600 try: return datetime.datetime.fromtimestamp(unix_time, datetime.timezone.utc) # Windows sometimes throws OSErrors rather than ValueError/OverflowError when it can't convert a value @@ -71,7 +71,7 @@ def round(addr: int, align: int, up: bool = False) -> int: Args: addr: the address align: the alignment value - up: Whether to round up or not + up: whether to round up or not Returns: The aligned address @@ -122,11 +122,12 @@ def convert_port(port_as_integer): def convert_network_four_tuple(family, four_tuple): - """Converts the connection four_tuple: (source ip, source port, dest ip, - dest port) + """Converts the connection four_tuple: + + (source ip, source port, dest ip, dest port) into their string equivalents. IP addresses are expected as a tuple - of unsigned shorts Ports are converted to proper endianness as well + of unsigned shorts. Ports are converted to proper endianness as well. """ if family == socket.AF_INET: From 43ac6c4d6271c928d9bcdaf6407e01e1c96d7cf9 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 7 Jan 2025 10:24:46 -0600 Subject: [PATCH 0330/1352] Fix copy-pasted module docstrings This updates the module docstrings for 5 modules that duplicate the docstring from the `proc` module. This was presumably the result of using the `proc` module as a template for the others. --- volatility3/framework/plugins/linux/bash.py | 4 ++-- volatility3/framework/plugins/linux/check_afinfo.py | 4 ++-- volatility3/framework/plugins/linux/check_syscall.py | 3 +-- volatility3/framework/plugins/linux/elfs.py | 4 ++-- volatility3/framework/plugins/linux/lsmod.py | 3 +-- 5 files changed, 8 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 056e3cd51..8acfeb848 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -1,8 +1,8 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -"""A module containing a collection of plugins that produce data typically -found in Linux's /proc file system.""" +"""A module containing a plugin that recovers bash command history +from bash process memory.""" import datetime import struct diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index 201a443f7..7aa3cbdd2 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -1,8 +1,8 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -"""A module containing a collection of plugins that produce data typically -found in Linux's /proc file system.""" +"""A module containing a plugin that verifies the operation function +pointers of network protocols.""" import logging from typing import List diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index 3537a9fa1..13d312f2f 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -1,8 +1,7 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -"""A module containing a collection of plugins that produce data typically -found in Linux's /proc file system.""" +"""A module containing a plugin that checks the system call table for hooks.""" import contextlib import logging from typing import List diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index 2fd740941..0d1c9c2dd 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -1,8 +1,8 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -"""A module containing a collection of plugins that produce data typically -found in Linux's /proc file system.""" +"""A module containing a plugin for enumerating memory-mapped +ELF files across all processes.""" import logging from typing import List, Optional, Type diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 49e990e93..e9a2a7137 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -1,8 +1,7 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -"""A module containing a collection of plugins that produce data typically -found in Linux's /proc file system.""" +"""A module containing a plugin that lists loaded kernel modules.""" import logging from typing import List, Iterable From 32cb6e11f6abe86ce5284e1a618bae9ab1cd4a5f Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Tue, 7 Jan 2025 19:41:02 +0000 Subject: [PATCH 0331/1352] Change one letter of a typo --- volatility3/framework/plugins/windows/driverscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index 24d81c3d5..d388ffbb7 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -64,7 +64,7 @@ class DriverScan(interfaces.plugins.PluginInterface): names associated with a driver Args: - driver: A Eriver object + driver: A Driver object Returns: A tuple of strings of (driver name, service key, driver alt. name) From 0860441c2fc5a5a97902a7582473d8462c457bc3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 9 Jan 2025 17:11:02 +0000 Subject: [PATCH 0332/1352] Core: Improve speed to JSONSchema validation --- pyproject.toml | 3 +-- volatility3/framework/plugins/isfinfo.py | 2 +- volatility3/schemas/__init__.py | 16 +++++++++++++--- 3 files changed, 15 insertions(+), 6 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 86e3921d2..af22cbe0a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -33,10 +33,9 @@ cloud = [ dev = [ "volatility3[full,cloud]", - "jsonschema>=4.23.0,<5", + "fastjsonschema>=2.21.1,<3", "pyinstaller>=6.11.0,<7", "pyinstaller-hooks-contrib>=2024.9", - "types-jsonschema>=4.23.0,<5", ] test = [ diff --git a/volatility3/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py index 1c2ac52e9..34b0a5653 100644 --- a/volatility3/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -97,7 +97,7 @@ class IsfInfo(plugins.PluginInterface): if filter_item in isf_file: filtered_list.append(isf_file) - if find_spec("jsonschema") and self.config["validate"]: + if find_spec("fastjsonschema") and self.config["validate"]: def check_valid(data): return "True" if schemas.validate(data, True) else "False" diff --git a/volatility3/schemas/__init__.py b/volatility3/schemas/__init__.py index 90cfaba48..3964e29a6 100644 --- a/volatility3/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -14,6 +14,8 @@ vollog = logging.getLogger(__name__) cached_validation_filepath = os.path.join(constants.CACHE_PATH, "valid_isf.hashcache") +validators = {} + def load_cached_validations() -> Set[str]: """Loads up the list of successfully cached json objects, so we don't need @@ -92,7 +94,12 @@ def valid( if input_hash in cached_validations and use_cache: return True try: - import jsonschema + import fastjsonschema + + schema_key = json.dumps(schema, sort_keys=True) + if schema_key not in validators: + validator = fastjsonschema.compile(schema) + validators[schema_key] = validator except ImportError: vollog.info("Dependency for validation unavailable: jsonschema") vollog.debug("All validations will report success, even with malformed input") @@ -100,10 +107,13 @@ def valid( try: vollog.debug("Validating JSON against schema...") - jsonschema.validate(input, schema) + validators[schema_key](input) + import pdb + + pdb.set_trace() cached_validations.add(input_hash) vollog.debug("JSON validated against schema (result cached)") - except jsonschema.exceptions.SchemaError: + except fastjsonschema.JsonSchemaValueException: vollog.debug("Schema validation error", exc_info=True) return False From e676e6179a3cd9c8d6afb838560d7a9e4d3a5420 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 9 Jan 2025 18:08:22 +0000 Subject: [PATCH 0333/1352] Swap fastjsonschema for jsonschema because of date-time validation issues --- volatility3/schemas/__init__.py | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/volatility3/schemas/__init__.py b/volatility3/schemas/__init__.py index 3964e29a6..b94e0831d 100644 --- a/volatility3/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -94,11 +94,13 @@ def valid( if input_hash in cached_validations and use_cache: return True try: - import fastjsonschema + import jsonschema schema_key = json.dumps(schema, sort_keys=True) if schema_key not in validators: - validator = fastjsonschema.compile(schema) + validator_class = jsonschema.validators.validator_for(schema) + validator_class.check_schema(schema) + validator = validator_class(schema) validators[schema_key] = validator except ImportError: vollog.info("Dependency for validation unavailable: jsonschema") @@ -107,10 +109,7 @@ def valid( try: vollog.debug("Validating JSON against schema...") - validators[schema_key](input) - import pdb - - pdb.set_trace() + validators[schema_key].validate(input) cached_validations.add(input_hash) vollog.debug("JSON validated against schema (result cached)") except fastjsonschema.JsonSchemaValueException: From 21decf13708d882369cc1f8fa2884f5a8ae5494d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 9 Jan 2025 18:12:36 +0000 Subject: [PATCH 0334/1352] Core: Put the dependencies back for jsonschema --- pyproject.toml | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index af22cbe0a..fbdbf0a8a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,7 +1,15 @@ [project] name = "volatility3" description = "Memory forensics framework" -keywords = ["volatility", "memory", "forensics", "framework", "windows", "linux", "volshell"] +keywords = [ + "volatility", + "memory", + "forensics", + "framework", + "windows", + "linux", + "volshell", +] readme = "README.md" authors = [ { name = "Volatility Foundation", email = "volatility@volatilityfoundation.org" }, @@ -10,9 +18,7 @@ requires-python = ">=3.8.0" license = { text = "VSL" } dynamic = ["version"] -dependencies = [ - "pefile>=2024.8.26", -] +dependencies = ["pefile>=2024.8.26"] [project.optional-dependencies] full = [ @@ -26,16 +32,14 @@ full = [ "pillow>=10.0.0,<11.0.0", ] -cloud = [ - "gcsfs>=2024.10.0", - "s3fs>=2024.10.0", -] +cloud = ["gcsfs>=2024.10.0", "s3fs>=2024.10.0"] dev = [ "volatility3[full,cloud]", - "fastjsonschema>=2.21.1,<3", + "jsonschema>=4.23.0,<5", "pyinstaller>=6.11.0,<7", "pyinstaller-hooks-contrib>=2024.9", + "types-jsonschema>=4.23.0,<5", ] test = [ @@ -78,16 +82,16 @@ target-version = "py38" [tool.ruff.lint] select = [ - "F", # pyflakes - "E", # pycodestyle errors - "W", # pycodestyle warnings - "G", # flake8-logging-format - "PIE", # flake8-pie - "UP", # pyupgrade + "F", # pyflakes + "E", # pycodestyle errors + "W", # pycodestyle warnings + "G", # flake8-logging-format + "PIE", # flake8-pie + "UP", # pyupgrade ] ignore = [ - "E501", # ignore due to conflict with formatter + "E501", # ignore due to conflict with formatter ] [build-system] From d07d31047b2ed49a570aa4b3698f6a64145c2d83 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 9 Jan 2025 18:24:48 +0000 Subject: [PATCH 0335/1352] Core: Revert the exception catching too --- volatility3/schemas/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/schemas/__init__.py b/volatility3/schemas/__init__.py index b94e0831d..e894def9f 100644 --- a/volatility3/schemas/__init__.py +++ b/volatility3/schemas/__init__.py @@ -112,7 +112,7 @@ def valid( validators[schema_key].validate(input) cached_validations.add(input_hash) vollog.debug("JSON validated against schema (result cached)") - except fastjsonschema.JsonSchemaValueException: + except jsonschema.exceptions.SchemaError: vollog.debug("Schema validation error", exc_info=True) return False From 585901105275a015a3c4326e486f4e2a52d8eb12 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 10 Jan 2025 12:35:04 +0100 Subject: [PATCH 0336/1352] introduce customizable plugin arparse epilog --- volatility3/cli/__init__.py | 3 +++ volatility3/framework/interfaces/plugins.py | 2 ++ 2 files changed, 5 insertions(+) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 6172a17f3..87caaece6 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -368,6 +368,9 @@ class CommandLine: help=plugin_list[plugin].__doc__, description=plugin_list[plugin].__doc__, ) + epilog = getattr(plugin_list[plugin], "_argparse_epilog", None) + if epilog is not None: + plugin_parser.epilog = epilog self.populate_requirements_argparse(plugin_parser, plugin_list[plugin]) ### diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py index f763815a6..6cd72f02e 100644 --- a/volatility3/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -112,6 +112,8 @@ class PluginInterface( # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set) _required_framework_version: Tuple[int, int, int] = (0, 0, 0) """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules""" + _argparse_epilog: str = None + """Display additional description of the plugin after the description of the arguments. See: https://docs.python.org/3/library/argparse.html#epilog""" def __init__( self, From 530617a700e259f69d53f62f08ccc3382bcdd057 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Fri, 10 Jan 2025 11:52:54 +0000 Subject: [PATCH 0337/1352] Small readability improvements --- volatility3/framework/automagic/mac.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py index f3679d160..a883028d2 100644 --- a/volatility3/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -101,7 +101,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VVVV, - f"Skipping invalid idlepml4_ptr: 0x{idlepml4_ptr:0x}", + f"Skipping invalid idlepml4_ptr: {idlepml4_ptr:#x}", ) continue @@ -112,7 +112,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): if tmp_dtb % 4096: vollog.log( constants.LOGLEVEL_VVV, - f"Skipping non-page aligned DTB: 0x{tmp_dtb:0x}", + f"Skipping non-page aligned DTB: {tmp_dtb:#x}", ) continue @@ -136,7 +136,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): new_layer.config["kernel_virtual_offset"] = kaslr_shift if new_layer and dtb: - vollog.debug(f"DTB was found at: 0x{dtb:0x}") + vollog.debug(f"DTB was found at: {dtb:#x}") return new_layer vollog.debug("No suitable mac banner could be matched") return None @@ -182,7 +182,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): aslr_shift = 0 for offset, banner in offset_generator: - banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[0:2]) + banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2]) tmp_aslr_shift = offset - cls.virtual_to_physical_address( version_json_address @@ -208,7 +208,6 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): continue aslr_shift = tmp_aslr_shift & 0xFFFFFFFF - break vollog.log(constants.LOGLEVEL_VVVV, f"Mac find_aslr returned: {aslr_shift:0x}") @@ -219,9 +218,9 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): """Converts a virtual mac address to a physical one (does not account of ASLR)""" if addr > 0xFFFFFF8000000000: - addr = addr - 0xFFFFFF8000000000 + addr -= 0xFFFFFF8000000000 else: - addr = addr - 0xFF8000000000 + addr -= 0xFF8000000000 return addr From a7661d45e78b10bc736946425055755c9627d111 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 10 Jan 2025 09:21:21 -0600 Subject: [PATCH 0338/1352] Windows: Certificates - handle uncaught RegistryFormatException Changes variable import to module import, and catches an unhandled `RegistryFormatException` in certificates.py --- .../plugins/windows/registry/certificates.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 8587b3719..a83badb90 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -1,11 +1,11 @@ import contextlib import logging import struct -from typing import List, Iterator, Optional, Tuple, Type +from typing import Iterator, List, Optional, Tuple, Type from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist, printkey vollog = logging.getLogger(__name__) @@ -81,7 +81,11 @@ class Certificates(interfaces.plugins.PluginInterface): "Microsoft\\SystemCertificates", "Software\\Microsoft\\SystemCertificates", ]: - with contextlib.suppress(KeyError, exceptions.InvalidAddressException): + with contextlib.suppress( + KeyError, + registry.RegistryFormatException, + exceptions.InvalidAddressException, + ): # Walk it node_path = hive.get_key(top_key, return_list=True) for ( @@ -92,7 +96,11 @@ class Certificates(interfaces.plugins.PluginInterface): _volatility, node, ) in printkey.PrintKey.key_iterator(hive, node_path, recurse=True): - if not is_key and RegValueTypes(node.Type).name == "REG_BINARY": + if ( + not is_key + and registry.RegValueTypes(node.Type) + == registry.RegValueTypes.REG_BINARY + ): name, certificate_data = self.parse_data(node.decode_data()) unique_key_offset = ( key_path.casefold().index(top_key.casefold()) From 96eca6e0162a77699c2befcce6df16f7deac4d23 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 10 Jan 2025 19:38:07 +0100 Subject: [PATCH 0339/1352] more compact _argparse_epilog --- volatility3/cli/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 87caaece6..37923362a 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -368,9 +368,9 @@ class CommandLine: help=plugin_list[plugin].__doc__, description=plugin_list[plugin].__doc__, ) - epilog = getattr(plugin_list[plugin], "_argparse_epilog", None) - if epilog is not None: - plugin_parser.epilog = epilog + plugin_parser.epilog = getattr( + plugin_list[plugin], "_argparse_epilog", None + ) self.populate_requirements_argparse(plugin_parser, plugin_list[plugin]) ### From 615d1d5a2e85dcd2f9d65493690a474c15f691cd Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 10 Jan 2025 19:49:25 +0100 Subject: [PATCH 0340/1352] more compact _argparse_epilog --- volatility3/cli/__init__.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 37923362a..fde4fcc6d 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -367,9 +367,7 @@ class CommandLine: plugin, help=plugin_list[plugin].__doc__, description=plugin_list[plugin].__doc__, - ) - plugin_parser.epilog = getattr( - plugin_list[plugin], "_argparse_epilog", None + epilog=getattr(plugin_list[plugin], "_argparse_epilog", None), ) self.populate_requirements_argparse(plugin_parser, plugin_list[plugin]) From a26ff8fa6e6ba03a6ea3ebe6c5f3b38b3a4d8851 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Fri, 10 Jan 2025 19:03:51 +0000 Subject: [PATCH 0341/1352] Small readability improvements --- volatility3/framework/automagic/mac.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py index a883028d2..3b16eb353 100644 --- a/volatility3/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -184,12 +184,12 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): for offset, banner in offset_generator: banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2]) - tmp_aslr_shift = offset - cls.virtual_to_physical_address( + aslr_shift = offset - cls.virtual_to_physical_address( version_json_address ) major_string = context.layers[layer_name].read( - version_major_phys_offset + tmp_aslr_shift, 4 + version_major_phys_offset + aslr_shift, 4 ) major = struct.unpack(" Date: Fri, 10 Jan 2025 19:08:56 +0000 Subject: [PATCH 0342/1352] Small readability improvements --- volatility3/framework/automagic/mac.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py index 3b16eb353..94c259463 100644 --- a/volatility3/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -184,9 +184,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): for offset, banner in offset_generator: banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2]) - aslr_shift = offset - cls.virtual_to_physical_address( - version_json_address - ) + aslr_shift = offset - cls.virtual_to_physical_address(version_json_address) major_string = context.layers[layer_name].read( version_major_phys_offset + aslr_shift, 4 From 1cf0232d25fa6dffa21ae3c281e1f568bbb280ab Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 10 Jan 2025 21:19:31 +0100 Subject: [PATCH 0343/1352] less specific argparse epilog reference --- volatility3/cli/__init__.py | 2 +- volatility3/framework/interfaces/plugins.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index fde4fcc6d..82a2a4205 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -367,7 +367,7 @@ class CommandLine: plugin, help=plugin_list[plugin].__doc__, description=plugin_list[plugin].__doc__, - epilog=getattr(plugin_list[plugin], "_argparse_epilog", None), + epilog=plugin_list[plugin].additional_description, ) self.populate_requirements_argparse(plugin_parser, plugin_list[plugin]) diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py index 6cd72f02e..7ad78d0ba 100644 --- a/volatility3/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -112,7 +112,7 @@ class PluginInterface( # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set) _required_framework_version: Tuple[int, int, int] = (0, 0, 0) """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules""" - _argparse_epilog: str = None + additional_description: str = None """Display additional description of the plugin after the description of the arguments. See: https://docs.python.org/3/library/argparse.html#epilog""" def __init__( From 7913fb2bb0aac4cc390ce6e42ad6621115f0ae7c Mon Sep 17 00:00:00 2001 From: ikelos Date: Fri, 10 Jan 2025 21:07:08 +0000 Subject: [PATCH 0344/1352] Revert "Small readability improvements" --- volatility3/framework/automagic/mac.py | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/automagic/mac.py b/volatility3/framework/automagic/mac.py index 94c259463..f3679d160 100644 --- a/volatility3/framework/automagic/mac.py +++ b/volatility3/framework/automagic/mac.py @@ -101,7 +101,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VVVV, - f"Skipping invalid idlepml4_ptr: {idlepml4_ptr:#x}", + f"Skipping invalid idlepml4_ptr: 0x{idlepml4_ptr:0x}", ) continue @@ -112,7 +112,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): if tmp_dtb % 4096: vollog.log( constants.LOGLEVEL_VVV, - f"Skipping non-page aligned DTB: {tmp_dtb:#x}", + f"Skipping non-page aligned DTB: 0x{tmp_dtb:0x}", ) continue @@ -136,7 +136,7 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): new_layer.config["kernel_virtual_offset"] = kaslr_shift if new_layer and dtb: - vollog.debug(f"DTB was found at: {dtb:#x}") + vollog.debug(f"DTB was found at: 0x{dtb:0x}") return new_layer vollog.debug("No suitable mac banner could be matched") return None @@ -182,12 +182,14 @@ class MacIntelStacker(interfaces.automagic.StackerLayerInterface): aslr_shift = 0 for offset, banner in offset_generator: - banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[:2]) + banner_major, banner_minor = (int(x) for x in banner[22:].split(b".")[0:2]) - aslr_shift = offset - cls.virtual_to_physical_address(version_json_address) + tmp_aslr_shift = offset - cls.virtual_to_physical_address( + version_json_address + ) major_string = context.layers[layer_name].read( - version_major_phys_offset + aslr_shift, 4 + version_major_phys_offset + tmp_aslr_shift, 4 ) major = struct.unpack(" 0xFFFFFF8000000000: - addr -= 0xFFFFFF8000000000 + addr = addr - 0xFFFFFF8000000000 else: - addr -= 0xFF8000000000 + addr = addr - 0xFF8000000000 return addr From 884237534142ec10ba6e7386eedc06ef30d277d0 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 10 Jan 2025 23:28:02 +0100 Subject: [PATCH 0345/1352] 2.15.0 -> 2.16.0 bump --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 2f0c53093..24f96fa89 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 15 # Number of changes that only add to the interface +VERSION_MINOR = 16 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From 0e4e7518447837b9c7f0f30203155b3a3fee0c3a Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 11 Jan 2025 14:05:36 +0100 Subject: [PATCH 0346/1352] stateless classmethods --- .../symbols/linux/utilities/tainting.py | 67 +++++++++++++------ 1 file changed, 45 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index 29d7d2b5b..552f51b98 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -17,26 +17,22 @@ class Tainting(interfaces.configuration.VersionableInterface): framework.require_interface_version(*_required_framework_version) - def __init__( - self, + @classmethod + def _get_kernel_taint_flags_list( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str, - *args, - **kwargs, - ): - super().__init__(*args, **kwargs) - self._kernel = context.modules[kernel_module_name] - - @property - def _kernel_taint_flags_list( - self, ) -> Optional[List[interfaces.objects.ObjectInterface]]: - if self._kernel.has_symbol("taint_flags"): - return list(self._kernel.object_from_symbol("taint_flags")) + kernel = context.modules[kernel_module_name] + if kernel.has_symbol("taint_flags"): + return list(kernel.object_from_symbol("taint_flags")) return None + @classmethod def _module_flags_taint_pre_4_10_rc1( - self, taints: int, is_module: bool = False + cls, + taints: int, + is_module: bool = False, ) -> str: """Convert the module's taints value to a 1-1 character mapping. Relies on statically defined taints mappings in the framework. @@ -58,8 +54,13 @@ class Tainting(interfaces.configuration.VersionableInterface): return taints_string + @classmethod def _module_flags_taint_post_4_10_rc1( - self, taints: int, is_module: bool = False + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + taints: int, + is_module: bool = False, ) -> str: """Convert the module's taints value to a 1-1 character mapping. Relies on kernel symbol embedded taints definitions. @@ -78,7 +79,9 @@ class Tainting(interfaces.configuration.VersionableInterface): The raw taints string. """ taints_string = "" - for taint_bit, taint_flag in enumerate(self._kernel_taint_flags_list): + for taint_bit, taint_flag in enumerate( + cls._get_kernel_taint_flags_list(context, kernel_module_name) + ): if is_module and not taint_flag.module: continue c_true = chr(taint_flag.c_true) @@ -90,7 +93,14 @@ class Tainting(interfaces.configuration.VersionableInterface): return taints_string - def get_taints_as_plain_string(self, taints: int, is_module: bool = False) -> str: + @classmethod + def get_taints_as_plain_string( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + taints: int, + is_module: bool = False, + ) -> str: """Convert the taints value to a 1-1 character mapping. Args: @@ -103,11 +113,22 @@ class Tainting(interfaces.configuration.VersionableInterface): - module_flags_taint kernel function """ - if self._kernel_taint_flags_list: - return self._module_flags_taint_post_4_10_rc1(taints, is_module) - return self._module_flags_taint_pre_4_10_rc1(taints, is_module) + if cls._get_kernel_taint_flags_list(context, kernel_module_name): + return cls._module_flags_taint_post_4_10_rc1( + context, kernel_module_name, taints, is_module + ) + return cls._module_flags_taint_pre_4_10_rc1( + context, kernel_module_name, taints, is_module + ) - def get_taints_parsed(self, taints: int, is_module: bool = False) -> List[str]: + @classmethod + def get_taints_parsed( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + taints: int, + is_module: bool = False, + ) -> List[str]: """Convert the taints string to a 1-1 descriptor mapping. Args: @@ -121,7 +142,9 @@ class Tainting(interfaces.configuration.VersionableInterface): - module_flags_taint kernel function """ comprehensive_taints = [] - for character in self.get_taints_as_plain_string(taints, is_module): + for character in cls.get_taints_as_plain_string( + context, kernel_module_name, taints, is_module + ): taint_flag = linux_constants.TAINT_FLAGS.get(character) if not taint_flag: comprehensive_taints.append(f"") From 6817d2c765fb5117a8ec6adb92cf343d37a92595 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 16:00:50 +1100 Subject: [PATCH 0347/1352] linux: ensure process listing functions yield only valid tasks --- volatility3/framework/plugins/linux/pslist.py | 5 ++- .../symbols/linux/extensions/__init__.py | 32 +++++++++++++++++++ 2 files changed, 36 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 37cf000fc..931acf29a 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -34,7 +34,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular linux memory image.""" _required_framework_version = (2, 13, 0) - _version = (4, 0, 0) + _version = (4, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -250,6 +250,9 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Note that the init_task itself is not yielded, since "ps" also never shows it. for task in init_task.tasks: + if not task.is_valid(): + continue + if filter_func(task): continue diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index df1c00e3d..a50b8ae09 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -307,6 +307,36 @@ class module(generic.GenericIntelProcess): class task_struct(generic.GenericIntelProcess): + def is_valid(self) -> bool: + layer = self._context.layers[self.vol.layer_name] + # Make sure the entire task content is readable + if not layer.is_valid(self.vol.offset, self.vol.size): + return False + + if self.pid < 0: + return False + + if not (self.signal and self.signal.is_readable()): + return False + + if not (self.nsproxy and self.nsproxy.is_readable()): + return False + + if not (self.real_parent and self.real_parent.is_readable()): + return False + + if self.active_mm and not self.active_mm.is_readable(): + return False + + if self.mm: + if not self.mm.is_readable(): + return False + + if self.mm != self.active_mm: + return False + + return True + def add_process_layer( self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None ) -> Optional[str]: @@ -401,6 +431,8 @@ class task_struct(generic.GenericIntelProcess): tasks_iterable = self._get_tasks_iterable() threads_seen = set([self.vol.offset]) for task in tasks_iterable: + if not task.is_valid(): + continue if task.vol.offset not in threads_seen: threads_seen.add(task.vol.offset) yield task From 093b12b7cdf4a1623a5d534309f0673c0311cc6b Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 16:52:45 +1100 Subject: [PATCH 0348/1352] Linux and Windows: Ensure linked list object extensions consistently yield valid entries --- .../symbols/linux/extensions/__init__.py | 42 ++++++++++------- .../symbols/windows/extensions/__init__.py | 47 +++++++++---------- 2 files changed, 48 insertions(+), 41 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index df1c00e3d..2065b3bb4 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1209,35 +1209,43 @@ class list_head(objects.StructType, collections.abc.Iterable): Objects of the type specified via the "symbol_type" argument. """ - layer = layer or self.vol.layer_name + layer_name = layer or self.vol.layer_name + + trans_layer = self._context.layers[layer_name] + if not trans_layer.is_valid(self.vol.offset): + return None relative_offset = self._context.symbol_space.get_type( symbol_type ).relative_child_offset(member) - direction = "prev" - if forward: - direction = "next" - try: - link = getattr(self, direction).dereference() - except exceptions.InvalidAddressException: + direction = "next" if forward else "prev" + + link_ptr = getattr(self, direction) + if not (link_ptr and link_ptr.is_readable()): return None + link = link_ptr.dereference() + if not sentinel: - yield self._context.object( - symbol_type, layer, offset=self.vol.offset - relative_offset - ) + obj_offset = self.vol.offset - relative_offset + if not trans_layer.is_valid(obj_offset): + return None + + yield self._context.object(symbol_type, layer_name, offset=obj_offset) + seen = {self.vol.offset} while link.vol.offset not in seen: - obj = self._context.object( - symbol_type, layer, offset=link.vol.offset - relative_offset - ) - yield obj + obj_offset = link.vol.offset - relative_offset + if not trans_layer.is_valid(obj_offset): + return None + + yield self._context.object(symbol_type, layer_name, offset=obj_offset) seen.add(link.vol.offset) - try: - link = getattr(link, direction).dereference() - except exceptions.InvalidAddressException: + link_ptr = getattr(link, direction) + if not (link_ptr and link_ptr.is_readable()): break + link = link_ptr.dereference() def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]: return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index f12fd3f5b..214002f49 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -962,56 +962,55 @@ class LIST_ENTRY(objects.StructType, collections.abc.Iterable): ) -> Iterator[interfaces.objects.ObjectInterface]: """Returns an iterator of the entries in the list.""" - layer = layer or self.vol.layer_name + layer_name = layer or self.vol.layer_name + native_layer_name = layer_name or self.vol.native_layer_name + + trans_layer = self._context.layers[layer_name] + if not trans_layer.is_valid(self.vol.offset): + return None relative_offset = self._context.symbol_space.get_type( symbol_type ).relative_child_offset(member) - direction = "Blink" - if forward: - direction = "Flink" + direction = "Flink" if forward else "Blink" - trans_layer = self._context.layers[layer] - - try: - is_valid = trans_layer.is_valid(self.vol.offset) - if not is_valid: - return None - - link = getattr(self, direction).dereference() - except exceptions.InvalidAddressException: + link_ptr = getattr(self, direction) + if not (link_ptr and link_ptr.is_readable()): return None + link = link_ptr.dereference() if not sentinel: + obj_offset = self.vol.offset - relative_offset + if not trans_layer.is_valid(obj_offset): + return None + yield self._context.object( symbol_type, - layer, - offset=self.vol.offset - relative_offset, - native_layer_name=layer or self.vol.native_layer_name, + layer_name, + offset=obj_offset, + native_layer_name=native_layer_name, ) seen = {self.vol.offset} while link.vol.offset not in seen: obj_offset = link.vol.offset - relative_offset - if not trans_layer.is_valid(obj_offset): return None - obj = self._context.object( + yield self._context.object( symbol_type, - layer, + layer_name, offset=obj_offset, - native_layer_name=layer or self.vol.native_layer_name, + native_layer_name=native_layer_name, ) - yield obj seen.add(link.vol.offset) - try: - link = getattr(link, direction).dereference() - except exceptions.InvalidAddressException: + link_ptr = getattr(link, direction) + if not (link_ptr and link_ptr.is_readable()): return None + link = link_ptr.dereference() def __iter__(self) -> Iterator[interfaces.objects.ObjectInterface]: return self.to_list(self.vol.parent.vol.type_name, self.vol.member_name) From 0d9715136cc9cc96637996b2bb027a76b8b5e87a Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 17:13:44 +1100 Subject: [PATCH 0349/1352] Linux: Ensure VMA enumration functions yield only valid objects consistently --- .../symbols/linux/extensions/__init__.py | 46 +++++++++++++------ 1 file changed, 32 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index df1c00e3d..61562270a 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -811,23 +811,30 @@ class mm_struct(objects.StructType): def _get_mmap_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns an iterator for the mmap list member of an mm_struct. Use this only if required, get_vma_iter() will choose the correct _get_maple_tree_iter() or - _get_mmap_iter() automatically as required.""" + _get_mmap_iter() automatically as required. + + Yields: + vm_area_struct objects + """ if not self.has_member("mmap"): raise AttributeError( "_get_mmap_iter called on mm_struct where no mmap member exists." ) - if not self.mmap: + vma_pointer = self.mmap + if not (vma_pointer and vma_pointer.is_readable()): return None - yield self.mmap + vma_object = vma_pointer.dereference() + yield vma_object - seen = {self.mmap.vol.offset} - link = self.mmap.vm_next + seen = {vma_pointer} + vma_pointer = vma_pointer.vm_next - while link != 0 and link.vol.offset not in seen: - yield link - seen.add(link.vol.offset) - link = link.vm_next + while vma_pointer and vma_pointer.is_readable() and vma_pointer not in seen: + vma_object = vma_pointer.dereference() + yield vma_object + seen.add(vma_pointer) + vma_pointer = vma_pointer.vm_next # TODO: As of version 3.0.0 this method should be removed def get_maple_tree_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: @@ -842,7 +849,11 @@ class mm_struct(objects.StructType): def _get_maple_tree_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns an iterator for the mm_mt member of an mm_struct. Use this only if required, get_vma_iter() will choose the correct _get_maple_tree_iter() or - get_mmap_iter() automatically as required.""" + get_mmap_iter() automatically as required. + + Yields: + vm_area_struct objects + """ if not self.has_member("mm_mt"): raise AttributeError( @@ -850,20 +861,27 @@ class mm_struct(objects.StructType): ) symbol_table_name = self.get_symbol_table_name() for vma_pointer in self.mm_mt.get_slot_iter(): - # convert pointer to vm_area_struct and yield - vma = self._context.object( + # Convert pointer to vm_area_struct and yield + vma_object = self._context.object( symbol_table_name + constants.BANG + "vm_area_struct", layer_name=self.vol.native_layer_name, offset=vma_pointer, ) - yield vma + yield vma_object def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: - """Returns an iterator for the VMAs in an mm_struct. Automatically choosing the mmap or mm_mt as required.""" + """Returns an iterator for the VMAs in an mm_struct. + Automatically choosing the mmap or mm_mt as required. + + Yields: + vm_area_struct objects + """ if self.has_member("mmap"): + # kernels < 6.1 yield from self._get_mmap_iter() elif self.has_member("mm_mt"): + # kernels >= 6.1 d4af56c5c7c6781ca6ca8075e2cf5bc119ed33d1 yield from self._get_maple_tree_iter() else: raise AttributeError("Unable to find mmap or mm_mt in mm_struct") From 35fa9321b3bdac0bc3b8097148eeb6872cade138 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 17:44:26 +1100 Subject: [PATCH 0350/1352] Linux: file struct: Remove `f_dentry` and `f_vfsmnt`, as they were preprocessor macro shortcuts, not actual members of the type. --- .../framework/symbols/linux/extensions/__init__.py | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index df1c00e3d..22c28f6fa 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1152,19 +1152,15 @@ class struct_file(objects.StructType): """Returns a pointer to the dentry associated with this file""" if self.has_member("f_path"): return self.f_path.dentry - elif self.has_member("f_dentry"): - return self.f_dentry - else: - raise AttributeError("Unable to find file -> dentry") + + raise AttributeError("Unable to find file -> dentry") def get_vfsmnt(self) -> interfaces.objects.ObjectInterface: """Returns the fs (vfsmount) where this file is mounted""" if self.has_member("f_path"): return self.f_path.mnt - elif self.has_member("f_vfsmnt"): - return self.f_vfsmnt - else: - raise AttributeError("Unable to find file -> vfs mount") + + raise AttributeError("Unable to find file -> vfs mount") def get_inode(self) -> interfaces.objects.ObjectInterface: """Returns an inode associated with this file""" From fba8f05c8075e07ccecbaca6299ef106127623e3 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 17:48:53 +1100 Subject: [PATCH 0351/1352] linux: Rename variable to clarify pointer type and avoid confusion with the 'dentry' class. --- volatility3/framework/symbols/linux/extensions/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 22c28f6fa..4d89764f3 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1390,9 +1390,9 @@ class mount(objects.StructType): A dentry pointer """ vfsmnt = self.get_vfsmnt_current() - dentry = vfsmnt.mnt_root + dentry_pointer = vfsmnt.mnt_root - return dentry + return dentry_pointer def get_dentry_parent(self): """Returns the parent root of the mounted tree From 4b10d658509faaf42b21c67ec543b9bd34f57f84 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 17:51:30 +1100 Subject: [PATCH 0352/1352] linux: minor docstring improvements --- .../framework/symbols/linux/__init__.py | 7 +-- .../symbols/linux/extensions/__init__.py | 46 ++++++++++--------- 2 files changed, 29 insertions(+), 24 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 5aa27b964..93ff35a06 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -106,8 +106,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): Args: task (task_struct): A reference task mnt (vfsmount or mount): A mounted filesystem or a mount point. - - kernels < 3.3.8 type is 'vfsmount' - - kernels >= 3.3.8 type is 'mount' + - kernels < 3.3 type is 'vfsmount' + - kernels >= 3.3 type is 'mount' Returns: str: Pathname of the mount point relative to the task's root directory. @@ -129,7 +129,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): rdentry (dentry *): A pointer to the root dentry rmnt (vfsmount *): A pointer to the root vfsmount dentry (dentry *): A pointer to the dentry - vfsmnt (vfsmount *): A pointer to the vfsmount + vfsmnt (vfsmount/vfsmount *): A vfsmount object (kernels >= 3.3) or a + vfsmount pointer (kernels < 3.3) Returns: str: Pathname of the mount point or file diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 4d89764f3..6d341653b 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1500,16 +1500,18 @@ class vfsmount(objects.StructType): ) def _is_kernel_prior_to_struct_mount(self) -> bool: - """Helper to distinguish between kernels prior to version 3.3.8 that - lacked the 'mount' structure and later versions that have it. + """Helper to distinguish between kernels prior to version 3.3 which lacked the + 'mount' struct, versus later versions that include it. + See 7d6fec45a5131918b51dcd76da52f2ec86a85be6. - The 'mnt_parent' member was moved from struct 'vfsmount' to struct - 'mount' when the latter was introduced. + # Following that commit, also in kernel version 3.3 (3376f34fff5be9954fd9a9c4fd68f4a0a36d480e), + # the 'mnt_parent' member was relocated from the 'vfsmount' struct to the newly + # introduced 'mount' struct. Alternatively, vmlinux.has_type('mount') can be used here but it is faster. Returns: - bool: 'True' if the kernel + 'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3. """ return self.has_member("mnt_parent") @@ -1517,22 +1519,21 @@ class vfsmount(objects.StructType): def is_equal(self, vfsmount_ptr) -> bool: """Helper to make sure it is comparing two pointers to 'vfsmount'. - Depending on the kernel version, the calling object (self) could be - a 'vfsmount \\*' (<3.3.8) or a 'vfsmount' (>=3.3.8). This way we trust - in the framework "auto" dereferencing ability to assure that when we - reach this point 'self' will be a 'vfsmount' already and self.vol.offset - a 'vfsmount \\*' and not a 'vfsmount \\*\\*'. The argument must be a 'vfsmount \\*'. + Depending on the kernel version, see 3376f34fff5be9954fd9a9c4fd68f4a0a36d480e, + the calling object (self) could be a 'vfsmount *' (<3.3) or a 'vfsmount' (>=3.3). + This way we trust in the framework "auto" dereferencing ability to assure that + when we reach this point 'self' will be a 'vfsmount' already and self.vol.offset + a 'vfsmount *' and not a 'vfsmount **'. The argument must be a 'vfsmount *'. Typically, it's called from do_get_path(). Args: - vfsmount_ptr (vfsmount *): A pointer to a 'vfsmount' + vfsmount_ptr: A pointer to a 'vfsmount' Raises: - exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount \\*' + exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount *' Returns: - bool: 'True' if the given argument points to the the same 'vfsmount' - as 'self'. + 'True' if the given argument points to the same 'vfsmount' as 'self'. """ if isinstance(vfsmount_ptr, objects.Pointer): return self.vol.offset == vfsmount_ptr @@ -1541,13 +1542,14 @@ class vfsmount(objects.StructType): "Unexpected argument type. It has to be a 'vfsmount *'" ) - def _get_real_mnt(self): + def _get_real_mnt(self) -> interfaces.objects.ObjectInterface: """Gets the struct 'mount' containing this 'vfsmount'. - It should be only called from kernels >= 3.3.8 when 'struct mount' was introduced. + It should be only called from kernels >= 3.3 when 'struct mount' was introduced. + See 7d6fec45a5131918b51dcd76da52f2ec86a85be6 Returns: - mount: the struct 'mount' containing this 'vfsmount'. + The 'mount' object containing this 'vfsmount'. """ vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) return linux.LinuxUtilities.container_of( @@ -1566,8 +1568,8 @@ class vfsmount(objects.StructType): """Gets the parent fs (vfsmount) to where it's mounted on Returns: - For kernels < 3.3.8: A vfsmount pointer - For kernels >= 3.3.8: A vfsmount object + For kernels < 3.3: A vfsmount pointer + For kernels >= 3.3: A vfsmount object """ if self._is_kernel_prior_to_struct_mount(): return self.get_mnt_parent() @@ -1600,8 +1602,8 @@ class vfsmount(objects.StructType): """Gets the mnt_parent member. Returns: - For kernels < 3.3.8: A vfsmount pointer - For kernels >= 3.3.8: A mount pointer + For kernels < 3.3: A vfsmount pointer + For kernels >= 3.3: A mount pointer """ if self._is_kernel_prior_to_struct_mount(): return self.mnt_parent @@ -1672,8 +1674,10 @@ class kobject(objects.StructType): class mnt_namespace(objects.StructType): def get_inode(self): if self.has_member("proc_inum"): + # 98f842e675f96ffac96e6c50315790912b2812be 3.8 <= kernels < 3.19 return self.proc_inum elif self.has_member("ns") and self.ns.has_member("inum"): + # kernels >= 3.19 435d5f4bb2ccba3b791d9ef61d2590e30b8e806e return self.ns.inum else: raise AttributeError("Unable to find mnt_namespace inode") From d4803a3884343f475a90a14de4be7fa947e561c5 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 17:58:21 +1100 Subject: [PATCH 0353/1352] Linux: Ensure mount API consistently returns valid mountpoints and path names --- .../framework/plugins/linux/mountinfo.py | 6 ++++-- .../framework/symbols/linux/__init__.py | 21 ++++++++++++++++--- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index b4f80e4f5..5a0d39f31 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -36,7 +36,7 @@ class MountInfo(plugins.PluginInterface): """Lists mount points on processes mount namespaces""" _required_framework_version = (2, 2, 0) - _version = (1, 2, 3) + _version = (1, 3, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -152,9 +152,11 @@ class MountInfo(plugins.PluginInterface): if not ( task and task.fs - and task.fs.root + and task.fs.is_readable() and task.nsproxy + and task.nsproxy.is_readable() and task.nsproxy.mnt_ns + and task.nsproxy.mnt_ns.is_readable() ): # This task doesn't have all the information required. # It should be a kernel < 2.6.30 diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 93ff35a06..03f4e501a 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -76,7 +76,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" - _version = (2, 2, 0) + _version = (2, 3, 0) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) @@ -121,7 +121,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt) @classmethod - def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> Union[None, str]: + def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> str: """Returns a pathname of the mount point or file It mimics the Linux kernel prepend_path function. @@ -136,8 +136,19 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): str: Pathname of the mount point or file """ + if not (rdentry and rdentry.is_readable() and rmnt and rmnt.is_readable()): + return "" + + if isinstance(vfsmnt, objects.Pointer) and not (rmnt and rmnt.is_readable()): + # vfsmnt can be the vfsmount object itself (>=3.3) or a vfsmount * (<3.3) + return "" + path_reversed = [] - while dentry != rdentry or not vfsmnt.is_equal(rmnt): + while ( + dentry + and dentry.is_readable() + and (dentry != rdentry or not vfsmnt.is_equal(rmnt)) + ): if dentry == vfsmnt.get_mnt_root() or dentry.is_root(): # Escaped? if dentry != vfsmnt.get_mnt_root(): @@ -450,6 +461,10 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): type_dec = vmlinux.get_type(type_name) member_offset = type_dec.relative_child_offset(member_name) container_addr = addr - member_offset + layer = vmlinux.context.layers[vmlinux.layer_name] + if not layer.is_valid(container_addr): + return None + return vmlinux.object( object_type=type_name, offset=container_addr, absolute=True ) From 1707e0a89ce88696f8585734587cc0f300b160ad Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 18:01:31 +1100 Subject: [PATCH 0354/1352] Fix array_to_string helper method: If called with other object than array and a count value, it will end up with an AttributeError exception --- volatility3/framework/objects/utility.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index b241ed56a..0bc285517 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -33,11 +33,12 @@ def array_to_string( ) -> interfaces.objects.ObjectInterface: """Takes a volatility Array of characters and returns a string.""" # TODO: Consider checking the Array's target is a native char - if count is None: - count = array.vol.count if not isinstance(array, objects.Array): raise TypeError("Array_to_string takes an Array of char") + if count is None: + count = array.vol.count + return array.cast("string", max_length=count, errors=errors) @@ -45,8 +46,10 @@ def pointer_to_string(pointer: "objects.Pointer", count: int, errors: str = "rep """Takes a volatility Pointer to characters and returns a string.""" if not isinstance(pointer, objects.Pointer): raise TypeError("pointer_to_string takes a Pointer") + if count < 1: raise ValueError("pointer_to_string requires a positive count") + char = pointer.dereference() return char.cast("string", max_length=count, errors=errors) From 77ad6f0d831a33cfbc037012a8f2bec0c57520ca Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 18:25:04 +1100 Subject: [PATCH 0355/1352] linux: remove unused import --- volatility3/framework/symbols/linux/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 03f4e501a..931c461b9 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -4,7 +4,7 @@ import math import contextlib from abc import ABC, abstractmethod -from typing import Iterator, List, Tuple, Optional, Union +from typing import Iterator, List, Tuple, Optional from volatility3 import framework from volatility3.framework import constants, exceptions, interfaces, objects From 8bc04529350c3ce5a927099a72bc4e419a049db5 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 14 Jan 2025 11:21:23 +1100 Subject: [PATCH 0356/1352] linux: Improve compatibility with ancient kernels --- .../symbols/linux/extensions/__init__.py | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index a50b8ae09..4a1a263dd 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -316,16 +316,26 @@ class task_struct(generic.GenericIntelProcess): if self.pid < 0: return False - if not (self.signal and self.signal.is_readable()): + if self.has_member("signal") and not ( + self.signal and self.signal.is_readable() + ): return False - if not (self.nsproxy and self.nsproxy.is_readable()): + if self.has_member("nsproxy") and not ( + self.nsproxy and self.nsproxy.is_readable() + ): return False - if not (self.real_parent and self.real_parent.is_readable()): + if self.has_member("real_parent") and not ( + self.real_parent and self.real_parent.is_readable() + ): return False - if self.active_mm and not self.active_mm.is_readable(): + if ( + self.has_member("active_mm") + and self.active_mm + and not self.active_mm.is_readable() + ): return False if self.mm: From 7fc2af5b4ecf4b1ced5c71357d164981b05ed309 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 14 Jan 2025 11:39:48 +1100 Subject: [PATCH 0357/1352] linux: Add an additional quick check before validating pointer readability --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 4a1a263dd..e2c9454f6 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -313,7 +313,7 @@ class task_struct(generic.GenericIntelProcess): if not layer.is_valid(self.vol.offset, self.vol.size): return False - if self.pid < 0: + if self.pid < 0 or self.tgid < 0: return False if self.has_member("signal") and not ( From d21fdb4211c800404acd863b71b8302022d090e4 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 13 Jan 2025 16:52:45 +1100 Subject: [PATCH 0358/1352] Linux: pagecache: Harden Page Cache API to consistently yield valid entries --- .../framework/plugins/linux/pagecache.py | 14 ++++++-- .../framework/symbols/linux/__init__.py | 9 +++--- .../symbols/linux/extensions/__init__.py | 32 +++++++++++++------ 3 files changed, 39 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 382268515..430190970 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -104,7 +104,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -253,6 +253,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): if not root_inode.is_valid(): continue + if not (root_inode.i_mapping and root_inode.i_mapping.is_readable()): + # Retrieving data from the page cache requires a valid address space + continue + # Inode already processed? if root_inode_ptr in seen_inodes: continue @@ -284,6 +288,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): if not file_inode.is_valid(): continue + if not (file_inode.i_mapping and file_inode.i_mapping.is_readable()): + # Retrieving data from the page cache requires a valid address space + continue + # Inode already processed? if file_inode_ptr in seen_inodes: continue @@ -316,10 +324,12 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): if self.config["find"]: if inode_in.path == self.config["find"]: inode_out = inode_in.to_user(vmlinux_layer) + yield (0, astuple(inode_out)) break # Only the first match else: inode_out = inode_in.to_user(vmlinux_layer) + yield (0, astuple(inode_out)) def generate_timeline(self): @@ -389,7 +399,7 @@ class InodePages(plugins.PluginInterface): _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 5aa27b964..3265dfd37 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -838,11 +838,12 @@ class PageCache: Yields: Page objects """ - + layer = self.vmlinux.context.layers[self.vmlinux.layer_name] for page_addr in self._idstorage.get_entries(self._page_cache.i_pages): if not page_addr: continue - page = self.vmlinux.object("page", offset=page_addr, absolute=True) - if page: - yield page + if not layer.is_valid(page_addr): + continue + + yield self.vmlinux.object("page", offset=page_addr, absolute=True) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index df1c00e3d..187b1e280 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2489,7 +2489,12 @@ class inode(objects.StructType): """ if not self.i_size: return - elif not (self.i_mapping and self.i_mapping.nrpages > 0): + + if not ( + self.i_mapping + and self.i_mapping.is_readable() + and self.i_mapping.nrpages > 0 + ): return page_cache = linux.PageCache( @@ -2497,19 +2502,21 @@ class inode(objects.StructType): kernel_module_name="kernel", page_cache=self.i_mapping.dereference(), ) + yield from page_cache.get_cached_pages() - def get_contents(self): + def get_contents(self) -> Iterable[Tuple[int, bytes]]: """Get the inode cached pages from the page cache Yields: page_index (int): The page index in the Tree. File offset is page_index * PAGE_SIZE. - page_content (str): The page content + page_content (bytes): The page content """ for page_obj in self.get_pages(): page_index = int(page_obj.index) page_content = page_obj.get_content() - yield page_index, page_content + if page_content: + yield page_index, page_content class address_space(objects.StructType): @@ -2625,7 +2632,7 @@ class page(objects.StructType): return page_paddr - def get_content(self) -> Union[str, None]: + def get_content(self) -> Union[bytes, None]: """Returns the page content Returns: @@ -2641,8 +2648,13 @@ class page(objects.StructType): if not page_paddr: return None - page_data = physical_layer.read(page_paddr, vmlinux_layer.page_size) - return page_data + if not physical_layer.is_valid(page_paddr, length=vmlinux_layer.page_size): + vollog.debug( + "Unable to read page 0x%x content at 0x%x", self.vol.offset, page_paddr + ) + return None + + return physical_layer.read(page_paddr, vmlinux_layer.page_size) def get_flags_list(self) -> List[str]: """Returns a list of page flags @@ -2755,17 +2767,17 @@ class IDR(objects.StructType): class rb_root(objects.StructType): - def _walk_nodes(self, root_node) -> Iterator[int]: + def _walk_nodes(self, root_node: int) -> Iterator[int]: """Traverses the Red-Black tree from the root node and yields a pointer to each node in this tree. Args: - root_node: A Red-Black tree node from which to start descending + root_node: A Red-Black tree node pointer from which to start descending Yields: A pointer to every node descending from the specified root node """ - if not root_node: + if not (root_node and root_node.is_readable()): return yield root_node From 529b67fc96d7e975bdff83edd7096c4c0cd8db80 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Tue, 14 Jan 2025 12:31:25 +1100 Subject: [PATCH 0359/1352] Linux: pagecache: Fix issue reported in #1527 --- volatility3/framework/plugins/linux/pagecache.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 430190970..9aff0e4f9 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -469,6 +469,8 @@ class InodePages(plugins.PluginInterface): inode_size, page_idx, ) + continue + f.seek(current_fp) f.write(page_bytes) From 1a84f96c70060bc09aab3c1b3348d980f8b9bc0e Mon Sep 17 00:00:00 2001 From: Kerry Goodwine Date: Thu, 9 Jan 2025 15:49:24 -0500 Subject: [PATCH 0360/1352] Actions: Add new workflow for generating windows EXEs with pyinstaller --- .github/workflows/build-pyinstaller.yml | 50 +++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/workflows/build-pyinstaller.yml diff --git a/.github/workflows/build-pyinstaller.yml b/.github/workflows/build-pyinstaller.yml new file mode 100644 index 000000000..bcba95403 --- /dev/null +++ b/.github/workflows/build-pyinstaller.yml @@ -0,0 +1,50 @@ +name: build-pyinstaller +on: + push: + branches: + - stable + - develop + - 'release/**' + pull_request: + branches: + - stable + - 'release/**' + +jobs: + + exe: + runs-on: windows-latest + strategy: + matrix: + python-version: ["3.11"] + steps: + - uses: actions/checkout@v3 + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v4 + with: + python-version: ${{ matrix.python-version }} + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install pyinstaller + + - name: Pyinstall executable + run: | + pyinstaller --clean -y vol.spec + pyinstaller --clean -y volshell.spec + + - name: Move files + run: | + mv dist/vol.exe vol.exe + mv dist/volshell.exe volshell.exe + + - name: Archive + uses: actions/upload-artifact@v4 + with: + name: volatility3-pyinstaller + path: | + vol.exe + volshell.exe + README.md + LICENSE.txt From 9f08af47b161579bf31f9d45c8b248c23861388a Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 15 Jan 2025 12:51:52 +1100 Subject: [PATCH 0361/1352] Linux: Add support for Intel 32bit with PAE --- volatility3/framework/automagic/linux.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index f22cae012..542d26a8d 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -71,6 +71,12 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): elif "init_level4_pgt" in table.symbols: layer_class = intel.LinuxIntel32e dtb_symbol_name = "init_level4_pgt" + elif ( + "pkmap_count" in table.symbols + and table.get_symbol("pkmap_count").type.count == 512 + ): + layer_class = intel.LinuxIntelPAE + dtb_symbol_name = "swapper_pg_dir" else: layer_class = intel.LinuxIntel dtb_symbol_name = "swapper_pg_dir" From 28c74f8c1b853df3680de14f6fdc22958516a9c2 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 15 Jan 2025 13:23:39 +1100 Subject: [PATCH 0362/1352] Linux: Add support for Intel 32bit with PAE in early kernels, including versions 2.3.27 and 2.3.28. --- volatility3/framework/automagic/linux.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/automagic/linux.py b/volatility3/framework/automagic/linux.py index 542d26a8d..cb4f3cc64 100644 --- a/volatility3/framework/automagic/linux.py +++ b/volatility3/framework/automagic/linux.py @@ -71,10 +71,9 @@ class LinuxIntelStacker(interfaces.automagic.StackerLayerInterface): elif "init_level4_pgt" in table.symbols: layer_class = intel.LinuxIntel32e dtb_symbol_name = "init_level4_pgt" - elif ( - "pkmap_count" in table.symbols - and table.get_symbol("pkmap_count").type.count == 512 - ): + elif "pkmap_count" in table.symbols and table.get_symbol( + "pkmap_count" + ).type.count in (512, 2048): layer_class = intel.LinuxIntelPAE dtb_symbol_name = "swapper_pg_dir" else: From b27f98fed258b597e043a5c80304d8489da27b32 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 15 Jan 2025 14:37:35 +1100 Subject: [PATCH 0363/1352] linux: pslist: fix task credentials rendering --- volatility3/framework/plugins/linux/pslist.py | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 37cf000fc..77b57e000 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -179,6 +179,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): file_output = "VMA start matching task start_code not found" return file_output + @staticmethod + def _format_cred(cred): + return renderers.NotAvailableValue() if cred is None else cred + def _generator( self, pid_filter: Callable[[Any], bool], @@ -212,16 +216,21 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): task_fields = self.get_task_fields(task, decorate_comm) + task_uid = self._format_cred(task_fields.uid) + task_gid = self._format_cred(task_fields.gid) + task_euid = self._format_cred(task_fields.euid) + task_egid = self._format_cred(task_fields.egid) + yield 0, ( format_hints.Hex(task_fields.offset), task_fields.user_pid, task_fields.user_tid, task_fields.user_ppid, task_fields.name, - task_fields.uid or renderers.NotAvailableValue(), - task_fields.gid or renderers.NotAvailableValue(), - task_fields.euid or renderers.NotAvailableValue(), - task_fields.egid or renderers.NotAvailableValue(), + task_uid, + task_gid, + task_euid, + task_egid, task_fields.creation_time or renderers.NotAvailableValue(), file_output, ) From 66084878627f636d0bebabbecc79842ac954d209 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Wed, 15 Jan 2025 15:08:57 +1100 Subject: [PATCH 0364/1352] Linux: pagecache: Fix issue with incosistent inode page caches --- volatility3/framework/plugins/linux/pagecache.py | 6 +++++- volatility3/framework/symbols/linux/__init__.py | 14 ++++++++++++-- .../framework/symbols/linux/extensions/__init__.py | 9 +++++++++ 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 9aff0e4f9..b2766be8d 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -520,7 +520,11 @@ class InodePages(plugins.PluginInterface): page_mapping_addr = page_obj.mapping page_index = int(page_obj.index) page_file_offset = page_index * vmlinux_layer.page_size - dump_safe = page_file_offset < inode_size + dump_safe = ( + page_file_offset < inode_size + and page_mapping_addr + and page_mapping_addr.is_readable() + ) page_flags_list = page_obj.get_flags_list() page_flags = ",".join([x.replace("PG_", "") for x in page_flags_list]) fields = ( diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 3265dfd37..08f69c326 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -3,6 +3,7 @@ # import math import contextlib +import logging from abc import ABC, abstractmethod from typing import Iterator, List, Tuple, Optional, Union @@ -12,6 +13,8 @@ from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux import extensions +vollog = logging.getLogger(__name__) + class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): provides = {"type": "interface"} @@ -612,7 +615,7 @@ class IDStorage(ABC): raise NotImplementedError def nodep_to_node(self, nodep) -> interfaces.objects.ObjectInterface: - """Instanciates a tree node from its pointer + """Instantiates a tree node from its pointer Args: nodep: Pointer to the XArray/RadixTree node @@ -846,4 +849,11 @@ class PageCache: if not layer.is_valid(page_addr): continue - yield self.vmlinux.object("page", offset=page_addr, absolute=True) + page = self.vmlinux.object("page", offset=page_addr, absolute=True) + if not page.is_valid(): + vollog.error( + f"Invalid cached page at {page.vol.offset:#x}, aborting", + ) + break + + yield page diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 187b1e280..6ae022923 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2534,6 +2534,15 @@ class address_space(objects.StructType): class page(objects.StructType): + def is_valid(self) -> bool: + if self.mapping and not self.mapping.is_readable(): + return False + + if self.to_paddr() < 0: + return False + + return True + @functools.cached_property def pageflags_enum(self) -> Dict: """Returns 'pageflags' enumeration key/values From ce40659d8728f57f9b6e63709af4b7a17588a309 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 16 Jan 2025 19:19:47 +1100 Subject: [PATCH 0365/1352] linux: radix_tree: Fix various issues, enhance early inconsistency detection, and improve compatibility with older kernel versions --- volatility3/framework/exceptions.py | 4 ++ .../framework/symbols/linux/__init__.py | 62 ++++++++++++------- 2 files changed, 44 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/exceptions.py b/volatility3/framework/exceptions.py index c44fb4f2e..41c67b88d 100644 --- a/volatility3/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -130,3 +130,7 @@ class OfflineException(VolatilityException): class RenderException(VolatilityException): """Thrown if there is an error during rendering""" + + +class LinuxPageCacheException(VolatilityException): + """Thrown if there is an error during Linux Page Cache processing""" diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 08f69c326..4c9934439 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -3,6 +3,7 @@ # import math import contextlib +import functools import logging from abc import ABC, abstractmethod from typing import Iterator, List, Tuple, Optional, Union @@ -662,7 +663,7 @@ class IDStorage(ABC): height = self.get_tree_height(root.vol.offset) nodep = self.get_head_node(root) - if not nodep: + if not (nodep and nodep.is_readable()): return # Keep the internal flag before untagging it @@ -697,7 +698,7 @@ class XArray(IDStorage): def get_node_height(self, nodep) -> int: node = self.nodep_to_node(nodep) - return (node.shift / self.CHUNK_SHIFT) + 1 + return (node.shift // self.CHUNK_SHIFT) + 1 def get_head_node(self, tree) -> int: return tree.xa_head @@ -720,6 +721,7 @@ class RadixTree(IDStorage): RADIX_TREE_INTERNAL_NODE = 1 RADIX_TREE_EXCEPTIONAL_ENTRY = 2 RADIX_TREE_ENTRY_MASK = 3 + RADIX_TREE_MAP_SHIFT = 6 # CONFIG_BASE_FULL # Dynamic values. These will be initialized later RADIX_TREE_INDEX_BITS = None @@ -756,43 +758,57 @@ class RadixTree(IDStorage): def get_tree_height(self, treep) -> int: with contextlib.suppress(exceptions.SymbolError): if self.vmlinux.get_type("radix_tree_root").has_member("height"): - # kernels < 4.7.10 + # kernels < 4.7 d0891265bbc988dc91ed8580b38eb3dac128581b radix_tree_root = self.vmlinux.object( "radix_tree_root", offset=treep, absolute=True ) return radix_tree_root.height - # kernels >= 4.7.10 + # kernels >= 4.7 return 0 + @functools.cached_property + def _max_height_array(self): + if self.vmlinux.has_symbol("height_to_maxindex"): + # 2.6.24 26fb1589cb0aaec3a0b4418c54f30c1a2b1781f6 <= Kernels < 4.7 d0891265bbc988dc91ed8580b38eb3dac128581b + return self.vmlinux.object_from_symbol("height_to_maxindex") + elif self.vmlinux.has_symbol("height_to_maxnodes"): + # 4.8 c78c66d1ddfdbd2353f3fcfeba0268524537b096 <= kernels < 4.20 8cf2f98411e3a0865026a1061af637161b16d32b + return self.vmlinux.object_from_symbol("height_to_maxnodes") + + return None + def _radix_tree_maxindex(self, node, height) -> int: """Return the maximum key which can be store into a radix tree with this height.""" - if not self.vmlinux.has_symbol("height_to_maxindex"): - # Kernels >= 4.7 - return (self.CHUNK_SIZE << node.shift) - 1 + if self._max_height_array: + # 2.6.24 <= kernels <= 4.20 See _max_height_array() + return self._max_height_array[height] else: - # Kernels < 4.7 - height_to_maxindex_array = self.vmlinux.object_from_symbol( - "height_to_maxindex" - ) - maxindex = height_to_maxindex_array[height] - return maxindex + # Kernels >= 4.20 + return (self.CHUNK_SIZE << node.shift) - 1 def get_node_height(self, nodep) -> int: node = self.nodep_to_node(nodep) if hasattr(node, "shift"): # 4.7 <= Kernels < 4.20 - return (node.shift / self.CHUNK_SHIFT) + 1 + height = (node.shift // self.CHUNK_SHIFT) + 1 elif hasattr(node, "path"): # 3.15 <= Kernels < 4.7 - return node.path & self.RADIX_TREE_HEIGHT_MASK + height = node.path & self.RADIX_TREE_HEIGHT_MASK elif hasattr(node, "height"): # Kernels < 3.15 - return node.height + height = node.height else: raise exceptions.VolatilityException("Cannot find radix-tree node height") + if self._max_height_array and not (0 <= height < self._max_height_array.count): + error_msg = f"Radix Tree node {node.vol.offset:#x} height {height} exceeds max height of {self._max_height_array.count}" + vollog.error(error_msg) + raise exceptions.LinuxPageCacheException(error_msg) + + return height + def get_head_node(self, tree) -> int: return tree.rnode @@ -805,14 +821,16 @@ class RadixTree(IDStorage): def untag_node(self, nodep) -> int: return nodep & (~self.RADIX_TREE_ENTRY_MASK) - def is_valid_node(self, nodep) -> bool: + def _is_exceptional_node(self, nodep) -> bool: # In kernels 4.20, exceptional nodes were removed and internal entries took their bitmask - if self.vmlinux.has_type("radix_tree_root"): - return ( - nodep & self.RADIX_TREE_ENTRY_MASK - ) != self.RADIX_TREE_EXCEPTIONAL_ENTRY + return ( + self.vmlinux.has_type("radix_tree_root") + and (nodep & self.RADIX_TREE_ENTRY_MASK) + == self.RADIX_TREE_EXCEPTIONAL_ENTRY + ) - return True + def is_valid_node(self, nodep) -> bool: + return not self._is_exceptional_node(nodep) class PageCache: From 3c92d7f7b7d3d7d9548275e960571d4ac37a6a21 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 16 Jan 2025 19:22:46 +1100 Subject: [PATCH 0366/1352] linux: page_cache: enhance early inconsistency detection --- volatility3/framework/symbols/linux/__init__.py | 14 ++++++-------- .../framework/symbols/linux/extensions/__init__.py | 7 ++++++- 2 files changed, 12 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 4c9934439..a7e6ef405 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -861,17 +861,15 @@ class PageCache: """ layer = self.vmlinux.context.layers[self.vmlinux.layer_name] for page_addr in self._idstorage.get_entries(self._page_cache.i_pages): - if not page_addr: - continue - if not layer.is_valid(page_addr): - continue + error_msg = f"Invalid cached page address at {page_addr:#x}, aborting" + vollog.error(error_msg) + raise exceptions.LinuxPageCacheException(error_msg) page = self.vmlinux.object("page", offset=page_addr, absolute=True) if not page.is_valid(): - vollog.error( - f"Invalid cached page at {page.vol.offset:#x}, aborting", - ) - break + error_msg = f"Invalid cached page at {page_addr:#x}, aborting" + vollog.error(error_msg) + raise exceptions.LinuxPageCacheException(error_msg) yield page diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 6ae022923..997370bbb 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2513,6 +2513,11 @@ class inode(objects.StructType): page_content (bytes): The page content """ for page_obj in self.get_pages(): + if page_obj.mapping != self.i_mapping: + vollog.warning( + f"Cached page at {page_obj.vol.offset:#x} has a mismatched address space with the inode. Skipping page" + ) + continue page_index = int(page_obj.index) page_content = page_obj.get_content() if page_content: @@ -2524,7 +2529,7 @@ class address_space(objects.StructType): def i_pages(self): """Returns the appropriate member containing the page cache tree""" if self.has_member("i_pages"): - # Kernel >= 4.17 + # Kernel >= 4.17 b93b016313b3ba8003c3b8bb71f569af91f19fc7 return self.member("i_pages") elif self.has_member("page_tree"): # Kernel < 4.17 From c1497410b4721703ebbb9f30f2ab3db497a4438b Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 16 Jan 2025 19:28:25 +1100 Subject: [PATCH 0367/1352] linux: page_cache plugin: lazy file initialization and avoid redundant inode page cache walk during dumps not showing output with dumping to file. --- .../framework/plugins/linux/pagecache.py | 89 ++++++++++++------- 1 file changed, 57 insertions(+), 32 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index b2766be8d..7ad0f5a8f 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -8,7 +8,7 @@ import datetime from dataclasses import dataclass, astuple from typing import List, Set, Type, Iterable -from volatility3.framework import renderers, interfaces +from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.renderers import format_hints from volatility3.framework.interfaces import plugins from volatility3.framework.configuration import requirements @@ -453,16 +453,18 @@ class InodePages(plugins.PluginInterface): # created, saving both disk space and I/O time. # Additionally, using the page index will guarantee that each page is written at the # appropriate file position. + inode_size = inode.i_size try: - with open_method(filename) as f: - inode_size = inode.i_size - f.truncate(inode_size) - + file_initialized = False + with open_method(filename) as file_obj: for page_idx, page_content in inode.get_contents(): current_fp = page_idx * vmlinux_layer.page_size max_length = inode_size - current_fp - page_bytes = page_content[:max_length] - if current_fp + len(page_bytes) > inode_size: + page_bytes_len = min(max_length, len(page_content)) + if ( + current_fp >= inode_size + or current_fp + page_bytes_len > inode_size + ): vollog.error( "Page out of file bounds: inode 0x%x, inode size %d, page index %d", inode.vol.offset, @@ -470,10 +472,20 @@ class InodePages(plugins.PluginInterface): page_idx, ) continue + page_bytes = page_content[:page_bytes_len] - f.seek(current_fp) - f.write(page_bytes) + if not file_initialized: + # Lazy initialization to avoid truncating the file until we are + # certain there is something to write + file_obj.truncate(inode_size) + file_initialized = True + file_obj.seek(current_fp) + file_obj.write(page_bytes) + except exceptions.LinuxPageCacheException: + vollog.error( + f"Error dumping cached pages for inode at {inode.vol.offset:#x}" + ) except OSError as e: vollog.error("Unable to write to file (%s): %s", filename, e) @@ -514,31 +526,44 @@ class InodePages(plugins.PluginInterface): return None inode_size = inode.i_size - for page_obj in inode.get_pages(): - page_vaddr = page_obj.vol.offset - page_paddr = page_obj.to_paddr() - page_mapping_addr = page_obj.mapping - page_index = int(page_obj.index) - page_file_offset = page_index * vmlinux_layer.page_size - dump_safe = ( - page_file_offset < inode_size - and page_mapping_addr - and page_mapping_addr.is_readable() - ) - page_flags_list = page_obj.get_flags_list() - page_flags = ",".join([x.replace("PG_", "") for x in page_flags_list]) - fields = ( - page_vaddr, - page_paddr, - page_mapping_addr, - page_index, - dump_safe, - page_flags, - ) + if not self.config["dump"]: + try: + for page_obj in inode.get_pages(): + if page_obj.mapping != inode.i_mapping: + vollog.warning( + f"Cached page at {page_obj.vol.offset:#x} has a mismatched address space with the inode. Skipping page" + ) + continue + page_vaddr = page_obj.vol.offset + page_paddr = page_obj.to_paddr() + page_mapping_addr = page_obj.mapping + page_index = int(page_obj.index) + page_file_offset = page_index * vmlinux_layer.page_size + dump_safe = ( + page_file_offset < inode_size + and page_mapping_addr + and page_mapping_addr.is_readable() + ) + page_flags_list = page_obj.get_flags_list() + page_flags = ",".join( + [x.replace("PG_", "") for x in page_flags_list] + ) + fields = ( + page_vaddr, + page_paddr, + page_mapping_addr, + page_index, + dump_safe, + page_flags, + ) - yield 0, fields + yield 0, fields + except exceptions.LinuxPageCacheException: + vollog.warning( + f"Page cache for inode at {inode.vol.offset:#x} is corrupt" + ) - if self.config["dump"]: + else: open_method = self.open inode_address = inode.vol.offset filename = open_method.sanitize_filename(f"inode_0x{inode_address:x}.dmp") From 5502a54198fc7617bb22e2e96519114c59704ab0 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 16 Jan 2025 19:38:41 +1100 Subject: [PATCH 0368/1352] linux: page_cache plugin: Refactor to make _generator more readable --- .../framework/plugins/linux/pagecache.py | 83 ++++++++++--------- 1 file changed, 42 insertions(+), 41 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 7ad0f5a8f..39ed60486 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -6,7 +6,7 @@ import math import logging import datetime from dataclasses import dataclass, astuple -from typing import List, Set, Type, Iterable +from typing import List, Set, Type, Iterable, Tuple from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.renderers import format_hints @@ -489,6 +489,44 @@ class InodePages(plugins.PluginInterface): except OSError as e: vollog.error("Unable to write to file (%s): %s", filename, e) + def _generate_inode_fields( + self, + inode: interfaces.objects.ObjectInterface, + vmlinux_layer: interfaces.layers.TranslationLayerInterface, + ) -> Iterable[Tuple[int, int, int, int, bool, str]]: + inode_size = inode.i_size + try: + for page_obj in inode.get_pages(): + if page_obj.mapping != inode.i_mapping: + vollog.warning( + f"Cached page at {page_obj.vol.offset:#x} has a mismatched address space with the inode. Skipping page" + ) + continue + page_vaddr = page_obj.vol.offset + page_paddr = page_obj.to_paddr() + page_mapping_addr = page_obj.mapping + page_index = int(page_obj.index) + page_file_offset = page_index * vmlinux_layer.page_size + dump_safe = ( + page_file_offset < inode_size + and page_mapping_addr + and page_mapping_addr.is_readable() + ) + page_flags_list = page_obj.get_flags_list() + page_flags = ",".join([x.replace("PG_", "") for x in page_flags_list]) + fields = ( + page_vaddr, + page_paddr, + page_mapping_addr, + page_index, + dump_safe, + page_flags, + ) + + yield 0, fields + except exceptions.LinuxPageCacheException: + vollog.warning(f"Page cache for inode at {inode.vol.offset:#x} is corrupt") + def _generator(self): vmlinux_module_name = self.config["kernel"] vmlinux = self.context.modules[vmlinux_module_name] @@ -510,7 +548,6 @@ class InodePages(plugins.PluginInterface): else: vollog.error("Unable to find inode with path %s", self.config["find"]) return None - elif self.config["inode"]: inode = vmlinux.object("inode", self.config["inode"], absolute=True) else: @@ -525,45 +562,7 @@ class InodePages(plugins.PluginInterface): vollog.error("The inode is not a regular file") return None - inode_size = inode.i_size - if not self.config["dump"]: - try: - for page_obj in inode.get_pages(): - if page_obj.mapping != inode.i_mapping: - vollog.warning( - f"Cached page at {page_obj.vol.offset:#x} has a mismatched address space with the inode. Skipping page" - ) - continue - page_vaddr = page_obj.vol.offset - page_paddr = page_obj.to_paddr() - page_mapping_addr = page_obj.mapping - page_index = int(page_obj.index) - page_file_offset = page_index * vmlinux_layer.page_size - dump_safe = ( - page_file_offset < inode_size - and page_mapping_addr - and page_mapping_addr.is_readable() - ) - page_flags_list = page_obj.get_flags_list() - page_flags = ",".join( - [x.replace("PG_", "") for x in page_flags_list] - ) - fields = ( - page_vaddr, - page_paddr, - page_mapping_addr, - page_index, - dump_safe, - page_flags, - ) - - yield 0, fields - except exceptions.LinuxPageCacheException: - vollog.warning( - f"Page cache for inode at {inode.vol.offset:#x} is corrupt" - ) - - else: + if self.config["dump"]: open_method = self.open inode_address = inode.vol.offset filename = open_method.sanitize_filename(f"inode_0x{inode_address:x}.dmp") @@ -571,6 +570,8 @@ class InodePages(plugins.PluginInterface): self.write_inode_content_to_file( inode, filename, open_method, vmlinux_layer ) + else: + yield from self._generate_inode_fields(inode, vmlinux_layer) def run(self): headers = [ From 9944fcc61f179a0d949266a90d3e0e290d5017c6 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 16 Jan 2025 21:15:00 +1100 Subject: [PATCH 0369/1352] linux: page_cache test case: Since the --dump no longer generate output, we test both modes, listing and dumping. --- test/test_volatility.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index bb7c9a851..e25e8278b 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -714,7 +714,7 @@ def test_linux_page_cache_inodepages(image, volatility, python): image, volatility, python, - pluginargs=["--inode", inode_address, "--dump"], + pluginargs=["--inode", inode_address], ) assert rc == 0 @@ -725,6 +725,14 @@ def test_linux_page_cache_inodepages(image, volatility, python): rb"0xea000054c5f8\s0x18389000\s0x88001ab5c3b0.*?True", out, ) + + rc, out, _err = runvol_plugin( + "linux.pagecache.InodePages", + image, + volatility, + python, + pluginargs=["--inode", inode_address, "--dump"], + ) assert os.path.exists(inode_dump_filename) with open(inode_dump_filename, "rb") as fp: inode_contents = fp.read() From d8254b63735388b9ef6be27009474ccea5726650 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 16 Jan 2025 21:39:37 +1100 Subject: [PATCH 0370/1352] linux: page_cache test case: Improve test --- test/test_volatility.py | 39 ++++++++++++++++++++++----------------- 1 file changed, 22 insertions(+), 17 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index e25e8278b..8676d1f3e 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -708,24 +708,25 @@ def test_linux_page_cache_inodepages(image, volatility, python): inode_address = hex(0x88001AB5C270) inode_dump_filename = f"inode_{inode_address}.dmp" + + rc, out, _err = runvol_plugin( + "linux.pagecache.InodePages", + image, + volatility, + python, + pluginargs=["--inode", inode_address], + ) + + assert rc == 0 + assert out.count(b"\n") > 4 + + # PageVAddr PagePAddr MappingAddr .. DumpSafe + assert re.search( + rb"0xea000054c5f8\s0x18389000\s0x88001ab5c3b0.*?True", + out, + ) + try: - rc, out, _err = runvol_plugin( - "linux.pagecache.InodePages", - image, - volatility, - python, - pluginargs=["--inode", inode_address], - ) - - assert rc == 0 - assert out.count(b"\n") > 4 - - # PageVAddr PagePAddr MappingAddr .. DumpSafe - assert re.search( - rb"0xea000054c5f8\s0x18389000\s0x88001ab5c3b0.*?True", - out, - ) - rc, out, _err = runvol_plugin( "linux.pagecache.InodePages", image, @@ -733,6 +734,10 @@ def test_linux_page_cache_inodepages(image, volatility, python): python, pluginargs=["--inode", inode_address, "--dump"], ) + + assert rc == 0 + assert out.count(b"\n") >= 4 + assert os.path.exists(inode_dump_filename) with open(inode_dump_filename, "rb") as fp: inode_contents = fp.read() From 749a0f9c656d8da0f5087faf25f225a6097ac8b4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 16 Jan 2025 12:06:22 +0000 Subject: [PATCH 0371/1352] Core: Fix up ISFinfo looking for fastjsonschema --- volatility3/framework/plugins/isfinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py index 34b0a5653..1c2ac52e9 100644 --- a/volatility3/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -97,7 +97,7 @@ class IsfInfo(plugins.PluginInterface): if filter_item in isf_file: filtered_list.append(isf_file) - if find_spec("fastjsonschema") and self.config["validate"]: + if find_spec("jsonschema") and self.config["validate"]: def check_valid(data): return "True" if schemas.validate(data, True) else "False" From b447bfa81c36e91c3cf30bdc432e6eba48afbc53 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 16 Jan 2025 16:24:38 +0100 Subject: [PATCH 0372/1352] remove module tainting proxies --- .../framework/plugins/linux/modxview.py | 16 ++++++++++-- .../symbols/linux/extensions/__init__.py | 25 ------------------- 2 files changed, 14 insertions(+), 27 deletions(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 3655200e8..69c6ac8bb 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -140,9 +140,21 @@ class Modxview(interfaces.plugins.PluginInterface): seen_addresses.add(module.vol.offset) if self.config.get("plain_taints"): - taints = module.get_taints_as_plain_string() + taints = tainting.Tainting.get_taints_as_plain_string( + self.context, + kernel_name, + module.taints, + True, + ) else: - taints = ",".join(module.get_taints_parsed()) + taints = ",".join( + tainting.Tainting.get_taints_parsed( + self.context, + kernel_name, + module.taints, + True, + ) + ) yield ( 0, diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index ac2f87df0..289d6c0a4 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -19,7 +19,6 @@ from volatility3.framework.layers import linear, intel from volatility3.framework.objects import utility from volatility3.framework.symbols import generic, linux, intermed from volatility3.framework.symbols.linux.extensions import elf -from volatility3.framework.symbols.linux.utilities import tainting vollog = logging.getLogger(__name__) @@ -279,30 +278,6 @@ class module(generic.GenericIntelProcess): return None - def get_taints_as_plain_string(self) -> str: - """Convert the module's taints value to a 1-1 character mapping. - Convenient wrapper around framework's Tainting capabilities. - - Returns: - The raw taints string. - """ - return tainting.Tainting( - self._context, - linux.LinuxUtilities.get_module_from_volobj_type(self._context, self).name, - ).get_taints_as_plain_string(self.taints, True) - - def get_taints_parsed(self) -> List[str]: - """Convert the module's taints string to a 1-1 descriptor mapping. - Convenient wrapper around framework's Tainting capabilities. - - Returns: - A comprehensive (user-friendly) taint descriptor list. - """ - return tainting.Tainting( - self._context, - linux.LinuxUtilities.get_module_from_volobj_type(self._context, self).name, - ).get_taints_parsed(self.taints, True) - @property def section_symtab(self): if self.has_member("kallsyms"): From 94704c6674d7f5fb9d57698faa0d9ed943c6158c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 16 Jan 2025 16:26:57 +0100 Subject: [PATCH 0373/1352] 2.16.0 -> 2.17.0 bump --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 832b2a5ba..3d68ab810 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 18 # Number of changes that only add to the interface +VERSION_MINOR = 17 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From cd8690a8059836f7e216c211c4397924ae311c84 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 16 Jan 2025 16:27:22 +0100 Subject: [PATCH 0374/1352] require framework version 2.17.0 --- volatility3/framework/plugins/linux/modxview.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 69c6ac8bb..3c2c5f05e 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -19,7 +19,7 @@ class Modxview(interfaces.plugins.PluginInterface): spot modules presence and taints.""" _version = (1, 0, 0) - _required_framework_version = (2, 18, 0) + _required_framework_version = (2, 17, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 3ab5fa90424b86904bca0a4ca987370aa890249f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 16 Jan 2025 19:59:31 +0000 Subject: [PATCH 0375/1352] Update copyright dates --- README.md | 2 +- doc/source/conf.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1463c2bde..4e6953592 100644 --- a/README.md +++ b/README.md @@ -106,7 +106,7 @@ The latest generated copy of the documentation can be found at: Date: Fri, 17 Jan 2025 07:28:13 +1100 Subject: [PATCH 0376/1352] linux: mount api: fix vfsmount pointer check --- volatility3/framework/symbols/linux/__init__.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 931c461b9..f9a3ddde5 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -139,7 +139,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): if not (rdentry and rdentry.is_readable() and rmnt and rmnt.is_readable()): return "" - if isinstance(vfsmnt, objects.Pointer) and not (rmnt and rmnt.is_readable()): + if isinstance(vfsmnt, objects.Pointer) and not ( + vfsmnt and vfsmnt.is_readable() + ): # vfsmnt can be the vfsmount object itself (>=3.3) or a vfsmount * (<3.3) return "" From 4d05e8a76c4b91ed9c998bce316d230614af031e Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 17 Jan 2025 08:49:20 +1100 Subject: [PATCH 0377/1352] linux: mount API: escape '*' in docstrings to ensure correct documentation rendering --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 6d341653b..9ba3cabab 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1520,17 +1520,17 @@ class vfsmount(objects.StructType): """Helper to make sure it is comparing two pointers to 'vfsmount'. Depending on the kernel version, see 3376f34fff5be9954fd9a9c4fd68f4a0a36d480e, - the calling object (self) could be a 'vfsmount *' (<3.3) or a 'vfsmount' (>=3.3). + the calling object (self) could be a 'vfsmount \\*' (<3.3) or a 'vfsmount' (>=3.3). This way we trust in the framework "auto" dereferencing ability to assure that when we reach this point 'self' will be a 'vfsmount' already and self.vol.offset - a 'vfsmount *' and not a 'vfsmount **'. The argument must be a 'vfsmount *'. + a 'vfsmount \\*' and not a 'vfsmount \\*\\*'. The argument must be a 'vfsmount \\*'. Typically, it's called from do_get_path(). Args: vfsmount_ptr: A pointer to a 'vfsmount' Raises: - exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount *' + exceptions.VolatilityException: If vfsmount_ptr is not a 'vfsmount \\*' Returns: 'True' if the given argument points to the same 'vfsmount' as 'self'. From ad0c48e8c9871538e8e31e7047553c68ddcfc69f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 17 Jan 2025 08:50:57 +1100 Subject: [PATCH 0378/1352] linux: mount info plugin: revert minor version increment in favor of a patch-level update --- volatility3/framework/plugins/linux/mountinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index 5a0d39f31..47d8705c8 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -36,7 +36,7 @@ class MountInfo(plugins.PluginInterface): """Lists mount points on processes mount namespaces""" _required_framework_version = (2, 2, 0) - _version = (1, 3, 0) + _version = (1, 2, 4) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 50c690e280dedfeb8f64a46f908c9bddc9e06f70 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 17 Jan 2025 09:27:07 +1100 Subject: [PATCH 0379/1352] linux: proc.Maps plugin: improve pointers validation --- volatility3/framework/plugins/linux/proc.py | 59 ++++++++++++--------- 1 file changed, 33 insertions(+), 26 deletions(-) diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 441c6bc93..23d6605b7 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -21,7 +21,7 @@ class Maps(plugins.PluginInterface): """Lists all memory maps for all processes.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 2) + _version = (1, 0, 3) MAXSIZE_DEFAULT = 1024 * 1024 * 1024 # 1 Gb @@ -83,18 +83,24 @@ class Maps(plugins.PluginInterface): Returns: Yields vmas based on the task and filtered based on the filter function """ - if task.mm: - for vma in task.mm.get_vma_iter(): - if filter_func(vma): - yield vma - else: - vollog.debug( - f"Excluded vma at offset {vma.vol.offset:#x} for pid {task.pid} due to filter_func" - ) - else: + mm_pointer = task.mm + if not mm_pointer: vollog.debug( - f"Excluded pid {task.pid} as there is no mm member. It is likely a kernel thread." + f"Excluded pid {task.pid} as there is no mm member. It is likely a kernel thread" ) + return + + if not mm_pointer.is_readable(): + vollog.error(f"Task {task.pid} has an invalid mm member") + return + + for vma in mm_pointer.get_vma_iter(): + if filter_func(vma): + yield vma + else: + vollog.debug( + f"Excluded vma at offset {vma.vol.offset:#x} for pid {task.pid} due to filter_func" + ) @classmethod def vma_dump( @@ -174,31 +180,32 @@ class Maps(plugins.PluginInterface): ] # if any of the user supplied addresses would fall within this vma return true - if addrs_in_vma: - return True - else: - return False + return bool(addrs_in_vma) vma_filter_func = vma_filter_function + for task in tasks: - if not task.mm: + if not (task.mm and task.mm.is_readable()): continue name = utility.array_to_string(task.comm) for vma in self.list_vmas(task, filter_func=vma_filter_func): flags = vma.get_protection() page_offset = vma.get_page_offset() - major = 0 - minor = 0 - inode = 0 - if vma.vm_file != 0: + inode_num = None + try: dentry = vma.vm_file.get_dentry() - if dentry != 0: - inode_object = dentry.d_inode - major = inode_object.i_sb.major - minor = inode_object.i_sb.minor - inode = inode_object.i_ino + inode_ptr = dentry.d_inode + inode_num = inode_ptr.i_ino + major = inode_ptr.i_sb.major + minor = inode_ptr.i_sb.minor + except exceptions.InvalidAddressException: + if not inode_num: + inode_num = 0 + major = 0 + minor = 0 + path = vma.get_name(self.context, task) file_output = "Disabled" @@ -238,7 +245,7 @@ class Maps(plugins.PluginInterface): format_hints.Hex(page_offset), major, minor, - inode, + inode_num, path, file_output, ), From 5dc4dfcee8aca6b3e1b0a314e53e8476aa499339 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 17 Jan 2025 09:30:59 +1100 Subject: [PATCH 0380/1352] linux: bpf_prog extension object: improve pointers validation --- volatility3/framework/symbols/linux/extensions/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index df1c00e3d..a3cd66238 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2023,8 +2023,11 @@ class bpf_prog(objects.StructType): prog_tag_addr = self.tag.vol.offset prog_tag_size = self.tag.count - prog_tag_bytes = vmlinux_layer.read(prog_tag_addr, prog_tag_size) + if not vmlinux_layer.is_valid(prog_tag_addr, prog_tag_size): + vollog.debug("Unable to read bpf tag string from 0x%x", prog_tag_addr) + return None + prog_tag_bytes = vmlinux_layer.read(prog_tag_addr, prog_tag_size) prog_tag = binascii.hexlify(prog_tag_bytes).decode() return prog_tag From c28944cdd3c65c72e033d1fc344fdfa858a2545a Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 17 Jan 2025 09:33:01 +1100 Subject: [PATCH 0381/1352] linux:sockstat plugin and list_sockets API: improve pointers validation --- volatility3/framework/plugins/linux/sockstat.py | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 7376bcbee..764c04563 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -438,7 +438,7 @@ class Sockstat(plugins.PluginInterface): """Lists all network connections for all processes.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 2) + _version = (3, 0, 3) @classmethod def get_requirements(cls): @@ -514,25 +514,28 @@ class Sockstat(plugins.PluginInterface): fd_num, filp, _full_path = fd_internal.fd_fields task = fd_internal.task + if not (filp.f_op and filp.f_op.is_readable()): + continue + if filp.f_op not in (sfop_addr, dfop_addr): continue dentry = filp.get_dentry() - if not dentry: + if not (dentry and dentry.is_readable()): continue d_inode = dentry.d_inode - if not d_inode: + if not (d_inode and d_inode.is_readable()): continue socket_alloc = linux.LinuxUtilities.container_of( d_inode, "socket_alloc", "vfs_inode", vmlinux ) - socket = socket_alloc.socket - - if not (socket and socket.sk): + if not socket_alloc: + continue + socket = socket_alloc.socket + if not (socket.sk and socket.sk.is_readable()): continue - sock = socket.sk.dereference() sock_type = sock.get_type() From 77b8058913910badde4f6a48c0af568d45ceae6f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 17 Jan 2025 09:41:25 +1100 Subject: [PATCH 0382/1352] linux:kmsg plugin: improve pointers validation --- volatility3/framework/plugins/linux/kmsg.py | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index 638c2ccf2..248e37dd8 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -136,7 +136,12 @@ class ABCKmsg(ABC): """ def get_string(self, addr: int, length: int) -> str: - txt = self._context.layers[self.layer_name].read(addr, length) # type: ignore + layer = self._context.layers[self.layer_name] + if not layer.is_valid(addr, length): + return "" + + txt = layer.read(addr, length) + return txt.decode(encoding="utf8", errors="replace") def nsec_to_sec_str(self, nsec: int) -> str: @@ -281,9 +286,13 @@ class Kmsg_3_5_to_3_11(ABCKmsg): log_struct_name = self._get_log_struct_name() log_struct_size = self.vmlinux.get_type(log_struct_name).size dict_offset = msg.vol.offset + log_struct_size + msg.text_len - dict_data = self._context.layers[self.layer_name].read( - dict_offset, msg.dict_len - ) + layer = self._context.layers[self.layer_name] + try: + dict_data = layer.read(dict_offset, msg.dict_len) + except exceptions.InvalidAddressException: + vollog.debug("Unable to read kmsg dict from 0x%x", dict_offset) + return None + for chunk in dict_data.split(b"\x00"): yield " " + chunk.decode() From 583a06630f9cef5659fb5667c74911701e0e095c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 17 Jan 2025 09:49:53 +1100 Subject: [PATCH 0383/1352] linux:check_syscall plugin: improve pointers validation --- volatility3/framework/plugins/linux/check_syscall.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index 13d312f2f..9ffd4c497 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -82,7 +82,7 @@ class Check_syscall(plugins.PluginInterface): return table_size - def _get_table_info_disassembly(self, ptr_sz, vmlinux): + def _get_table_info_disassembly(self, ptr_sz, vmlinux) -> int: """Find the size of the system call table by disassembling functions that immediately reference it in their first instruction This is in the form 'cmp reg,NR_syscalls'.""" @@ -107,9 +107,13 @@ class Check_syscall(plugins.PluginInterface): return 0 vmlinux = self.context.modules[self.config["kernel"]] - data = self.context.layers.read(vmlinux.layer_name, func_addr, 6) + vmlinux_layer = self.context.layers[vmlinux.layer_name] + try: + data = vmlinux_layer.read(func_addr, 6) + except exceptions.InvalidAddressException: + return 0 - for address, size, mnemonic, op_str in md.disasm_lite(data, func_addr): + for _address, _size, mnemonic, op_str in md.disasm_lite(data, func_addr): if mnemonic == "CMP": table_size = int(op_str.split(",")[1].strip()) & 0xFFFF break From 6dac7195dc88518fa8b40a70d57e855d40b30b01 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 17 Jan 2025 09:50:53 +1100 Subject: [PATCH 0384/1352] linux: elf_linkmap object extension: Use a more generic invalid address exception --- volatility3/framework/symbols/linux/extensions/elf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index eadcbbae0..fb5f89f60 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -437,7 +437,7 @@ class elf_linkmap(objects.StructType): def get_name(self): try: buf = self._context.layers.read(self.vol.layer_name, self.l_name, 256) - except exceptions.PagedInvalidAddressException: + except exceptions.InvalidAddressException: # Protection against memory smear vollog.log( constants.LOGLEVEL_VVVV, From adf81bc74a388d6ff5bffabe588bc5ca72147506 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 16 Jan 2025 19:59:31 +0000 Subject: [PATCH 0385/1352] Update copyright dates --- README.md | 2 +- doc/source/conf.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cc33d3cc4..b74bdab0b 100644 --- a/README.md +++ b/README.md @@ -88,7 +88,7 @@ The latest generated copy of the documentation can be found at: Date: Fri, 17 Jan 2025 16:03:47 +0000 Subject: [PATCH 0386/1352] Core: Correct version dependencies to avoid conflicts Fixes #1546 --- pyproject.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 86e3921d2..542a1480a 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -34,7 +34,7 @@ cloud = [ dev = [ "volatility3[full,cloud]", "jsonschema>=4.23.0,<5", - "pyinstaller>=6.11.0,<7", + "pyinstaller>=6.5.0,<7", "pyinstaller-hooks-contrib>=2024.9", "types-jsonschema>=4.23.0,<5", ] @@ -48,7 +48,7 @@ test = [ docs = [ "volatility3[dev]", - "sphinx>=8.0.0,<7", + "sphinx>=8.0.0,<9", "sphinx-autodoc-typehints>=2.5.0,<3", "sphinx-rtd-theme>=3.0.1,<4", ] From c4430cda8d6b13b0d69a787fe32e8158ae471c3a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 17 Jan 2025 16:09:35 +0000 Subject: [PATCH 0387/1352] Core: Try to maintain python-3.8 support for the documentation --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 542a1480a..8944bb058 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -49,7 +49,7 @@ test = [ docs = [ "volatility3[dev]", "sphinx>=8.0.0,<9", - "sphinx-autodoc-typehints>=2.5.0,<3", + "sphinx-autodoc-typehints>=2.0.0,<3", "sphinx-rtd-theme>=3.0.1,<4", ] From 13a8c53f7b64bc7180b665e363b2a3f0348e8b04 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 17 Jan 2025 16:13:35 +0000 Subject: [PATCH 0388/1352] Core: There was no clear reason to stop supporting older versions of sphinx --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 8944bb058..3f16eeece 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -48,7 +48,7 @@ test = [ docs = [ "volatility3[dev]", - "sphinx>=8.0.0,<9", + "sphinx>=4.0.0,<9", "sphinx-autodoc-typehints>=2.0.0,<3", "sphinx-rtd-theme>=3.0.1,<4", ] From cc9486cf03f6f8b8035069f02702ce30a589cb7e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 02:19:11 +0100 Subject: [PATCH 0389/1352] pre-process module triaging to improve readability --- .../framework/plugins/linux/modxview.py | 71 ++++++++++--------- 1 file changed, 38 insertions(+), 33 deletions(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 3c2c5f05e..125c1cc33 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -82,7 +82,8 @@ class Modxview(interfaces.plugins.PluginInterface): kernel_name: str, run_hidden_modules: bool = True, ) -> Dict[str, List[extensions.module]]: - """Run module scanning plugins and aggregate the results. + """Run module scanning plugins and aggregate the results. It is designed + to not operate any inter-plugin results triage. Args: run_hidden_modules: specify if the hidden_modules plugin should be run @@ -128,46 +129,50 @@ class Modxview(interfaces.plugins.PluginInterface): def _generator(self): kernel_name = self.config["kernel"] run_results = self.run_modules_scanners(self.context, kernel_name) - modules_offsets = {} - for key in ["lsmod", "check_modules", "hidden_modules"]: - modules_offsets[key] = set(module.vol.offset for module in run_results[key]) + aggregated_modules = {} + # We want to be explicit on the plugins results we are interested in + for plugin_name in ["lsmod", "check_modules", "hidden_modules"]: + # Iterate over each recovered module + for module in run_results[plugin_name]: + # Use offsets as unique keys, whether a module + # appears in many plugin runs or not + if aggregated_modules.get(module.vol.offset): + # Append the plugin to the list of originating plugins + aggregated_modules[module.vol.offset][1].append(plugin_name) + else: + aggregated_modules[module.vol.offset] = (module, [plugin_name]) - seen_addresses = set() - for modules_list in run_results.values(): - for module in modules_list: - if module.vol.offset in seen_addresses: - continue - seen_addresses.add(module.vol.offset) - - if self.config.get("plain_taints"): - taints = tainting.Tainting.get_taints_as_plain_string( + for module_offset, (module, originating_plugins) in aggregated_modules.items(): + # Tainting parsing capabilities applied to the module + if self.config.get("plain_taints"): + taints = tainting.Tainting.get_taints_as_plain_string( + self.context, + kernel_name, + module.taints, + True, + ) + else: + taints = ",".join( + tainting.Tainting.get_taints_parsed( self.context, kernel_name, module.taints, True, ) - else: - taints = ",".join( - tainting.Tainting.get_taints_parsed( - self.context, - kernel_name, - module.taints, - True, - ) - ) - - yield ( - 0, - ( - module.get_name() or NotAvailableValue(), - format_hints.Hex(module.vol.offset), - module.vol.offset in modules_offsets["lsmod"], - module.vol.offset in modules_offsets["check_modules"], - module.vol.offset in modules_offsets["hidden_modules"], - taints or NotAvailableValue(), - ), ) + yield ( + 0, + ( + module.get_name() or NotAvailableValue(), + format_hints.Hex(module_offset), + "lsmod" in originating_plugins, + "check_modules" in originating_plugins, + "hidden_modules" in originating_plugins, + taints or NotAvailableValue(), + ), + ) + def run(self): columns = [ ("Name", str), From 3b679cbafbb50a2c986a63efd223cf9088bbc330 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 13:26:43 +0100 Subject: [PATCH 0390/1352] explicit None check --- volatility3/framework/plugins/linux/modxview.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 125c1cc33..c74bf28e8 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -136,7 +136,7 @@ class Modxview(interfaces.plugins.PluginInterface): for module in run_results[plugin_name]: # Use offsets as unique keys, whether a module # appears in many plugin runs or not - if aggregated_modules.get(module.vol.offset): + if aggregated_modules.get(module.vol.offset, None) is not None: # Append the plugin to the list of originating plugins aggregated_modules[module.vol.offset][1].append(plugin_name) else: From bb6556dbc0145682866d56bb2608b5b841e381e8 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 13:37:52 +0100 Subject: [PATCH 0391/1352] correct arguments for pre_4_10_rc1 --- volatility3/framework/symbols/linux/utilities/tainting.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index 552f51b98..14b69d3d6 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -117,9 +117,7 @@ class Tainting(interfaces.configuration.VersionableInterface): return cls._module_flags_taint_post_4_10_rc1( context, kernel_module_name, taints, is_module ) - return cls._module_flags_taint_pre_4_10_rc1( - context, kernel_module_name, taints, is_module - ) + return cls._module_flags_taint_pre_4_10_rc1(taints, is_module) @classmethod def get_taints_parsed( From 0b82f731375583076abdfabd332ce067612d69f5 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 13:45:30 +0100 Subject: [PATCH 0392/1352] functools caching and doc. --- .../framework/symbols/linux/utilities/tainting.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index 14b69d3d6..c1136436e 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -1,3 +1,5 @@ +import functools + from volatility3 import framework from volatility3.framework import interfaces from volatility3.framework.constants import linux as linux_constants @@ -18,11 +20,18 @@ class Tainting(interfaces.configuration.VersionableInterface): framework.require_interface_version(*_required_framework_version) @classmethod + @functools.lru_cache def _get_kernel_taint_flags_list( cls, context: interfaces.context.ContextInterface, kernel_module_name: str, ) -> Optional[List[interfaces.objects.ObjectInterface]]: + """Determine whether the kernel embeds taint flags definition + in-memory or not. + + Returns: + A list of "taint_flag" kernel objects if taint_flags symbok exists + """ kernel = context.modules[kernel_module_name] if kernel.has_symbol("taint_flags"): return list(kernel.object_from_symbol("taint_flags")) From 8095924e8a926990f6002f16d2c7259c5c750980 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 13:46:13 +0100 Subject: [PATCH 0393/1352] typo --- volatility3/framework/symbols/linux/utilities/tainting.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index c1136436e..2360401d5 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -30,7 +30,7 @@ class Tainting(interfaces.configuration.VersionableInterface): in-memory or not. Returns: - A list of "taint_flag" kernel objects if taint_flags symbok exists + A list of "taint_flag" kernel objects if taint_flags symbol exists """ kernel = context.modules[kernel_module_name] if kernel.has_symbol("taint_flags"): From 2fe8ee5983bd5faf8a89db5712512aa411329dbc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 18 Jan 2025 13:18:53 +0000 Subject: [PATCH 0394/1352] Layers: Update LeechCore RawIO with better error handling for readlines Fixes #1419 --- volatility3/framework/layers/leechcore.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/framework/layers/leechcore.py b/volatility3/framework/layers/leechcore.py index eeede1673..06c359203 100644 --- a/volatility3/framework/layers/leechcore.py +++ b/volatility3/framework/layers/leechcore.py @@ -129,6 +129,8 @@ if HAS_LEECHCORE: def readline(self, __size: Optional[int] = ...) -> bytes: data = b"" + if not __size: + __size = 0 while __size > self._chunk_size or __size < 0: data += self.read(self._chunk_size) index = data.find(b"\n") From 0849c163a1c517fa8595f9cc7610a737d1904fc2 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 14:48:37 +0100 Subject: [PATCH 0395/1352] appropriate symbols type hinting --- volatility3/framework/contexts/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index f527544c0..17a91e827 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -337,7 +337,7 @@ class Module(interfaces.context.ModuleInterface): ) @property - def symbols(self): + def symbols(self) -> Iterable[str]: return self.context.symbol_space[self.symbol_table_name].symbols get_symbol = get_module_wrapper("get_symbol") From d46cb3328d07ae2216045ba3fc33679c2ab13fbc Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 14:48:46 +0100 Subject: [PATCH 0396/1352] appropriate symbols type hinting --- volatility3/framework/interfaces/context.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index a87e0f1e8..2b95a18ad 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -303,8 +303,8 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): """Determines whether an enumeration is present in the module's symbol table.""" @abstractmethod - def symbols(self) -> List: - """Lists the symbols contained in the symbol table for this module""" + def symbols(self) -> Iterable[str]: + """Returns an iterable of the symbols contained in the symbol table for this module""" @abstractmethod def get_symbols_by_absolute_location(self, offset: int, size: int = 0) -> List[str]: From fb93d2333b8d3854d348548decc76ac67f358699 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 14:50:14 +0100 Subject: [PATCH 0397/1352] improve comments --- volatility3/framework/interfaces/symbols.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index b8712e38d..c0bebe1e2 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -122,7 +122,7 @@ class BaseSymbolTableInterface: @property def symbols(self) -> Iterable[str]: - """Returns an iterator of the Symbol names.""" + """Returns an iterable of the available symbol names.""" raise NotImplementedError( "Abstract property symbols not implemented by subclass." ) @@ -131,7 +131,7 @@ class BaseSymbolTableInterface: @property def types(self) -> Iterable[str]: - """Returns an iterator of the Symbol type names.""" + """Returns an iterable of the available symbol type names.""" raise NotImplementedError( "Abstract property types not implemented by subclass." ) @@ -149,7 +149,7 @@ class BaseSymbolTableInterface: @property def enumerations(self) -> Iterable[Any]: - """Returns an iterator of the Enumeration names.""" + """Returns an iterable of the available enumerations names.""" raise NotImplementedError( "Abstract property enumerations not implemented by subclass." ) @@ -366,6 +366,7 @@ class NativeTableInterface(BaseSymbolTableInterface): @property def symbols(self) -> Iterable[str]: + """Returns an iterable of the available symbol names.""" return [] def get_enumeration(self, name: str) -> objects.Template: From 1e9551b0530be824ab8d9a40db57cbd813d48136 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 14:50:28 +0100 Subject: [PATCH 0398/1352] types base class and comments improvements --- volatility3/framework/interfaces/symbols.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index c0bebe1e2..752d288f7 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -375,7 +375,13 @@ class NativeTableInterface(BaseSymbolTableInterface): ) @property - def enumerations(self) -> Iterable[str]: + def enumerations(self) -> Iterable[Any]: + """Returns an iterable of the available enumerations.""" + return [] + + @property + def types(self) -> Iterable[str]: + """Returns an iterable of the available symbol type names.""" return [] From aa99410dd2c50ee556293db959c469739c882684 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 14:51:31 +0100 Subject: [PATCH 0399/1352] prefer KeysView iterable to lists --- volatility3/framework/symbols/intermed.py | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 6802af7d6..0a30148aa 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -411,18 +411,23 @@ class Version1Format(ISFormatTable): @property def symbols(self) -> Iterable[str]: - """Returns an iterator of the symbol names.""" - return list(self._json_object.get("symbols", {})) + """Returns an iterable (KeysView) of the available symbol names.""" + return self._json_object.get("symbols", {}).keys() @property - def enumerations(self) -> Iterable[str]: - """Returns an iterator of the available enumerations.""" - return list(self._json_object.get("enums", {})) + def enumerations(self) -> Iterable[Any]: + """Returns an iterable (KeysView) of the available enumerations.""" + return self._json_object.get("enums", {}).keys() @property - def types(self) -> Iterable[str]: - """Returns an iterator of the symbol type names.""" - return list(self._json_object.get("user_types", {})) + list(self.natives.types) + def types(self): + """Returns an iterable (KeysView) of the available symbol type names.""" + # self.natives.types (set) is generally very small compared to user_types, + # so the dict conversion overhead can be neglected + return { + **self._json_object.get("user_types", {}), + **dict.fromkeys(self.natives.types), + }.keys() def get_type_class(self, name: str) -> Type[interfaces.objects.ObjectInterface]: return self._overrides.get(name, objects.AggregateType) From 3a2933155b6f92a8585666f611cd2069424ce5a9 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 14:51:52 +0100 Subject: [PATCH 0400/1352] improve comments --- volatility3/framework/symbols/native.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/native.py b/volatility3/framework/symbols/native.py index 7c3e1b312..61417532e 100644 --- a/volatility3/framework/symbols/native.py +++ b/volatility3/framework/symbols/native.py @@ -30,7 +30,7 @@ class NativeTable(interfaces.symbols.NativeTableInterface): @property def types(self) -> Iterable[str]: - """Returns an iterator of the symbol type names.""" + """Returns an iterable (set) of the available symbol type names.""" return self._types def get_type(self, type_name: str) -> interfaces.objects.Template: From ba09db6952d37590f62a647265c2bb5bb903ec3c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 14:54:04 +0100 Subject: [PATCH 0401/1352] improve comments --- volatility3/framework/interfaces/symbols.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index 752d288f7..2d142de9a 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -149,7 +149,7 @@ class BaseSymbolTableInterface: @property def enumerations(self) -> Iterable[Any]: - """Returns an iterable of the available enumerations names.""" + """Returns an iterable of the available enumerations.""" raise NotImplementedError( "Abstract property enumerations not implemented by subclass." ) From 4b3d93b0f0637c7d41acc545f397e3522a913978 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 15:00:03 +0100 Subject: [PATCH 0402/1352] 2.17.0 -> 2.18.0 bump --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 3d68ab810..832b2a5ba 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 17 # Number of changes that only add to the interface +VERSION_MINOR = 18 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From c5628c5d79496ae051942598bab08c19d3632a18 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 15:48:44 +0100 Subject: [PATCH 0403/1352] revert the mistakenly removed types type hinting --- volatility3/framework/symbols/intermed.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 0a30148aa..9ece69d8b 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -420,7 +420,7 @@ class Version1Format(ISFormatTable): return self._json_object.get("enums", {}).keys() @property - def types(self): + def types(self) -> Iterable[str]: """Returns an iterable (KeysView) of the available symbol type names.""" # self.natives.types (set) is generally very small compared to user_types, # so the dict conversion overhead can be neglected From 0ee016e65554539318705a5b7c292864fcc2f436 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 15:50:28 +0100 Subject: [PATCH 0404/1352] 2.17.0 -> 2.17.1 bump --- volatility3/framework/constants/_version.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 832b2a5ba..041439909 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 18 # Number of changes that only add to the interface -VERSION_PATCH = 0 # Number of changes that do not change the interface +VERSION_MINOR = 17 # Number of changes that only add to the interface +VERSION_PATCH = 1 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From c2ef3c2fe575f2c3ea49541b7e1207e7d93884f1 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 18 Jan 2025 15:59:51 +0100 Subject: [PATCH 0405/1352] add fixme about merge operator --- volatility3/framework/symbols/intermed.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 9ece69d8b..cb0b67969 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -422,8 +422,12 @@ class Version1Format(ISFormatTable): @property def types(self) -> Iterable[str]: """Returns an iterable (KeysView) of the available symbol type names.""" - # self.natives.types (set) is generally very small compared to user_types, - # so the dict conversion overhead can be neglected + # We use ** instead of + # `set(self._json_object.get("user_types", {}).keys()).union(self.natives.types)` + # because converting user_types dict to a set is costly. + # It is more efficient to convert the (very small) self.natives.types set to a dict. + # FIXME: On Python3.8 support drop, merge the two dicts using the merge operator: + # (self._json_object.get("user_types", {}) | dict.fromkeys(self.natives.types)).keys() return { **self._json_object.get("user_types", {}), **dict.fromkeys(self.natives.types), From 726fbe6ccec8480c1baa74fadcc7fc4e87377bcd Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 13:01:14 +0100 Subject: [PATCH 0406/1352] 2.17.1 -> 2.18.0 bump --- volatility3/framework/constants/_version.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 041439909..832b2a5ba 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 17 # Number of changes that only add to the interface -VERSION_PATCH = 1 # Number of changes that do not change the interface +VERSION_MINOR = 18 # Number of changes that only add to the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From 08830fee05c30adfc5ea4e997ce317f6f6927033 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:06:42 +0100 Subject: [PATCH 0407/1352] use architectures.LINUX_ARCHS --- volatility3/framework/plugins/linux/pagecache.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 382268515..408a9b98a 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -8,6 +8,7 @@ import datetime from dataclasses import dataclass, astuple from typing import List, Set, Type, Iterable +from volatility3.framework.constants import architectures from volatility3.framework import renderers, interfaces from volatility3.framework.renderers import format_hints from volatility3.framework.interfaces import plugins @@ -112,7 +113,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.ModuleRequirement( name="kernel", description="Linux kernel", - architectures=["Intel32", "Intel64"], + architectures=architectures.LINUX_ARCHS, ), requirements.PluginRequirement( name="mountinfo", plugin=mountinfo.MountInfo, version=(1, 2, 0) @@ -397,7 +398,7 @@ class InodePages(plugins.PluginInterface): requirements.ModuleRequirement( name="kernel", description="Linux kernel", - architectures=["Intel32", "Intel64"], + architectures=architectures.LINUX_ARCHS, ), requirements.PluginRequirement( name="files", plugin=Files, version=(1, 0, 0) From d325e1ca176b55f68de03f462ca855631736ef6c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:08:27 +0100 Subject: [PATCH 0408/1352] add inode_size and format_symlink to Inode* dataclasses --- volatility3/framework/plugins/linux/pagecache.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 408a9b98a..c86664f3d 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -38,6 +38,11 @@ class InodeUser: modification_time: str change_time: str path: str + inode_size: int + + @staticmethod + def format_symlink(symlink_source: str, symlink_dest: str): + return f"{symlink_source} -> {symlink_dest}" @dataclass @@ -81,6 +86,7 @@ class InodeInternal: access_time_dt = self.inode.get_access_time() modification_time_dt = self.inode.get_modification_time() change_time_dt = self.inode.get_change_time() + inode_size = int(self.inode.i_size) inode_user = InodeUser( superblock_addr=superblock_addr, @@ -96,6 +102,7 @@ class InodeInternal: modification_time=modification_time_dt, change_time=change_time_dt, path=self.path, + inode_size=inode_size, ) return inode_user From 1d0159325fbf04bb5029a9ed4ae2ea1acc770cee Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:09:20 +0100 Subject: [PATCH 0409/1352] switch to InodeUser.format_symlink --- volatility3/framework/plugins/linux/pagecache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index c86664f3d..a0dd8efe4 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -156,10 +156,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): """ # i_link (fast symlinks) were introduced in 4.2 if inode and inode.is_link and inode.has_member("i_link") and inode.i_link: - i_link_str = inode.i_link.dereference().cast( + symlink_dest = inode.i_link.dereference().cast( "string", max_length=255, encoding="utf-8", errors="replace" ) - symlink_path = f"{symlink_path} -> {i_link_str}" + symlink_path = InodeUser.format_symlink(symlink_path, symlink_dest) return symlink_path From 48a8f3929bbe992ff687a494e3ea0e6a7446f42c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:10:32 +0100 Subject: [PATCH 0410/1352] add and leverage follow_symlinks parameter --- volatility3/framework/plugins/linux/pagecache.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index a0dd8efe4..4871d0d0f 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -220,12 +220,14 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str, + follow_symlinks: bool = True, ) -> Iterable[InodeInternal]: """Retrieves the inodes from the superblocks Args: context: The context that the plugin will operate within vmlinux_module_name: The name of the kernel module on which to operate + follow_symlinks: Whether to follow symlinks or not Yields: An InodeInternal object @@ -297,7 +299,9 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue seen_inodes.add(file_inode_ptr) - file_path = cls._follow_symlink(file_inode_ptr, file_path) + if follow_symlinks: + file_path = cls._follow_symlink(file_inode_ptr, file_path) + inode_in = InodeInternal( superblock=superblock, mountpoint=mountpoint, From 6f2ff4f7c6f702c11bf7d75b5ab78cb8f5881a20 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:11:03 +0100 Subject: [PATCH 0411/1352] add InodeSize column to Files --- volatility3/framework/plugins/linux/pagecache.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 4871d0d0f..770c6391a 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -389,6 +389,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): ("ModificationTime", datetime.datetime), ("ChangeTime", datetime.datetime), ("FilePath", str), + ("InodeSize", int), ] return renderers.TreeGrid( From 85941060051b530350ad8e770de4c1f2d3edefee Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:12:10 +0100 Subject: [PATCH 0412/1352] 1.0.1 -> 1.2.0 Files bump --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 770c6391a..d57bd77f8 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -112,7 +112,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 2, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From e8b44efc17dbfd6e412436d324702ed3e4cc7c7f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:13:26 +0100 Subject: [PATCH 0413/1352] add and leverage write_inode_content_to_stream --- .../framework/plugins/linux/pagecache.py | 60 ++++++++++++------- 1 file changed, 38 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index d57bd77f8..42fa7538f 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -6,7 +6,7 @@ import math import logging import datetime from dataclasses import dataclass, astuple -from typing import List, Set, Type, Iterable +from typing import List, Set, Type, Iterable, IO from volatility3.framework.constants import architectures from volatility3.framework import renderers, interfaces @@ -452,31 +452,47 @@ class InodePages(plugins.PluginInterface): vollog.error("The inode is not a regular file") return None - # By using truncate/seek, provided the filesystem supports it, a sparse file will be + try: + with open_method(filename) as f: + InodePages.write_inode_content_to_stream(inode, f, vmlinux_layer) + except OSError as e: + vollog.error("Unable to write to file (%s): %s", filename, e) + + @staticmethod + def write_inode_content_to_stream( + inode: interfaces.objects.ObjectInterface, + stream: IO, + vmlinux_layer: interfaces.layers.TranslationLayerInterface, + ) -> None: + """Extracts the inode's contents from the page cache and saves them to a stream + + Args: + inode: The inode to dump + stream: A IO steam to write to, typically FileHandlerInterface or BytesIO + vmlinux_layer: The kernel layer to obtain the page size + """ + + # By using truncate/seek, provided the filesystem supports it, and the + # stream is a File interface, a sparse file will be # created, saving both disk space and I/O time. # Additionally, using the page index will guarantee that each page is written at the # appropriate file position. - try: - with open_method(filename) as f: - inode_size = inode.i_size - f.truncate(inode_size) + inode_size = inode.i_size + stream.truncate(inode_size) - for page_idx, page_content in inode.get_contents(): - current_fp = page_idx * vmlinux_layer.page_size - max_length = inode_size - current_fp - page_bytes = page_content[:max_length] - if current_fp + len(page_bytes) > inode_size: - vollog.error( - "Page out of file bounds: inode 0x%x, inode size %d, page index %d", - inode.vol.offset, - inode_size, - page_idx, - ) - f.seek(current_fp) - f.write(page_bytes) - - except OSError as e: - vollog.error("Unable to write to file (%s): %s", filename, e) + for page_idx, page_content in inode.get_contents(): + current_fp = page_idx * vmlinux_layer.page_size + max_length = inode_size - current_fp + page_bytes = page_content[:max_length] + if current_fp + len(page_bytes) > inode_size: + vollog.error( + "Page out of file bounds: inode 0x%x, inode size %d, page index %d", + inode.vol.offset, + inode_size, + page_idx, + ) + stream.seek(current_fp) + stream.write(page_bytes) def _generator(self): vmlinux_module_name = self.config["kernel"] From 818ddb746bb5bcbf45fe22fb54e8022d75d5fedd Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:15:55 +0100 Subject: [PATCH 0414/1352] 2.0.0 -> 2.1.0 InodePages bump --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 42fa7538f..feac31bb7 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -402,7 +402,7 @@ class InodePages(plugins.PluginInterface): _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (2, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From da068676d13eeefae033e46f8a916d91881bc2a6 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 15:16:09 +0100 Subject: [PATCH 0415/1352] typo --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index feac31bb7..e87bc2c9d 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -468,7 +468,7 @@ class InodePages(plugins.PluginInterface): Args: inode: The inode to dump - stream: A IO steam to write to, typically FileHandlerInterface or BytesIO + stream: An IO steam to write to, typically FileHandlerInterface or BytesIO vmlinux_layer: The kernel layer to obtain the page size """ From 452d6e705b973213238becd22d736f6ee1cb45e0 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 16:26:25 +0100 Subject: [PATCH 0416/1352] 1.0.1 -> 1.1.0 Files bump --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index e87bc2c9d..89d30a9eb 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -112,7 +112,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - _version = (1, 2, 0) + _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From ecae545f5897e7c9a59d231d0b3f04b195cbf169 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 17:05:52 +0100 Subject: [PATCH 0417/1352] typo --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 7d211150a..850045244 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2948,7 +2948,7 @@ class scatterlist(objects.StructType): Returns: An iterator of bytes """ - # Either "physical" is layer-1 because this is a module layer, either "physical" is the current layer + # Either "physical" is layer-1 because this is a module layer, or "physical" is the current layer physical_layer_name = self._context.layers[self.vol.layer_name].config.get( "memory_layer", self.vol.layer_name ) From eddba98ef7c8c72162233dd19332e770d2a916d7 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 17:09:59 +0100 Subject: [PATCH 0418/1352] type hint format_symlink --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 89d30a9eb..d98103368 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -41,7 +41,7 @@ class InodeUser: inode_size: int @staticmethod - def format_symlink(symlink_source: str, symlink_dest: str): + def format_symlink(symlink_source: str, symlink_dest: str) -> str: return f"{symlink_source} -> {symlink_dest}" From 59703045c78941a12087a295b18cc8bc98414a06 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 17:26:42 +0100 Subject: [PATCH 0419/1352] switch calling convention to context and layer name --- .../framework/plugins/linux/pagecache.py | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index d98103368..d5297ab10 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -435,18 +435,20 @@ class InodePages(plugins.PluginInterface): @staticmethod def write_inode_content_to_file( + context: interfaces.context.ContextInterface, + layer_name: str, inode: interfaces.objects.ObjectInterface, filename: str, open_method: Type[interfaces.plugins.FileHandlerInterface], - vmlinux_layer: interfaces.layers.TranslationLayerInterface, ) -> None: """Extracts the inode's contents from the page cache and saves them to a file Args: + context: The context on which to operate + layer_name: The name of the layer on which to operate inode: The inode to dump filename: Filename for writing the inode content open_method: class for constructing output files - vmlinux_layer: The kernel layer to obtain the page size """ if not inode.is_reg: vollog.error("The inode is not a regular file") @@ -454,24 +456,26 @@ class InodePages(plugins.PluginInterface): try: with open_method(filename) as f: - InodePages.write_inode_content_to_stream(inode, f, vmlinux_layer) + InodePages.write_inode_content_to_stream(context, layer_name, inode, f) except OSError as e: vollog.error("Unable to write to file (%s): %s", filename, e) @staticmethod def write_inode_content_to_stream( + context: interfaces.context.ContextInterface, + layer_name: str, inode: interfaces.objects.ObjectInterface, stream: IO, - vmlinux_layer: interfaces.layers.TranslationLayerInterface, ) -> None: """Extracts the inode's contents from the page cache and saves them to a stream Args: + context: The context on which to operate + layer_name: The name of the layer on which to operate inode: The inode to dump stream: An IO steam to write to, typically FileHandlerInterface or BytesIO - vmlinux_layer: The kernel layer to obtain the page size """ - + layer = context.layers[layer_name] # By using truncate/seek, provided the filesystem supports it, and the # stream is a File interface, a sparse file will be # created, saving both disk space and I/O time. @@ -481,7 +485,7 @@ class InodePages(plugins.PluginInterface): stream.truncate(inode_size) for page_idx, page_content in inode.get_contents(): - current_fp = page_idx * vmlinux_layer.page_size + current_fp = page_idx * layer.page_size max_length = inode_size - current_fp page_bytes = page_content[:max_length] if current_fp + len(page_bytes) > inode_size: @@ -557,7 +561,7 @@ class InodePages(plugins.PluginInterface): filename = open_method.sanitize_filename(f"inode_0x{inode_address:x}.dmp") vollog.info("[*] Writing inode at 0x%x to '%s'", inode_address, filename) self.write_inode_content_to_file( - inode, filename, open_method, vmlinux_layer + self.context, vmlinux_layer.name, inode, filename, open_method ) def run(self): From a02243bb3c4a14076cda7a516c7499e1734f19d0 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 17:27:27 +0100 Subject: [PATCH 0420/1352] 2.1.0 -> 3.0.0 InodePages bump --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index d5297ab10..a86c1b936 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -402,7 +402,7 @@ class InodePages(plugins.PluginInterface): _required_framework_version = (2, 0, 0) - _version = (2, 1, 0) + _version = (3, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From d42ffc01e22672602a346b21f90b3733cd02db3e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 19 Jan 2025 17:33:47 +0100 Subject: [PATCH 0421/1352] typo --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index a86c1b936..77aa42338 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -473,7 +473,7 @@ class InodePages(plugins.PluginInterface): context: The context on which to operate layer_name: The name of the layer on which to operate inode: The inode to dump - stream: An IO steam to write to, typically FileHandlerInterface or BytesIO + stream: An IO stream to write to, typically FileHandlerInterface or BytesIO """ layer = context.layers[layer_name] # By using truncate/seek, provided the filesystem supports it, and the From 74b98e62c7aa4ca721f48651243122fa222548a5 Mon Sep 17 00:00:00 2001 From: ikelos Date: Sun, 19 Jan 2025 23:42:41 +0000 Subject: [PATCH 0422/1352] Revert "Add missing exception handling in env var recovery. Prevent backtraces" --- volatility3/framework/plugins/linux/envars.py | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index 04b75c8a8..8cdbfe493 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -5,7 +5,7 @@ import logging from typing import Iterable, Tuple -from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -58,16 +58,10 @@ class Envars(plugins.PluginInterface): Tuples of (key, value) representing each environment variable. """ - # This ensures the `task` is valid as well as its - # memory mapping structures - try: - task_name = utility.array_to_string(task.comm) - env_start = task.mm.env_start - env_end = task.mm.env_end - except exceptions.InvalidAddressException: - return None - + task_name = utility.array_to_string(task.comm) task_pid = task.pid + env_start = task.mm.env_start + env_end = task.mm.env_end env_area_size = env_end - env_start if not (0 < env_area_size <= env_area_max_size): vollog.debug( From e18bffdde95e4adb0ee89aeb28b3845c53b37687 Mon Sep 17 00:00:00 2001 From: ikelos Date: Sun, 19 Jan 2025 23:51:28 +0000 Subject: [PATCH 0423/1352] Revert "Pre linux.pagecache.recoverfs support" --- .../framework/plugins/linux/pagecache.py | 97 ++++++------------- 1 file changed, 32 insertions(+), 65 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 77aa42338..382268515 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -6,9 +6,8 @@ import math import logging import datetime from dataclasses import dataclass, astuple -from typing import List, Set, Type, Iterable, IO +from typing import List, Set, Type, Iterable -from volatility3.framework.constants import architectures from volatility3.framework import renderers, interfaces from volatility3.framework.renderers import format_hints from volatility3.framework.interfaces import plugins @@ -38,11 +37,6 @@ class InodeUser: modification_time: str change_time: str path: str - inode_size: int - - @staticmethod - def format_symlink(symlink_source: str, symlink_dest: str) -> str: - return f"{symlink_source} -> {symlink_dest}" @dataclass @@ -86,7 +80,6 @@ class InodeInternal: access_time_dt = self.inode.get_access_time() modification_time_dt = self.inode.get_modification_time() change_time_dt = self.inode.get_change_time() - inode_size = int(self.inode.i_size) inode_user = InodeUser( superblock_addr=superblock_addr, @@ -102,7 +95,6 @@ class InodeInternal: modification_time=modification_time_dt, change_time=change_time_dt, path=self.path, - inode_size=inode_size, ) return inode_user @@ -112,7 +104,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - _version = (1, 1, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -120,7 +112,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.ModuleRequirement( name="kernel", description="Linux kernel", - architectures=architectures.LINUX_ARCHS, + architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( name="mountinfo", plugin=mountinfo.MountInfo, version=(1, 2, 0) @@ -156,10 +148,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): """ # i_link (fast symlinks) were introduced in 4.2 if inode and inode.is_link and inode.has_member("i_link") and inode.i_link: - symlink_dest = inode.i_link.dereference().cast( + i_link_str = inode.i_link.dereference().cast( "string", max_length=255, encoding="utf-8", errors="replace" ) - symlink_path = InodeUser.format_symlink(symlink_path, symlink_dest) + symlink_path = f"{symlink_path} -> {i_link_str}" return symlink_path @@ -220,14 +212,12 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str, - follow_symlinks: bool = True, ) -> Iterable[InodeInternal]: """Retrieves the inodes from the superblocks Args: context: The context that the plugin will operate within vmlinux_module_name: The name of the kernel module on which to operate - follow_symlinks: Whether to follow symlinks or not Yields: An InodeInternal object @@ -299,9 +289,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue seen_inodes.add(file_inode_ptr) - if follow_symlinks: - file_path = cls._follow_symlink(file_inode_ptr, file_path) - + file_path = cls._follow_symlink(file_inode_ptr, file_path) inode_in = InodeInternal( superblock=superblock, mountpoint=mountpoint, @@ -389,7 +377,6 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): ("ModificationTime", datetime.datetime), ("ChangeTime", datetime.datetime), ("FilePath", str), - ("InodeSize", int), ] return renderers.TreeGrid( @@ -402,7 +389,7 @@ class InodePages(plugins.PluginInterface): _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -410,7 +397,7 @@ class InodePages(plugins.PluginInterface): requirements.ModuleRequirement( name="kernel", description="Linux kernel", - architectures=architectures.LINUX_ARCHS, + architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( name="files", plugin=Files, version=(1, 0, 0) @@ -435,68 +422,48 @@ class InodePages(plugins.PluginInterface): @staticmethod def write_inode_content_to_file( - context: interfaces.context.ContextInterface, - layer_name: str, inode: interfaces.objects.ObjectInterface, filename: str, open_method: Type[interfaces.plugins.FileHandlerInterface], + vmlinux_layer: interfaces.layers.TranslationLayerInterface, ) -> None: """Extracts the inode's contents from the page cache and saves them to a file Args: - context: The context on which to operate - layer_name: The name of the layer on which to operate inode: The inode to dump filename: Filename for writing the inode content open_method: class for constructing output files + vmlinux_layer: The kernel layer to obtain the page size """ if not inode.is_reg: vollog.error("The inode is not a regular file") return None - try: - with open_method(filename) as f: - InodePages.write_inode_content_to_stream(context, layer_name, inode, f) - except OSError as e: - vollog.error("Unable to write to file (%s): %s", filename, e) - - @staticmethod - def write_inode_content_to_stream( - context: interfaces.context.ContextInterface, - layer_name: str, - inode: interfaces.objects.ObjectInterface, - stream: IO, - ) -> None: - """Extracts the inode's contents from the page cache and saves them to a stream - - Args: - context: The context on which to operate - layer_name: The name of the layer on which to operate - inode: The inode to dump - stream: An IO stream to write to, typically FileHandlerInterface or BytesIO - """ - layer = context.layers[layer_name] - # By using truncate/seek, provided the filesystem supports it, and the - # stream is a File interface, a sparse file will be + # By using truncate/seek, provided the filesystem supports it, a sparse file will be # created, saving both disk space and I/O time. # Additionally, using the page index will guarantee that each page is written at the # appropriate file position. - inode_size = inode.i_size - stream.truncate(inode_size) + try: + with open_method(filename) as f: + inode_size = inode.i_size + f.truncate(inode_size) - for page_idx, page_content in inode.get_contents(): - current_fp = page_idx * layer.page_size - max_length = inode_size - current_fp - page_bytes = page_content[:max_length] - if current_fp + len(page_bytes) > inode_size: - vollog.error( - "Page out of file bounds: inode 0x%x, inode size %d, page index %d", - inode.vol.offset, - inode_size, - page_idx, - ) - stream.seek(current_fp) - stream.write(page_bytes) + for page_idx, page_content in inode.get_contents(): + current_fp = page_idx * vmlinux_layer.page_size + max_length = inode_size - current_fp + page_bytes = page_content[:max_length] + if current_fp + len(page_bytes) > inode_size: + vollog.error( + "Page out of file bounds: inode 0x%x, inode size %d, page index %d", + inode.vol.offset, + inode_size, + page_idx, + ) + f.seek(current_fp) + f.write(page_bytes) + + except OSError as e: + vollog.error("Unable to write to file (%s): %s", filename, e) def _generator(self): vmlinux_module_name = self.config["kernel"] @@ -561,7 +528,7 @@ class InodePages(plugins.PluginInterface): filename = open_method.sanitize_filename(f"inode_0x{inode_address:x}.dmp") vollog.info("[*] Writing inode at 0x%x to '%s'", inode_address, filename) self.write_inode_content_to_file( - self.context, vmlinux_layer.name, inode, filename, open_method + inode, filename, open_method, vmlinux_layer ) def run(self): From bf76aad1e2367e2db4d561d9cc1cd76a42162420 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 20 Jan 2025 10:28:46 +1100 Subject: [PATCH 0424/1352] linux: page_cache.Files plugin: Ensure the inode's i_link pointer is readable --- volatility3/framework/plugins/linux/pagecache.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 39ed60486..f265241b6 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -147,7 +147,13 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): Otherwise, it returns the same symlink_path """ # i_link (fast symlinks) were introduced in 4.2 - if inode and inode.is_link and inode.has_member("i_link") and inode.i_link: + if ( + inode + and inode.is_link + and inode.has_member("i_link") + and inode.i_link + and inode.i_link.is_readable() + ): i_link_str = inode.i_link.dereference().cast( "string", max_length=255, encoding="utf-8", errors="replace" ) From ec7a101eb92499741cafeb4dea1ab1ef1683a27c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 20 Jan 2025 11:05:09 +1100 Subject: [PATCH 0425/1352] linux: page_cache.InodePages plugin: Remove unnecesary casting --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index f265241b6..32b176b72 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -511,7 +511,7 @@ class InodePages(plugins.PluginInterface): page_vaddr = page_obj.vol.offset page_paddr = page_obj.to_paddr() page_mapping_addr = page_obj.mapping - page_index = int(page_obj.index) + page_index = page_obj.index page_file_offset = page_index * vmlinux_layer.page_size dump_safe = ( page_file_offset < inode_size From dfe3d255c064b9c78edf4f5f58eff6c15cc56486 Mon Sep 17 00:00:00 2001 From: Odysseas Stavrou Date: Mon, 20 Jan 2025 22:25:01 +0200 Subject: [PATCH 0426/1352] Volshell: Update Process retrieval methods with virtual/physical offsets --- volatility3/cli/volshell/linux.py | 58 +++++++++++++++++++++++++++++ volatility3/cli/volshell/windows.py | 47 +++++++++++++++++++++++ 2 files changed, 105 insertions(+) diff --git a/volatility3/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py index cc58fa1c2..9ea3ea1f5 100644 --- a/volatility3/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -3,6 +3,7 @@ # from typing import Any, List, Optional, Tuple, Union +from enum import Enum from volatility3.cli.volshell import generic from volatility3.framework import constants, interfaces @@ -10,6 +11,16 @@ from volatility3.framework.configuration import requirements from volatility3.plugins.linux import pslist +# Could import the enum from psscan.py to avoid code duplication +class DescExitStateEnum(Enum): + """Enum for linux task exit_state as defined in include/linux/sched.h""" + + TASK_RUNNING = 0x00000000 + EXIT_DEAD = 0x00000010 + EXIT_ZOMBIE = 0x00000020 + EXIT_TRACE = EXIT_ZOMBIE | EXIT_DEAD + + class Volshell(generic.Volshell): """Shell environment to directly interact with a linux memory image.""" @@ -40,6 +51,52 @@ class Volshell(generic.Volshell): return None print(f"No task with task ID {pid} found") + def get_process(self, pid=None, offset=None): + """Get Task based on a process ID. Does not retrieve the layer, to change layer use the .pid attribute. The offset argument can be used both for physical or virtual offsets""" + + if pid is not None and offset is not None: + print("Only one parameter is accepted") + return None + + if offset is not None: + vmlinux_module_name = self.config["kernel"] + vmlinux = self.context.modules[vmlinux_module_name] + + kernel_layer_name = vmlinux.layer_name + kernel_layer = self.context.layers[kernel_layer_name] + + memory_layer_name = kernel_layer.dependencies[0] + + ptask = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "task_struct", + layer_name=memory_layer_name, + offset=offset, + native_layer_name=kernel_layer_name, + ) + + try: + DescExitStateEnum(ptask.exit_state) + except ValueError: + print( + f"task_struct @ {hex(ptask.vol.offset)} as exit_state {ptask.exit_state} is likely not valid" + ) + + if not (0 < ptask.pid < 65535): + print( + f"task_struct @ {hex(ptask.vol.offset)} as pid {ptask.pid} is likely not valid" + ) + + return ptask + + if pid is not None: + tasks = self.list_tasks() + for task in tasks: + if task.pid == pid: + return task + print(f"No task with task ID {pid} found") + + return None + def list_tasks(self): """Returns a list of task objects from the primary layer""" # We always use the main kernel memory and associated symbols @@ -50,6 +107,7 @@ class Volshell(generic.Volshell): result += [ (["ct", "change_task", "cp"], self.change_task), (["lt", "list_tasks", "ps"], self.list_tasks), + (["gp", "get_process"], self.get_process), (["symbols"], self.context.symbol_space[self.current_symbol_table]), ] if self.config.get("pid", None) is not None: diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index 303d4d5c3..a77392561 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -44,11 +44,58 @@ class Volshell(generic.Volshell): ) ) + def get_process(self, pid=None, v_offset=None, p_offset=None): + """Returns the EPROCESS object that matches the pid. If v_offset/p_offset is provided, construct the EPROCESS object at the provided address. Only one parameter is allowed.""" + + if sum(1 if x is not None else 0 for x in [pid, v_offset, p_offset]) != 1: + print("Only one parameter is accepted") + return None + + kernel_name = self.config["kernel"] + kernel = self.context.modules[kernel_name] + + kernel_layer_name = kernel.layer_name + + kernel_layer = self.context.layers[kernel_layer_name] + memory_layer_name = kernel_layer.dependencies[0] + + eprocess_symbol = kernel.symbol_table_name + constants.BANG + "_EPROCESS" + + if v_offset is not None: + eproc = self.context.object( + eprocess_symbol, + layer_name=kernel_layer_name, + offset=v_offset, + ) + + return eproc + + if p_offset is not None: + eproc = self.context.object( + eprocess_symbol, + layer_name=memory_layer_name, + offset=p_offset, + native_layer_name=kernel_layer_name, + ) + + return eproc + + if pid is not None: + processes = self.list_processes() + for process in processes: + if process.UniqueProcessId == pid: + return process + print(f"No process with process ID {pid} found") + return None + + return None + def construct_locals(self) -> List[Tuple[List[str], Any]]: result = super().construct_locals() result += [ (["cp", "change_process"], self.change_process), (["lp", "list_processes", "ps"], self.list_processes), + (["gp", "get_process"], self.get_process), (["symbols"], self.context.symbol_space[self.current_symbol_table]), ] if self.config.get("pid", None) is not None: From b8e8fb6e92e403bfad4e52675e2737b9eb7ba49c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 21 Jan 2025 18:37:04 +0100 Subject: [PATCH 0427/1352] initial split linux modules utilities --- .../symbols/linux/utilities/modules.py | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 volatility3/framework/symbols/linux/utilities/modules.py diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py new file mode 100644 index 000000000..bb8519643 --- /dev/null +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -0,0 +1,41 @@ +from volatility3 import framework +from volatility3.framework import interfaces +from volatility3.framework.symbols.linux import extensions, LinuxUtilities +from typing import Iterable, Optional + + +class Modules(interfaces.configuration.VersionableInterface): + """Kernel modules related utilities.""" + + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + framework.require_interface_version(*_required_framework_version) + + @classmethod + def module_lookup_by_address( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + modules: Iterable[extensions.module], + target_address: int, + ) -> Optional[extensions.module]: + """ + Determine if a target address lies in a module memory space. + Returns the module where the provided address lies. + + Args: + context: The context on which to operate + layer_name: The name of the layer on which to operate + modules: An iterable containing the modules to match the address against + target_address: The address to check for a match + """ + + for module in modules: + _, start, end = LinuxUtilities.mask_mods_list( + context, layer_name, [module] + )[0] + if start <= target_address <= end: + return module + + return None From f007a28ee7e76ee85ec0641581d2acf506195121 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 21 Jan 2025 18:37:55 +0100 Subject: [PATCH 0428/1352] initial linux.tracing.ftrace.Check_ftrace --- .../framework/plugins/linux/tracing/ftrace.py | 285 ++++++++++++++++++ 1 file changed, 285 insertions(+) create mode 100644 volatility3/framework/plugins/linux/tracing/ftrace.py diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py new file mode 100644 index 000000000..ba52a93ce --- /dev/null +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -0,0 +1,285 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +# Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf + +import logging +from typing import List, Iterable, Tuple, Set +from enum import auto, IntFlag +from volatility3.plugins.linux import hidden_modules, modxview +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.symbols.linux.utilities import modules as modules_utilities +from volatility3.framework.constants import architectures + +vollog = logging.getLogger(__name__) + + +# https://docs.python.org/3.13/library/enum.html#enum.IntFlag +class FTRACE_OPS_FLAGS(IntFlag): + """Denote the state of an ftrace_ops struct. + Based on https://elixir.bootlin.com/linux/v6.13-rc3/source/include/linux/ftrace.h#L255. + """ + + FTRACE_OPS_FL_ENABLED = auto() + FTRACE_OPS_FL_DYNAMIC = auto() + FTRACE_OPS_FL_SAVE_REGS = auto() + FTRACE_OPS_FL_SAVE_REGS_IF_SUPPORTED = auto() + FTRACE_OPS_FL_RECURSION = auto() + FTRACE_OPS_FL_STUB = auto() + FTRACE_OPS_FL_INITIALIZED = auto() + FTRACE_OPS_FL_DELETED = auto() + FTRACE_OPS_FL_ADDING = auto() + FTRACE_OPS_FL_REMOVING = auto() + FTRACE_OPS_FL_MODIFYING = auto() + FTRACE_OPS_FL_ALLOC_TRAMP = auto() + FTRACE_OPS_FL_IPMODIFY = auto() + FTRACE_OPS_FL_PID = auto() + FTRACE_OPS_FL_RCU = auto() + FTRACE_OPS_FL_TRACE_ARRAY = auto() + FTRACE_OPS_FL_PERMANENT = auto() + FTRACE_OPS_FL_DIRECT = auto() + FTRACE_OPS_FL_SUBOP = auto() + + +class Check_ftrace(interfaces.plugins.PluginInterface): + """Detect ftrace hooking""" + + _version = (1, 0, 0) + _required_framework_version = (2, 17, 0) + additional_description = """Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged + to hook kernel functions and modify their behaviour.""" + _hidden_modules_run = False + """Flag to determine if the hidden_modules plugin was run, + in the context of this plugin.""" + + @staticmethod + def get_requirements() -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.VersionRequirement( + name="modules_utilities", + component=modules_utilities.Modules, + version=(1, 0, 0), + ), + requirements.PluginRequirement( + name="modxview", plugin=modxview.Modxview, version=(1, 0, 0) + ), + requirements.PluginRequirement( + name="hidden_modules", + plugin=hidden_modules.Hidden_modules, + version=(1, 0, 0), + ), + requirements.BooleanRequirement( + name="show_ftrace_flags", + description="Show ftrace flags associated with an ftrace_ops struct", + optional=True, + default=False, + ), + ] + + @classmethod + def _set_hidden_modules_run(cls) -> None: + """Use a self-contained setter, to prevent running hidden_modules multiple times.""" + cls._hidden_modules_run = True + + @staticmethod + def extract_hash_table_filters( + ftrace_ops: interfaces.objects.ObjectInterface, + ) -> Iterable[interfaces.objects.ObjectInterface]: + """Wrap the process of walking to every ftrace_func_entry of an ftrace_ops. + Those are stored in a hash table of filters that indicates the addresses hooked. + + Args: + ftrace_ops: The ftrace_ops struct to walk through + + Returns: + An iterable of ftrace_func_entry structs + """ + + try: + current_bucket_ptr = ftrace_ops.func_hash.filter_hash.buckets.first + except exceptions.InvalidAddressException: + vollog.log( + constants.LOGLEVEL_VV, + f"ftrace_func_entry list of ftrace_ops@{ftrace_ops.vol.offset:#x} is empty/invalid. Skipping it...", + ) + return [] + + while current_bucket_ptr.is_readable(): + yield current_bucket_ptr.dereference().cast("ftrace_func_entry") + current_bucket_ptr = current_bucket_ptr.next + + @classmethod + def parse_ftrace_ops( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + known_modules: Set[extensions.module], + ftrace_ops: interfaces.objects.ObjectInterface, + parse_flags: bool = False, + ) -> Tuple: + """Parse an ftrace_ops struct to highlight ftrace kernel hooking. + Iterates over embedded ftrace_func_entry entries, which point to hooked memory areas. + + Args: + known_modules: A set of known modules to iterate over, used to locate callbacks origin + ftrace_ops: The ftrace_ops struct to parse + parse_flags: Whether to parse ftrace_ops flags or not + + Yields: + A tuple containing a selection of useful fields (callback, hook, module) related to an ftrace_func_entry struct + """ + kernel = context.modules[kernel_name] + callback = ftrace_ops.func + + # Try to lookup within the known modules if the callback address fits + module = modules_utilities.Modules.module_lookup_by_address( + context, kernel.layer_name, known_modules, callback + ) + # Run hidden_modules plugin if a callback origin couldn't be determined (only done once, results are re-used afterwards) + if module is None and not cls._hidden_modules_run: + vollog.info( + f"A callback module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", + ) + known_modules_addresses = set( + context.layers[kernel.layer_name].canonicalize(module.vol.offset) + for module in known_modules + ) + modules_memory_boundaries = ( + hidden_modules.Hidden_modules.get_modules_memory_boundaries( + context, kernel_name + ) + ) + known_modules.update( + hidden_modules.Hidden_modules.get_hidden_modules( + context, + kernel_name, + known_modules_addresses, + modules_memory_boundaries, + ) + ) + cls._set_hidden_modules_run() + # Lookup the updated list to see if hidden_modules was able + # to find the missing module + module = modules_utilities.Modules.module_lookup_by_address( + context, kernel.layer_name, known_modules, callback + ) + + # Fetch more information about the module + if module: + module_address = format_hints.Hex(module.vol.offset) + module_name = module.get_name() or NotAvailableValue() + callback_symbol = ( + module.get_symbol_by_address(callback) or NotAvailableValue() + ) + else: + vollog.warning( + f"Could not determine ftrace_ops@{ftrace_ops.vol.offset:#x} callback {callback:#x} module origin.", + ) + module_address = NotAvailableValue() + module_name = NotAvailableValue() + callback_symbol = NotAvailableValue() + + # Iterate over ftrace_func_entry list + for ftrace_func_entry in cls.extract_hash_table_filters(ftrace_ops): + hook_address = ftrace_func_entry.ip.cast("pointer") + + # Determine the symbols associated with a hook + hooked_symbols = kernel.get_symbols_by_absolute_location(hook_address) + hooked_symbols = ",".join( + [s.split(constants.BANG)[-1] for s in hooked_symbols] + ) + parsed_entry = ( + format_hints.Hex(ftrace_ops.vol.offset), + callback_symbol, + format_hints.Hex(callback), + hooked_symbols or NotAvailableValue(), + module_name, + module_address, + ) + + if parse_flags: + # e.g. FTRACE_OPS_FL_ENABLED,FTRACE_OPS_FL_DYNAMIC + parsed_entry += ( + FTRACE_OPS_FLAGS(ftrace_ops.flags).name.replace("|", ","), + ) + + return parsed_entry + + @staticmethod + def iterate_ftrace_ops_list( + context: interfaces.context.ContextInterface, kernel_name: str + ) -> Iterable[interfaces.objects.ObjectInterface]: + """Iterate over (ftrace_ops *)ftrace_ops_list. + + Returns: + An iterable of ftrace_ops structs + """ + kernel = context.modules[kernel_name] + current_frace_ops_ptr = kernel.object_from_symbol("ftrace_ops_list") + ftrace_list_end = kernel.object_from_symbol("ftrace_list_end") + + while current_frace_ops_ptr.is_readable(): + # ftrace_list_end is not considered a valid struct + # see kernel function test_rec_ops_needs_regs + if current_frace_ops_ptr != ftrace_list_end.vol.offset: + yield current_frace_ops_ptr.dereference() + current_frace_ops_ptr = current_frace_ops_ptr.next + else: + break + + def _generator(self): + kernel_name = self.config["kernel"] + kernel = self.context.modules[kernel_name] + + if not kernel.has_symbol("ftrace_ops_list"): + raise exceptions.SymbolError( + "ftrace_ops_list", + kernel.symbol_table_name, + 'The provided symbol table does not include the "ftrace_ops_list" symbol. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupted.', + ) + + # Do not run hidden_modules by default, but only on failure to find a module + known_modules = set( + modxview.Modxview.flatten_run_modules_results( + modxview.Modxview.run_modules_scanners( + self.context, kernel_name, run_hidden_modules=False + ) + ) + ) + for ftrace_ops in self.iterate_ftrace_ops_list(self.context, kernel_name): + ftrace_ops_parsed = self.parse_ftrace_ops( + self.context, + kernel_name, + known_modules, + ftrace_ops, + self.config.get("show_ftrace_flags"), + ) + if ftrace_ops_parsed is not None: + yield (0, (ftrace_ops_parsed)) + + def run(self): + columns = [ + ("ftrace_ops address", format_hints.Hex), + ("Callback", str), + ("Callback address", format_hints.Hex), + ("Hooked symbols", str), + ("Module", str), + ("Module address", format_hints.Hex), + ] + + if self.config.get("show_ftrace_flags"): + columns.append(("Flags", str)) + + return TreeGrid( + columns, + self._generator(), + ) From 414cab128b06281fb845cb990f698885c0adce18 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 21 Jan 2025 18:38:24 +0100 Subject: [PATCH 0429/1352] 2.18.0 -> 2.19.0 bump --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 832b2a5ba..f2403cf4a 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 18 # Number of changes that only add to the interface +VERSION_MINOR = 19 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From d5a21340449c1dc63853e05e57aa0b9b06c1e234 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 21 Jan 2025 18:39:02 +0100 Subject: [PATCH 0430/1352] modules utilities __init__.py --- volatility3/framework/plugins/linux/tracing/__init__.py | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 volatility3/framework/plugins/linux/tracing/__init__.py diff --git a/volatility3/framework/plugins/linux/tracing/__init__.py b/volatility3/framework/plugins/linux/tracing/__init__.py new file mode 100644 index 000000000..e69de29bb From 37b792b09c440591abcdfa19d8b49dc32f5b5695 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 21 Jan 2025 18:57:42 +0100 Subject: [PATCH 0431/1352] ruff fix --- volatility3/framework/plugins/linux/tracing/ftrace.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index ba52a93ce..01268aa8a 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -53,7 +53,7 @@ class Check_ftrace(interfaces.plugins.PluginInterface): additional_description = """Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged to hook kernel functions and modify their behaviour.""" _hidden_modules_run = False - """Flag to determine if the hidden_modules plugin was run, + """Flag to determine if the hidden_modules plugin was run, in the context of this plugin.""" @staticmethod @@ -147,7 +147,7 @@ class Check_ftrace(interfaces.plugins.PluginInterface): # Run hidden_modules plugin if a callback origin couldn't be determined (only done once, results are re-used afterwards) if module is None and not cls._hidden_modules_run: vollog.info( - f"A callback module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", + "A callback module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", ) known_modules_addresses = set( context.layers[kernel.layer_name].canonicalize(module.vol.offset) From 614ac507be14a0500cd9b41d9315c47b218a6aae Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 21 Jan 2025 19:23:38 +0100 Subject: [PATCH 0432/1352] explicit returns and extra Optional type hinting --- .../framework/plugins/linux/tracing/ftrace.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 01268aa8a..a198647d9 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -5,7 +5,7 @@ # Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf import logging -from typing import List, Iterable, Tuple, Set +from typing import List, Iterable, Optional, Tuple, Set from enum import auto, IntFlag from volatility3.plugins.linux import hidden_modules, modxview from volatility3.framework import constants, exceptions, interfaces @@ -93,7 +93,7 @@ class Check_ftrace(interfaces.plugins.PluginInterface): @staticmethod def extract_hash_table_filters( ftrace_ops: interfaces.objects.ObjectInterface, - ) -> Iterable[interfaces.objects.ObjectInterface]: + ) -> Optional[Iterable[interfaces.objects.ObjectInterface]]: """Wrap the process of walking to every ftrace_func_entry of an ftrace_ops. Those are stored in a hash table of filters that indicates the addresses hooked. @@ -117,6 +117,8 @@ class Check_ftrace(interfaces.plugins.PluginInterface): yield current_bucket_ptr.dereference().cast("ftrace_func_entry") current_bucket_ptr = current_bucket_ptr.next + return None + @classmethod def parse_ftrace_ops( cls, @@ -125,7 +127,7 @@ class Check_ftrace(interfaces.plugins.PluginInterface): known_modules: Set[extensions.module], ftrace_ops: interfaces.objects.ObjectInterface, parse_flags: bool = False, - ) -> Tuple: + ) -> Optional[Tuple]: """Parse an ftrace_ops struct to highlight ftrace kernel hooking. Iterates over embedded ftrace_func_entry entries, which point to hooked memory areas. @@ -214,10 +216,12 @@ class Check_ftrace(interfaces.plugins.PluginInterface): return parsed_entry + return None + @staticmethod def iterate_ftrace_ops_list( context: interfaces.context.ContextInterface, kernel_name: str - ) -> Iterable[interfaces.objects.ObjectInterface]: + ) -> Optional[Iterable[interfaces.objects.ObjectInterface]]: """Iterate over (ftrace_ops *)ftrace_ops_list. Returns: From d297693876b057d7a56ba81ec851b0b0fe9627d0 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 21 Jan 2025 23:31:17 +0100 Subject: [PATCH 0433/1352] correct required framework version --- volatility3/framework/plugins/linux/tracing/ftrace.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index a198647d9..a04491550 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -49,7 +49,7 @@ class Check_ftrace(interfaces.plugins.PluginInterface): """Detect ftrace hooking""" _version = (1, 0, 0) - _required_framework_version = (2, 17, 0) + _required_framework_version = (2, 19, 0) additional_description = """Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged to hook kernel functions and modify their behaviour.""" _hidden_modules_run = False From 3ba60d55f7d0c6b62fdbc9b4381b9bd96006a171 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 22 Jan 2025 00:52:41 +0100 Subject: [PATCH 0434/1352] remove self-contained hidden_modules check, switch to dataclass --- .../framework/plugins/linux/tracing/ftrace.py | 131 ++++++++++-------- 1 file changed, 76 insertions(+), 55 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index a04491550..009d48ce8 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -5,8 +5,10 @@ # Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf import logging -from typing import List, Iterable, Optional, Tuple, Set +from typing import Dict, List, Iterable, Optional from enum import auto, IntFlag +from dataclasses import dataclass + from volatility3.plugins.linux import hidden_modules, modxview from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements @@ -19,7 +21,7 @@ vollog = logging.getLogger(__name__) # https://docs.python.org/3.13/library/enum.html#enum.IntFlag -class FTRACE_OPS_FLAGS(IntFlag): +class FtraceOpsFlags(IntFlag): """Denote the state of an ftrace_ops struct. Based on https://elixir.bootlin.com/linux/v6.13-rc3/source/include/linux/ftrace.h#L255. """ @@ -45,16 +47,27 @@ class FTRACE_OPS_FLAGS(IntFlag): FTRACE_OPS_FL_SUBOP = auto() -class Check_ftrace(interfaces.plugins.PluginInterface): +@dataclass +class ParsedFtraceOps: + """Parsed ftrace_ops struct representation, containing a selection of forensics valuable + informations.""" + + ftrace_ops_offset: int + callback_symbol: str + callback_address: int + hooked_symbols: str + module_name: str + module_address: int + flags: str + + +class CheckFtrace(interfaces.plugins.PluginInterface): """Detect ftrace hooking""" _version = (1, 0, 0) _required_framework_version = (2, 19, 0) additional_description = """Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged to hook kernel functions and modify their behaviour.""" - _hidden_modules_run = False - """Flag to determine if the hidden_modules plugin was run, - in the context of this plugin.""" @staticmethod def get_requirements() -> List[interfaces.configuration.RequirementInterface]: @@ -85,11 +98,6 @@ class Check_ftrace(interfaces.plugins.PluginInterface): ), ] - @classmethod - def _set_hidden_modules_run(cls) -> None: - """Use a self-contained setter, to prevent running hidden_modules multiple times.""" - cls._hidden_modules_run = True - @staticmethod def extract_hash_table_filters( ftrace_ops: interfaces.objects.ObjectInterface, @@ -124,43 +132,54 @@ class Check_ftrace(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, kernel_name: str, - known_modules: Set[extensions.module], + known_modules: Dict[str, List[extensions.module]], ftrace_ops: interfaces.objects.ObjectInterface, - parse_flags: bool = False, - ) -> Optional[Tuple]: + run_hidden_modules: bool = True, + ) -> Optional[Iterable[ParsedFtraceOps]]: """Parse an ftrace_ops struct to highlight ftrace kernel hooking. Iterates over embedded ftrace_func_entry entries, which point to hooked memory areas. Args: - known_modules: A set of known modules to iterate over, used to locate callbacks origin + known_modules: A dict of known modules, used to locate callbacks origin. Typically obtained through modxview.run_modules_scanners(). ftrace_ops: The ftrace_ops struct to parse - parse_flags: Whether to parse ftrace_ops flags or not + run_hidden_modules: Whether to run the hidden_modules plugin or not. Note: it won't be run, even if specified, \ +if the "hidden_modules" key is present in known_modules. Yields: - A tuple containing a selection of useful fields (callback, hook, module) related to an ftrace_func_entry struct + An iterable of ParsedFtraceOps dataclasses, containing a selection of useful fields (callback, hook, module) related to an ftrace_ops struct """ kernel = context.modules[kernel_name] callback = ftrace_ops.func + callback_symbol = module_address = module_name = None # Try to lookup within the known modules if the callback address fits module = modules_utilities.Modules.module_lookup_by_address( - context, kernel.layer_name, known_modules, callback + context, + kernel.layer_name, + modxview.Modxview.flatten_run_modules_results(known_modules), + callback, ) # Run hidden_modules plugin if a callback origin couldn't be determined (only done once, results are re-used afterwards) - if module is None and not cls._hidden_modules_run: + if ( + module is None + and run_hidden_modules + and "hidden_modules" not in known_modules + ): vollog.info( "A callback module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", ) known_modules_addresses = set( context.layers[kernel.layer_name].canonicalize(module.vol.offset) - for module in known_modules + for module in modxview.Modxview.flatten_run_modules_results( + known_modules + ) ) modules_memory_boundaries = ( hidden_modules.Hidden_modules.get_modules_memory_boundaries( context, kernel_name ) ) - known_modules.update( + known_modules["hidden_modules"] = list( hidden_modules.Hidden_modules.get_hidden_modules( context, kernel_name, @@ -168,27 +187,24 @@ class Check_ftrace(interfaces.plugins.PluginInterface): modules_memory_boundaries, ) ) - cls._set_hidden_modules_run() # Lookup the updated list to see if hidden_modules was able # to find the missing module module = modules_utilities.Modules.module_lookup_by_address( - context, kernel.layer_name, known_modules, callback + context, + kernel.layer_name, + modxview.Modxview.flatten_run_modules_results(known_modules), + callback, ) # Fetch more information about the module - if module: - module_address = format_hints.Hex(module.vol.offset) - module_name = module.get_name() or NotAvailableValue() - callback_symbol = ( - module.get_symbol_by_address(callback) or NotAvailableValue() - ) + if module is not None: + module_address = module.vol.offset + module_name = module.get_name() + callback_symbol = module.get_symbol_by_address(callback) else: vollog.warning( f"Could not determine ftrace_ops@{ftrace_ops.vol.offset:#x} callback {callback:#x} module origin.", ) - module_address = NotAvailableValue() - module_name = NotAvailableValue() - callback_symbol = NotAvailableValue() # Iterate over ftrace_func_entry list for ftrace_func_entry in cls.extract_hash_table_filters(ftrace_ops): @@ -199,23 +215,20 @@ class Check_ftrace(interfaces.plugins.PluginInterface): hooked_symbols = ",".join( [s.split(constants.BANG)[-1] for s in hooked_symbols] ) - parsed_entry = ( - format_hints.Hex(ftrace_ops.vol.offset), + yield ParsedFtraceOps( + ftrace_ops.vol.offset, callback_symbol, - format_hints.Hex(callback), - hooked_symbols or NotAvailableValue(), + callback, + hooked_symbols, module_name, module_address, + # FtraceOpsFlags(ftrace_ops.flags).name is valid in > Python3.10, but + # returns None <= Python 3.10. We need to manipulate it like so to ensure compatibility: + # FtraceOpsFlags.FTRACE_OPS_FL_IPMODIFY|FTRACE_OPS_FL_ALLOC_TRAMP + # -> FTRACE_OPS_FL_IPMODIFY,FTRACE_OPS_FL_ALLOC_TRAMP + str(FtraceOpsFlags(ftrace_ops.flags)).split(".")[-1].replace("|", ","), ) - if parse_flags: - # e.g. FTRACE_OPS_FL_ENABLED,FTRACE_OPS_FL_DYNAMIC - parsed_entry += ( - FTRACE_OPS_FLAGS(ftrace_ops.flags).name.replace("|", ","), - ) - - return parsed_entry - return None @staticmethod @@ -252,23 +265,31 @@ class Check_ftrace(interfaces.plugins.PluginInterface): ) # Do not run hidden_modules by default, but only on failure to find a module - known_modules = set( - modxview.Modxview.flatten_run_modules_results( - modxview.Modxview.run_modules_scanners( - self.context, kernel_name, run_hidden_modules=False - ) - ) + known_modules = modxview.Modxview.run_modules_scanners( + self.context, kernel_name, run_hidden_modules=False ) for ftrace_ops in self.iterate_ftrace_ops_list(self.context, kernel_name): - ftrace_ops_parsed = self.parse_ftrace_ops( + for ftrace_ops_parsed in self.parse_ftrace_ops( self.context, kernel_name, known_modules, ftrace_ops, - self.config.get("show_ftrace_flags"), - ) - if ftrace_ops_parsed is not None: - yield (0, (ftrace_ops_parsed)) + ): + formatted_results = ( + format_hints.Hex(ftrace_ops_parsed.ftrace_ops_offset), + ftrace_ops_parsed.callback_symbol or NotAvailableValue(), + format_hints.Hex(ftrace_ops_parsed.callback_address), + ftrace_ops_parsed.hooked_symbols or NotAvailableValue(), + ftrace_ops_parsed.module_name or NotAvailableValue(), + ( + format_hints.Hex(ftrace_ops_parsed.module_address) + if ftrace_ops_parsed.module_address is not None + else NotAvailableValue() + ), + ) + if self.config["show_ftrace_flags"]: + formatted_results += (ftrace_ops_parsed.flags,) + yield (0, formatted_results) def run(self): columns = [ From b59f051353cd58b7d6e4bfda2f07746820f4f32a Mon Sep 17 00:00:00 2001 From: Odysseas Stavrou Date: Wed, 22 Jan 2025 02:39:35 +0200 Subject: [PATCH 0435/1352] Volshell: Updates to the get_process() methods --- volatility3/cli/volshell/linux.py | 55 +++++++++++++++++++---------- volatility3/cli/volshell/windows.py | 23 ++++++++---- 2 files changed, 53 insertions(+), 25 deletions(-) diff --git a/volatility3/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py index 9ea3ea1f5..b3689c3ae 100644 --- a/volatility3/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -51,42 +51,61 @@ class Volshell(generic.Volshell): return None print(f"No task with task ID {pid} found") - def get_process(self, pid=None, offset=None): - """Get Task based on a process ID. Does not retrieve the layer, to change layer use the .pid attribute. The offset argument can be used both for physical or virtual offsets""" + def get_process(self, pid=None, virtaddr=None, physaddr=None): + """Return the task_struct object that matches the pid. If a physical or a virtual address is provided, construct the task_struct object at said address. Only one parameter is allowed. - if pid is not None and offset is not None: + Args: + pid (int, optional): PID to search for + virtaddr (int, optional): Virtual address to construct object at + physaddr (int, optional): Physical address to construct object at + + Returns: + ObjectInterface: task_struct Object + """ + + if sum(1 if x is not None else 0 for x in [pid, virtaddr, physaddr]) != 1: print("Only one parameter is accepted") return None - if offset is not None: - vmlinux_module_name = self.config["kernel"] - vmlinux = self.context.modules[vmlinux_module_name] + vmlinux_module_name = self.config["kernel"] + vmlinux = self.context.modules[vmlinux_module_name] - kernel_layer_name = vmlinux.layer_name - kernel_layer = self.context.layers[kernel_layer_name] + kernel_layer_name = vmlinux.layer_name + kernel_layer = self.context.layers[kernel_layer_name] - memory_layer_name = kernel_layer.dependencies[0] + memory_layer_name = kernel_layer.dependencies[0] - ptask = self.context.object( - vmlinux.symbol_table_name + constants.BANG + "task_struct", + task_struct_symbol = vmlinux.symbol_table_name + constants.BANG + "task_struct" + + if virtaddr is not None: + task = self.context.object( + task_struct_symbol, + layer_name=kernel_layer_name, + offset=virtaddr, + ) + + if physaddr is not None: + task = self.context.object( + task_struct_symbol, layer_name=memory_layer_name, - offset=offset, + offset=physaddr, native_layer_name=kernel_layer_name, ) + if physaddr is not None or virtaddr is not None: try: - DescExitStateEnum(ptask.exit_state) + DescExitStateEnum(task.exit_state) except ValueError: print( - f"task_struct @ {hex(ptask.vol.offset)} as exit_state {ptask.exit_state} is likely not valid" + f"task_struct @ {hex(task.vol.offset)} as exit_state {task.exit_state} is likely not valid" ) - if not (0 < ptask.pid < 65535): + if not (0 < task.pid < 65535): print( - f"task_struct @ {hex(ptask.vol.offset)} as pid {ptask.pid} is likely not valid" + f"task_struct @ {hex(task.vol.offset)} as pid {task.pid} is likely not valid" ) - return ptask + return task if pid is not None: tasks = self.list_tasks() @@ -107,7 +126,7 @@ class Volshell(generic.Volshell): result += [ (["ct", "change_task", "cp"], self.change_task), (["lt", "list_tasks", "ps"], self.list_tasks), - (["gp", "get_process"], self.get_process), + (["gp", "get_process", "get_task"], self.get_process), (["symbols"], self.context.symbol_space[self.current_symbol_table]), ] if self.config.get("pid", None) is not None: diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index a77392561..9b89a8b81 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -44,10 +44,19 @@ class Volshell(generic.Volshell): ) ) - def get_process(self, pid=None, v_offset=None, p_offset=None): - """Returns the EPROCESS object that matches the pid. If v_offset/p_offset is provided, construct the EPROCESS object at the provided address. Only one parameter is allowed.""" + def get_process(self, pid=None, virtaddr=None, physaddr=None): + """Returns the _EPROCESS object that matches the pid. If a physical or a virtual address is provided, construct the _EPROCESS object at said address. Only one parameter is allowed. - if sum(1 if x is not None else 0 for x in [pid, v_offset, p_offset]) != 1: + Args: + pid (int, optional): PID / UniqueProcessId to search for. + virtaddr (int, optional): Virtual address to construct object at + physaddr (int, optional): Physical address to construct object at + + Returns: + ObjectInterface: _EPROCESS Object + """ + + if sum(1 if x is not None else 0 for x in [pid, virtaddr, physaddr]) != 1: print("Only one parameter is accepted") return None @@ -61,20 +70,20 @@ class Volshell(generic.Volshell): eprocess_symbol = kernel.symbol_table_name + constants.BANG + "_EPROCESS" - if v_offset is not None: + if virtaddr is not None: eproc = self.context.object( eprocess_symbol, layer_name=kernel_layer_name, - offset=v_offset, + offset=virtaddr, ) return eproc - if p_offset is not None: + if physaddr is not None: eproc = self.context.object( eprocess_symbol, layer_name=memory_layer_name, - offset=p_offset, + offset=physaddr, native_layer_name=kernel_layer_name, ) From c10572905f3f3760594db07575534a5805a10fe3 Mon Sep 17 00:00:00 2001 From: Daniel Davidov <35842733+Danking555@users.noreply.github.com> Date: Wed, 22 Jan 2025 10:45:52 +0200 Subject: [PATCH 0436/1352] Add low stub offset kernel detection reference: Memprocfs and https://www.youtube.com/watch?v=_ShCSth6dWM --- volatility3/framework/automagic/pdbscan.py | 36 ++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 729c48063..1ccecf97a 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -11,6 +11,7 @@ import contextlib import logging import math import os +import struct from typing import Any, Callable, Dict, Iterable, List, Optional, Set, Tuple, Union from volatility3.framework import constants, exceptions, interfaces, layers @@ -376,8 +377,43 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): valid_kernel = (virtual_layer_name, address, res[0]) return valid_kernel + def method_low_stub_offset(self, + context: interfaces.context.ContextInterface, + vlayer: layers.intel.Intel, + progress_callback: constants.ProgressCallback = None, + ) -> Optional[ValidKernelType]: + kernel_hint = 0 + kernel_base = 0 + physical_layer = context.layers.get('memory_layer') + + # try locating kernel base via x64 Low Stub in lower 1MB starting from second page (4KB) + # if "Discard Low Memory" setting is disabled in BIOS, the Low Stub may be at the third/fourth or further pages + for offset in range(0x1000,0x100000, 0x1000): + if 0xffffffffffff00ff & int.from_bytes(physical_layer.read(offset, 0x8), "little") != 0x00000001000600E9: + continue # not _PROCESSOR_START_BLOCK->Jmp + potential_kernel_hint = int.from_bytes(physical_layer.read(offset + 0x70, 0x8), "little") + if (0xfffff80000000003 & potential_kernel_hint) != 0xfffff80000000000: + continue # not _PROCESSOR_START_BLOCK->LmTarget + kernel_hint = potential_kernel_hint & 0xffffffffffff + kernel_base = kernel_hint & (~0x1fffff) & 0xffffffffffff + break + + if kernel_base: + # Scanning 32mb in 2mb chunks for the 'ntoskrnl' base address + while (kernel_base + 0x2000000) > kernel_hint: + for i in range(0, 0x200000, 0x1000): + valid_kernel = self.check_kernel_offset( + context, vlayer, kernel_base, progress_callback + ) + if valid_kernel: + return valid_kernel + kernel_base -= 0x200000 + + return None + # List of methods to be run, in order, to determine the valid kernels methods = [ + method_low_stub_offset, method_kdbg_offset, method_module_offset, method_fixed_mapping, From e7b51bd1a71b9af453605b53182f6b8c9b719d08 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 22 Jan 2025 16:51:06 +0100 Subject: [PATCH 0437/1352] prefer staticmethod when cls is not needed --- volatility3/framework/symbols/linux/utilities/modules.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index bb8519643..4be460a68 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -12,9 +12,8 @@ class Modules(interfaces.configuration.VersionableInterface): framework.require_interface_version(*_required_framework_version) - @classmethod + @staticmethod def module_lookup_by_address( - cls, context: interfaces.context.ContextInterface, layer_name: str, modules: Iterable[extensions.module], From 34a7dfc72fb3dced313e9a52b73b96dff31b778a Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 23 Jan 2025 10:42:52 +0100 Subject: [PATCH 0438/1352] split linux modules utilities --- .../symbols/linux/utilities/modules.py | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 volatility3/framework/symbols/linux/utilities/modules.py diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py new file mode 100644 index 000000000..ac9b2afaf --- /dev/null +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -0,0 +1,68 @@ +from typing import Iterator, List, Tuple + +from volatility3 import framework +from volatility3.framework import constants, interfaces +from volatility3.framework.objects import utility + + +class Modules(interfaces.configuration.VersionableInterface): + """Kernel modules related utilities.""" + + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + framework.require_interface_version(*_required_framework_version) + + @staticmethod + def mask_mods_list( + context: interfaces.context.ContextInterface, + layer_name: str, + mods: Iterator[interfaces.objects.ObjectInterface], + ) -> List[Tuple[str, int, int]]: + """ + A helper function to mask the starting and end address of kernel modules + """ + mask = context.layers[layer_name].address_mask + + return [ + ( + utility.array_to_string(mod.name), + mod.get_module_base() & mask, + (mod.get_module_base() & mask) + mod.get_core_size(), + ) + for mod in mods + ] + + @staticmethod + def lookup_module_address( + context: interfaces.context.ContextInterface, + kernel_module_name: str, + handlers: List[Tuple[str, int, int]], + target_address: int, + ) -> Tuple[str, str]: + """ + Searches between the start and end address of the kernel module using target_address. + Returns the module and symbol name of the address provided. + """ + kernel_module = context.modules[kernel_module_name] + mod_name = "UNKNOWN" + symbol_name = "N/A" + + for name, start, end in handlers: + if start <= target_address <= end: + mod_name = name + if name == constants.linux.KERNEL_NAME: + symbols = list( + kernel_module.get_symbols_by_absolute_location(target_address) + ) + + if len(symbols): + symbol_name = ( + symbols[0].split(constants.BANG)[1] + if constants.BANG in symbols[0] + else symbols[0] + ) + + break + + return mod_name, symbol_name From 43ab0b0c314832742c00f7821cd6f3327529894e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 23 Jan 2025 10:43:14 +0100 Subject: [PATCH 0439/1352] add deprecation decorator --- .../framework/configuration/requirements.py | 23 +++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 3e3608000..3af5601dc 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -11,6 +11,7 @@ expect to be in the context (such as particular layers or symboltables). import abc import logging import os +import functools from typing import Any, ClassVar, Dict, List, Optional, Set, Tuple, Type from urllib import parse, request @@ -723,3 +724,25 @@ class ModuleRequirement( """Builds the appropriate configuration for the specified requirement.""" return context.modules[value].build_configuration() + + +def deprecated_method(replacement: str, additional_information: str = ""): + """A decorator for marking functions as deprecated. + + Args: + replacement: The replacement function overriding the deprecated API (full path preferred, starting from "volatility3."). String was preferred, for convenience and to prevent import conflicts on caller side. + additional_information: Information appended at the end of the deprecation message + """ + + def decorator(deprecated_func): + @functools.wraps(deprecated_func) + def wrapper(*args, **kwargs): + nonlocal replacement, additional_information + deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__name__}\" is deprecated, use \"{replacement}\" instead. {additional_information}" + vollog.warning(deprecation_msg) + # Return the wrapped function with its original arguments + return deprecated_func(*args, **kwargs) + + return wrapper + + return decorator From 7575aa5d6354419b51d1ac563c1de4db62da0ca1 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 23 Jan 2025 10:44:20 +0100 Subject: [PATCH 0440/1352] deprecate lookup_module_address and mask_mods_list --- .../framework/symbols/linux/__init__.py | 101 ++++++++---------- 1 file changed, 44 insertions(+), 57 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 423284b03..3dc744f78 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -8,11 +8,13 @@ import logging from abc import ABC, abstractmethod from typing import Iterator, List, Tuple, Optional, Union +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3 import framework from volatility3.framework import constants, exceptions, interfaces, objects from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux import extensions +from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) @@ -81,7 +83,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" - _version = (2, 2, 0) + _version = (2, 2, 1) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) @@ -338,27 +340,6 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): yield fd_num, filp, full_path - @classmethod - def mask_mods_list( - cls, - context: interfaces.context.ContextInterface, - layer_name: str, - mods: Iterator[interfaces.objects.ObjectInterface], - ) -> List[Tuple[str, int, int]]: - """ - A helper function to mask the starting and end address of kernel modules - """ - mask = context.layers[layer_name].address_mask - - return [ - ( - utility.array_to_string(mod.name), - mod.get_module_base() & mask, - (mod.get_module_base() & mask) + mod.get_core_size(), - ) - for mod in mods - ] - @classmethod def generate_kernel_handler_info( cls, @@ -382,41 +363,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return [ (constants.linux.KERNEL_NAME, start_addr, end_addr) - ] + LinuxUtilities.mask_mods_list(context, kernel.layer_name, mods_list) - - @classmethod - def lookup_module_address( - cls, - kernel_module: interfaces.context.ModuleInterface, - handlers: List[Tuple[str, int, int]], - target_address: int, - ): - """ - Searches between the start and end address of the kernel module using target_address. - Returns the module and symbol name of the address provided. - """ - - mod_name = "UNKNOWN" - symbol_name = "N/A" - - for name, start, end in handlers: - if start <= target_address <= end: - mod_name = name - if name == constants.linux.KERNEL_NAME: - symbols = list( - kernel_module.get_symbols_by_absolute_location(target_address) - ) - - if len(symbols): - symbol_name = ( - symbols[0].split(constants.BANG)[1] - if constants.BANG in symbols[0] - else symbols[0] - ) - - break - - return mod_name, symbol_name + ] + linux_utilities_modules.Modules.mask_mods_list( + context, kernel.layer_name, mods_list + ) @classmethod def walk_internal_list(cls, vmlinux, struct_name, list_member, list_start): @@ -504,6 +453,44 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): [chr((code >> (i * 8)) & 0xFF) for i in range(code_bytes_length)] ) + ## Deprecated APIs ## + @classmethod + @requirements.deprecated_method( + replacement="volatility3.framework.symbols.linux.utilities.modules.Modules.mask_mods_list" + ) + def mask_mods_list( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + mods: Iterator[interfaces.objects.ObjectInterface], + ) -> List[Tuple[str, int, int]]: + """ + DEPRECATED: use "volatility3.framework.symbols.linux.utilities.modules.Modules.mask_mods_list" instead. + + A helper function to mask the starting and end address of kernel modules + """ + return linux_utilities_modules.Modules.mask_mods_list(context, layer_name, mods) + + @classmethod + @requirements.deprecated_method( + replacement="volatility3.framework.symbols.linux.utilities.modules.Modules.lookup_module_address" + ) + def lookup_module_address( + cls, + kernel_module: interfaces.context.ModuleInterface, + handlers: List[Tuple[str, int, int]], + target_address: int, + ) -> Tuple[str, str]: + """ + DEPRECATED: use "volatility3.framework.symbols.linux.utilities.modules.Modules.lookup_module_address" instead. + + Searches between the start and end address of the kernel module using target_address. + Returns the module and symbol name of the address provided. + """ + return linux_utilities_modules.Modules.lookup_module_address( + kernel_module.context, kernel_module.name, handlers, target_address + ) + class IDStorage(ABC): """Abstraction to support both XArray and RadixTree""" From fd77c041537b40f38db7428ce05a876ad5b1e08b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 23 Jan 2025 10:46:42 +0100 Subject: [PATCH 0441/1352] move to linux_utilities_modules APIs --- volatility3/framework/plugins/linux/check_idt.py | 7 +++++-- .../framework/plugins/linux/keyboard_notifiers.py | 7 +++++-- volatility3/framework/plugins/linux/kthreads.py | 9 ++++++--- volatility3/framework/plugins/linux/netfilter.py | 7 +++++-- volatility3/framework/plugins/linux/tty_check.py | 7 +++++-- 5 files changed, 26 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index 07582e2c1..5859e73d6 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -5,6 +5,7 @@ import logging from typing import List +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.framework import interfaces, renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints @@ -99,8 +100,10 @@ class Check_idt(interfaces.plugins.PluginInterface): idt_addr = idt_addr & address_mask - module_name, symbol_name = linux.LinuxUtilities.lookup_module_address( - vmlinux, handlers, idt_addr + module_name, symbol_name = ( + linux_utilities_modules.Modules.lookup_module_address( + self.context, vmlinux.name, handlers, idt_addr + ) ) yield ( diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index 72273a77b..c1b7572c6 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -4,6 +4,7 @@ import logging +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints @@ -66,8 +67,10 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): ): call_addr = call_back.notifier_call - module_name, symbol_name = linux.LinuxUtilities.lookup_module_address( - vmlinux, handlers, call_addr + module_name, symbol_name = ( + linux_utilities_modules.Modules.lookup_module_address( + self.context, vmlinux.name, handlers, call_addr + ) ) yield (0, [format_hints.Hex(call_addr), module_name, symbol_name]) diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index 40e992069..2e1bbed47 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -4,6 +4,7 @@ import logging from typing import List +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins @@ -20,7 +21,7 @@ class Kthreads(plugins.PluginInterface): """Enumerates kthread functions""" _required_framework_version = (2, 11, 0) - _version = (1, 0, 2) + _version = (1, 0, 3) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -88,8 +89,10 @@ class Kthreads(plugins.PluginInterface): if kthread.has_member("full_name") else task_name ) - module_name, symbol_name = linux.LinuxUtilities.lookup_module_address( - vmlinux, handlers, threadfn + module_name, symbol_name = ( + linux_utilities_modules.Modules.lookup_module_address( + self.context, vmlinux.name, handlers, threadfn + ) ) fields = [ diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index 73496dfd9..ccb831b61 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -5,6 +5,7 @@ from dataclasses import dataclass, field from abc import ABC, abstractmethod import logging +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from typing import Iterator, List, Tuple from volatility3 import framework from volatility3.framework import ( @@ -263,8 +264,10 @@ class AbstractNetfilter(ABC): """Helper to obtain the module and symbol name in the format needed for the output of this plugin. """ - module_name, symbol_name = linux.LinuxUtilities.lookup_module_address( - self.vmlinux, self.handlers, addr + module_name, symbol_name = ( + linux_utilities_modules.Modules.lookup_module_address( + self._context, self.vmlinux.name, self.handlers, addr + ) ) if module_name == "UNKNOWN": diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index 45238ef8c..f375968a4 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -5,6 +5,7 @@ import logging from typing import List +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.framework import interfaces, renderers, exceptions, constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins @@ -79,8 +80,10 @@ class tty_check(plugins.PluginInterface): recv_buf = tty_dev.ldisc.ops.receive_buf - module_name, symbol_name = linux.LinuxUtilities.lookup_module_address( - vmlinux, handlers, recv_buf + module_name, symbol_name = ( + linux_utilities_modules.Modules.lookup_module_address( + self.context, vmlinux.name, handlers, recv_buf + ) ) yield (0, (name, format_hints.Hex(recv_buf), module_name, symbol_name)) From b8d9c7b88311016cea97b8b60afeec4d47558af0 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 23 Jan 2025 11:57:43 -0600 Subject: [PATCH 0442/1352] #1473 - add missing exception handling for get_key --- volatility3/framework/plugins/windows/envars.py | 12 ++++++------ .../framework/plugins/windows/getservicesids.py | 5 +++-- .../framework/plugins/windows/getsids.py | 2 +- .../plugins/windows/registry/userassist.py | 17 ++++++++++++----- .../framework/plugins/windows/svcscan.py | 6 +++--- 5 files changed, 25 insertions(+), 17 deletions(-) diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index cac4ecf40..48e1ef671 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -76,14 +76,14 @@ class Envars(interfaces.plugins.PluginInterface): "CurrentControlSet\\Control\\Session Manager\\Environment" ) sys = True - except KeyError: - with contextlib.suppress(KeyError): + except (KeyError, registry.RegistryFormatException): + with contextlib.suppress(KeyError, registry.RegistryFormatException): key = hive.get_key( "ControlSet001\\Control\\Session Manager\\Environment" ) sys = True if sys: - with contextlib.suppress(KeyError): + with contextlib.suppress(KeyError, registry.RegistryFormatException): for node in key.get_values(): try: value_node_name = node.get_name() @@ -100,11 +100,11 @@ class Envars(interfaces.plugins.PluginInterface): continue ## The user-specific variables - with contextlib.suppress(KeyError): + with contextlib.suppress(KeyError, registry.RegistryFormatException): key = hive.get_key("Environment") ntuser = True if ntuser: - with contextlib.suppress(KeyError): + with contextlib.suppress(KeyError, registry.RegistryFormatException): for node in key.get_values(): try: value_node_name = node.get_name() @@ -123,7 +123,7 @@ class Envars(interfaces.plugins.PluginInterface): ## The volatile user variables try: key = hive.get_key("Volatile Environment") - except KeyError: + except (KeyError, registry.RegistryFormatException): continue try: for node in key.get_values(): diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index eece7fb6c..b97d2bb46 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -10,6 +10,7 @@ from typing import List from volatility3.framework import renderers, interfaces, constants, exceptions from volatility3.framework.configuration import requirements +from volatility3.framework.layers import registry from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -86,10 +87,10 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): # Get ControlSet\Services. try: services = hive.get_key(r"CurrentControlSet\Services") - except (KeyError, exceptions.InvalidAddressException): + except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException): try: services = hive.get_key(r"ControlSet001\Services") - except (KeyError, exceptions.InvalidAddressException): + except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException): continue if services: diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index df0c7a835..00c78e1cf 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -158,7 +158,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): layers.registry.RegistryFormatException, ): continue - except (KeyError, exceptions.InvalidAddressException): + except (KeyError, exceptions.InvalidAddressException, layers.registry.RegistryFormatException): continue return sids diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 932ee9d6f..646fb1d7f 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -13,7 +13,7 @@ from typing import Any, Generator, List, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.layers.physical import BufferDataLayer -from volatility3.framework.layers.registry import RegistryHive +from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed from volatility3.plugins.windows.registry import hivelist @@ -167,10 +167,17 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac self._determine_userassist_type() - userassist_node_path = hive.get_key( - "software\\microsoft\\windows\\currentversion\\explorer\\userassist", - return_list=True, - ) + try: + userassist_node_path = hive.get_key( + "software\\microsoft\\windows\\currentversion\\explorer\\userassist", + return_list=True, + ) + except RegistryFormatException as e: + vollog.warning(f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}") + return None + except KeyError: + vollog.warning(f"UserAssist key not found in {hive_name} at {hive.hive_offset:#x}") + return None if not userassist_node_path: vollog.warning("list_userassist did not find a valid node_path (or None)") diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index bd477ba27..93087f352 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -15,7 +15,7 @@ from volatility3.framework import ( symbols, ) from volatility3.framework.configuration import requirements -from volatility3.framework.layers import scanners +from volatility3.framework.layers import scanners, registry from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import versions @@ -159,12 +159,12 @@ class SvcScan(interfaces.plugins.PluginInterface): return cast( objects.StructType, hive.get_key(r"CurrentControlSet\Services") ) - except (KeyError, exceptions.InvalidAddressException): + except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException): try: return cast( objects.StructType, hive.get_key(r"ControlSet001\Services") ) - except (KeyError, exceptions.InvalidAddressException): + except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException): vollog.log( constants.LOGLEVEL_VVVV, "Could not retrieve any control set from SYSTEM hive", From 6c4cafa64f68e6b001cd1ed32e8e5fb3d9993f30 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 23 Jan 2025 11:59:37 -0600 Subject: [PATCH 0443/1352] #1473 - black fixes --- .../framework/plugins/windows/getservicesids.py | 12 ++++++++++-- volatility3/framework/plugins/windows/getsids.py | 6 +++++- .../framework/plugins/windows/registry/userassist.py | 8 ++++++-- volatility3/framework/plugins/windows/svcscan.py | 12 ++++++++++-- 4 files changed, 31 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index b97d2bb46..207d0e2ad 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -87,10 +87,18 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): # Get ControlSet\Services. try: services = hive.get_key(r"CurrentControlSet\Services") - except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException): + except ( + KeyError, + exceptions.InvalidAddressException, + registry.RegistryFormatException, + ): try: services = hive.get_key(r"ControlSet001\Services") - except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException): + except ( + KeyError, + exceptions.InvalidAddressException, + registry.RegistryFormatException, + ): continue if services: diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 00c78e1cf..a75bbe7ea 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -158,7 +158,11 @@ class GetSIDs(interfaces.plugins.PluginInterface): layers.registry.RegistryFormatException, ): continue - except (KeyError, exceptions.InvalidAddressException, layers.registry.RegistryFormatException): + except ( + KeyError, + exceptions.InvalidAddressException, + layers.registry.RegistryFormatException, + ): continue return sids diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 646fb1d7f..d50b5216e 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -173,10 +173,14 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac return_list=True, ) except RegistryFormatException as e: - vollog.warning(f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}") + vollog.warning( + f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}" + ) return None except KeyError: - vollog.warning(f"UserAssist key not found in {hive_name} at {hive.hive_offset:#x}") + vollog.warning( + f"UserAssist key not found in {hive_name} at {hive.hive_offset:#x}" + ) return None if not userassist_node_path: diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 93087f352..17baac5b0 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -159,12 +159,20 @@ class SvcScan(interfaces.plugins.PluginInterface): return cast( objects.StructType, hive.get_key(r"CurrentControlSet\Services") ) - except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException): + except ( + KeyError, + exceptions.InvalidAddressException, + registry.RegistryFormatException, + ): try: return cast( objects.StructType, hive.get_key(r"ControlSet001\Services") ) - except (KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException): + except ( + KeyError, + exceptions.InvalidAddressException, + registry.RegistryFormatException, + ): vollog.log( constants.LOGLEVEL_VVVV, "Could not retrieve any control set from SYSTEM hive", From 81ba89eef663727608886e66595dfd7b3dcd9831 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 23 Jan 2025 12:20:14 -0600 Subject: [PATCH 0444/1352] #1473 - update exception message --- volatility3/framework/plugins/windows/registry/userassist.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index d50b5216e..87016553a 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -174,7 +174,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac ) except RegistryFormatException as e: vollog.warning( - f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}" + f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}: {e}" ) return None except KeyError: From a68be50798254cbadc490393721e74180b4117cc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 23 Jan 2025 20:30:21 +0000 Subject: [PATCH 0445/1352] Revert "Typing fix" This reverts commit c82d432b10258136ff0777dfec1fbf5844316132. --- volatility3/framework/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index a1925faef..754939460 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -5,6 +5,7 @@ # Check the python version to ensure it's suitable import glob import sys +from volatility3.framework import check_python_version as check_python_version import zipfile import importlib import inspect @@ -57,7 +58,7 @@ class NonInheritable: self.default_value = value self.cls = cls - def __get__(self, obj: Any, get_type: Optional[Type] = None) -> Any: + def __get__(self, obj: Any, get_type: Type = Optional[None]) -> Any: if type is self.cls: if hasattr(self.default_value, "__get__"): return self.default_value.__get__(obj, get_type) From 61f60ac464ba01885216704faf37ed6b6fc4beb6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 23 Jan 2025 20:52:08 +0000 Subject: [PATCH 0446/1352] Core: Move the python check somewhere it can't accidentally be removed --- volatility3/framework/__init__.py | 12 +++++++++++- volatility3/framework/check_python_version.py | 14 -------------- volatility3/framework/constants/__init__.py | 2 ++ 3 files changed, 13 insertions(+), 15 deletions(-) delete mode 100644 volatility3/framework/check_python_version.py diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 754939460..466e697bb 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -5,7 +5,6 @@ # Check the python version to ensure it's suitable import glob import sys -from volatility3.framework import check_python_version as check_python_version import zipfile import importlib import inspect @@ -16,6 +15,17 @@ from typing import Any, Dict, Generator, List, Optional, Tuple, Type, TypeVar from volatility3.framework import constants, interfaces +if ( + sys.version_info.major != constants.REQUIRED_PYTHON_VERSION[0] + or sys.version_info.minor < constants.REQUIRED_PYTHON_VERSION[1] + or ( + sys.version_info.minor == constants.REQUIRED_PYTHON_VERSION[1] + and sys.version_info.micro < constants.REQUIRED_PYTHON_VERSION[2] + ) +): + raise RuntimeError( + f"Volatility framework requires python version {".".join(str(x) for x in constants.REQUIRED_PYTHON_VERSION)} or greater" + ) # ## # diff --git a/volatility3/framework/check_python_version.py b/volatility3/framework/check_python_version.py deleted file mode 100644 index f2d284f2a..000000000 --- a/volatility3/framework/check_python_version.py +++ /dev/null @@ -1,14 +0,0 @@ -import sys - -required_python_version = (3, 8, 0) -if ( - sys.version_info.major != required_python_version[0] - or sys.version_info.minor < required_python_version[1] - or ( - sys.version_info.minor == required_python_version[1] - and sys.version_info.micro < required_python_version[2] - ) -): - raise RuntimeError( - f"Volatility framework requires python version {required_python_version[0]}.{required_python_version[1]}.{required_python_version[2]} or greater" - ) diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 23cc2dde5..2e6ae0261 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -23,6 +23,8 @@ from volatility3.framework.constants._version import ( VERSION_SUFFIX as VERSION_SUFFIX, ) +REQUIRED_PYTHON_VERSION = (3, 8, 0) + PLUGINS_PATH = [ os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "plugins")), os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "plugins")), From 128e1be154cc5a9853da3413565685689bf702e5 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 23 Jan 2025 20:57:44 +0000 Subject: [PATCH 0447/1352] Core: Fix f-string quotes --- volatility3/framework/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 466e697bb..0bbdefa43 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -24,7 +24,7 @@ if ( ) ): raise RuntimeError( - f"Volatility framework requires python version {".".join(str(x) for x in constants.REQUIRED_PYTHON_VERSION)} or greater" + f"Volatility framework requires python version {'.'.join(str(x) for x in constants.REQUIRED_PYTHON_VERSION)} or greater" ) # ## From bd83369c67428e9962379012414509efb3febb8c Mon Sep 17 00:00:00 2001 From: hsarkey Date: Wed, 9 Oct 2024 15:31:53 -0400 Subject: [PATCH 0448/1352] Updates to make the windows.dlllist plugin report dlls from wow64 processes. --- .../symbols/windows/extensions/__init__.py | 144 +- .../framework/symbols/windows/wow64.json | 1585 +++++++++++++++++ 2 files changed, 1709 insertions(+), 20 deletions(-) create mode 100644 volatility3/framework/symbols/windows/wow64.json diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 214002f49..2b73fa625 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -24,6 +24,7 @@ from volatility3.framework.objects import utility from volatility3.framework.renderers import conversion from volatility3.framework.symbols import generic from volatility3.framework.symbols.windows.extensions import pool +from volatility3.framework.symbols import windows vollog = logging.getLogger(__name__) @@ -484,9 +485,9 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): ].is_valid(self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: - name: Union[str, interfaces.renderers.BaseAbsentValue] = ( - renderers.UnreadableValue() - ) + name: Union[ + str, interfaces.renderers.BaseAbsentValue + ] = renderers.UnreadableValue() # this pointer needs to be checked against native_layer_name because the object may # be instantiated from a primary (virtual) layer or a memory (physical) layer. @@ -775,15 +776,93 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) return peb + def get_peb32(self) -> interfaces.objects.ObjectInterface: + """Constructs a PEB32 object""" + if constants.BANG not in self.vol.type_name: + raise ValueError( + f"Invalid symbol table name syntax (no {constants.BANG} found)" + ) + + # add_process_layer can raise InvalidAddressException. + # if that happens, we let the exception propagate upwards + proc_layer_name = self.add_process_layer() + proc_layer = self._context.layers[proc_layer_name] + + # Determine if process is running under WOW64. + if self.get_is_wow64(): + peb32 = self.get_wow_64_process() + else: + return None + # Confirm WoW64Process points to a valid process address + if not proc_layer.is_valid(peb32): + raise exceptions.InvalidAddressException( + proc_layer_name, peb32, f"Invalid Wow64Process address at {self.Peb:0x}" + ) + + # Leverage the context of existing symbol table to help configure + # a new symbol table for 32-bit types + sym_table = self.get_symbol_table_name() + config_path = self._context.symbol_space[sym_table].config_path + + # Load the 32-bit types into a new symbol space + # We use the WindowsKernelIntermedSymbols class to make + # sure we get all the object helpers. For example, traversing + # linked-lists. + self._32bit_table_name = windows.WindowsKernelIntermedSymbols.create( + self._context, config_path, "windows", "wow64" + ) + + # windows 10 + if self._context.symbol_space.has_type( + sym_table + constants.BANG + "_EWOW64PROCESS" + ): + peb32 = self._context.object( + f"{self._32bit_table_name}{constants.BANG}_PEB32", + layer_name=proc_layer_name, + offset=peb32.Peb, + ) + return peb32 + + # vista sp0-sp1 and 2003 sp1-sp2 + elif self._context.symbol_space.has_type( + sym_table + constants.BANG + "_WOW64_PROCESS" + ): + peb32 = self._context.object( + f"{self._32bit_table_name}{constants.BANG}_PEB32", + layer_name=proc_layer_name, + offset=peb32.Wow64, + ) + return peb32 + + else: + peb32 = self._context.object( + f"{self._32bit_table_name}{constants.BANG}_PEB32", + layer_name=proc_layer_name, + offset=peb32, + ) + return peb32 + def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were loaded.""" - try: - peb = self.get_peb() - yield from peb.Ldr.InLoadOrderModuleList.to_list( - f"{self.get_symbol_table_name()}{constants.BANG}_LDR_DATA_TABLE_ENTRY", - "InLoadOrderLinks", - ) + pebs = [ + [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], + [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + ] + for peb, table_name in pebs: + if peb != None: + sym_table = self.get_symbol_table_name() + if peb.Ldr.vol.type_name.endswith("unsigned long"): + Ldr_data = self._context.symbol_space.get_type( + self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" + ) + peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + sym_table = self._32bit_table_name + for entry in peb.Ldr.InLoadOrderModuleList.to_list( + f"{sym_table}{constants.BANG}" + table_name, + "InLoadOrderLinks", + ): + yield entry except exceptions.InvalidAddressException: return None @@ -791,23 +870,48 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): """Generator for DLLs in the order that they were initialized""" try: - peb = self.get_peb() - yield from peb.Ldr.InInitializationOrderModuleList.to_list( - f"{self.get_symbol_table_name()}{constants.BANG}_LDR_DATA_TABLE_ENTRY", - "InInitializationOrderLinks", - ) + pebs = [ + [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], + [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + ] + for peb, table_name in pebs: + if peb != None: + sym_table = self.get_symbol_table_name() + if peb.Ldr.vol.type_name.endswith("unsigned long"): + Ldr_data = self._context.symbol_space.get_type( + self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" + ) + peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + sym_table = self._32bit_table_name + for entry in peb.Ldr.InInitializationOrderModuleList.to_list( + f"{sym_table}{constants.BANG}" + table_name, + "InInitializationOrderLinks", + ): + yield entry except exceptions.InvalidAddressException: return None def mem_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they appear in memory""" - try: - peb = self.get_peb() - yield from peb.Ldr.InMemoryOrderModuleList.to_list( - f"{self.get_symbol_table_name()}{constants.BANG}_LDR_DATA_TABLE_ENTRY", - "InMemoryOrderLinks", - ) + pebs = [ + [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], + [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + ] + for peb, table_name in pebs: + if peb != None: + sym_table = self.get_symbol_table_name() + if peb.Ldr.vol.type_name.endswith("unsigned long"): + Ldr_data = self._context.symbol_space.get_type( + self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" + ) + peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + sym_table = self._32bit_table_name + for entry in peb.Ldr.InMemoryOrderModuleList.to_list( + f"{sym_table}{constants.BANG}" + table_name, + "InMemoryOrderLinks", + ): + yield entry except exceptions.InvalidAddressException: return None diff --git a/volatility3/framework/symbols/windows/wow64.json b/volatility3/framework/symbols/windows/wow64.json new file mode 100644 index 000000000..e28d77241 --- /dev/null +++ b/volatility3/framework/symbols/windows/wow64.json @@ -0,0 +1,1585 @@ +{ + "symbols": {}, + "enums": { + "_LDR_DLL_LOAD_REASON": { + "base": "int", + "constants": { + "LoadReasonAsDataLoad": 6, + "LoadReasonAsImageLoad": 5, + "LoadReasonDelayloadDependency": 3, + "LoadReasonDynamicForwarderDependency": 2, + "LoadReasonDynamicLoad": 4, + "LoadReasonStaticDependency": 0, + "LoadReasonStaticForwarderDependency": 1, + "LoadReasonUnknown": -1, + }, + "size": 4, + }, + "_LDR_DDAG_STATE": { + "base": "int", + "constants": { + "LdrModulesCondensed": 6, + "LdrModulesInitError": -4, + "LdrModulesInitializing": 8, + "LdrModulesMapped": 2, + "LdrModulesMapping": 1, + "LdrModulesMerged": -5, + "LdrModulesPlaceHolder": 0, + "LdrModulesReadyToInit": 7, + "LdrModulesReadyToRun": 9, + "LdrModulesSnapError": -3, + "LdrModulesSnapped": 5, + "LdrModulesSnapping": 4, + "LdrModulesUnloaded": -2, + "LdrModulesUnloading": -1, + "LdrModulesWaitingForDependencies": 3, + }, + "size": 4, + }, + }, + "base_types": { + "unsigned long": { + "kind": "int", + "size": 4, + "signed": false, + "endian": "little", + }, + "int": {"endian": "little", "kind": "int", "signed": true, "size": 4}, + "unsigned long long": { + "kind": "int", + "size": 8, + "signed": false, + "endian": "little", + }, + "unsigned char": { + "kind": "char", + "size": 1, + "signed": false, + "endian": "little", + }, + "pointer": {"kind": "int", "size": 4, "signed": false, "endian": "little"}, + "unsigned int": {"kind": "int", "size": 4, "signed": false, "endian": "little"}, + "unsigned short": { + "kind": "int", + "size": 2, + "signed": false, + "endian": "little", + }, + "long": {"kind": "int", "size": 4, "signed": false, "endian": "little"}, + "long long": {"endian": "little", "kind": "int", "signed": true, "size": 8}, + "void": {"endian": "little", "kind": "void", "signed": true, "size": 0}, + }, + "metadata": { + "format": "4.1.0", + "producer": { + "datetime": "2024-05-30T17:02:06.755760", + "name": "awalters-by-hand", + "version": "0.0.2", + }, + }, + "user_types": { + "_LDR_SERVICE_TAG_RECORD": { + "fields": { + "Next": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_LDR_SERVICE_TAG_RECORD", + }, + }, + }, + "ServiceTag": { + "offset": 4, + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "kind": "struct", + "size": 8, + }, + "_KTIMER": { + "fields": { + "Dpc": { + "offset": 32, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_KDPC"}, + }, + }, + "DueTime": { + "offset": 16, + "type": {"kind": "union", "name": "_ULARGE_INTEGER"}, + }, + "Header": { + "offset": 0, + "type": {"kind": "struct", "name": "_DISPATCHER_HEADER"}, + }, + "Period": { + "offset": 36, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "TimerListEntry": { + "offset": 24, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + }, + "kind": "struct", + "size": 40, + }, + "_ERESOURCE": { + "fields": { + "ActiveCount": { + "offset": 12, + "type": {"kind": "base", "name": "short"}, + }, + "ActiveEntries": { + "offset": 32, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "Address": { + "offset": 48, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "ContentionCount": { + "offset": 36, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "CreatorBackTraceIndex": { + "offset": 48, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ExclusiveWaiters": { + "offset": 20, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_KEVENT"}, + }, + }, + "Flag": { + "offset": 14, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "NumberOfExclusiveWaiters": { + "offset": 44, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "NumberOfSharedWaiters": { + "offset": 40, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "OwnerEntry": { + "offset": 24, + "type": {"kind": "struct", "name": "_OWNER_ENTRY"}, + }, + "OwnerTable": { + "offset": 8, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_OWNER_ENTRY"}, + }, + }, + "ReservedLowFlags": { + "offset": 14, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "SharedWaiters": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_KSEMAPHORE"}, + }, + }, + "SpinLock": { + "offset": 52, + "type": {"kind": "base", "name": "unsigned long long"}, + }, + "SystemResourcesList": { + "offset": 0, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + "WaiterPriority": { + "offset": 15, + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "kind": "struct", + "size": 56, + }, + "_LARGE_INTEGER": { + "fields": { + "HighPart": {"offset": 4, "type": {"kind": "base", "name": "long"}}, + "LowPart": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "QuadPart": { + "offset": 0, + "type": {"kind": "base", "name": "long long"}, + }, + "u": { + "offset": 0, + "type": {"kind": "struct", "name": "__unnamed_1083"}, + }, + }, + "kind": "union", + "size": 8, + }, + "_ETHREAD": { + "fields": { + "Cid": { + "offset": 868, + "type": {"kind": "struct", "name": "_CLIENT_ID"}, + }, + "CreateTime": { + "offset": 824, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + "CrossThreadFlags": { + "offset": 952, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ExitTime": { + "offset": 832, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + "Tcb": {"offset": 0, "type": {"kind": "struct", "name": "_KTHREAD"}}, + }, + "kind": "struct", + "size": 1048, + }, + "_KTHREAD": { + "fields": { + "State": { + "offset": 144, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "WaitReason": { + "offset": 395, + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "kind": "struct", + "size": 824, + }, + "_EPROCESS": { + "fields": { + "CreateTime": { + "offset": 168, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + "ExitTime": { + "offset": 688, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + "ImageFileName": { + "offset": 1080, + "type": { + "count": 368, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned char"}, + }, + }, + "ObjectTable": { + "offset": 336, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_HANDLE_TABLE"}, + }, + }, + "Pcb": {"offset": 0, "type": {"kind": "struct", "name": "_KPROCESS"}}, + "Peb": { + "offset": 320, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_PEB"}, + }, + }, + "Session": { + "offset": 324, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "ThreadListHead": { + "offset": 404, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + "UniqueProcessId": { + "offset": 180, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "VadRoot": { + "offset": 628, + "type": {"kind": "struct", "name": "_RTL_AVL_TREE"}, + }, + }, + "kind": "struct", + "size": 760, + }, + "_EX_FAST_REF": { + "fields": { + "Object": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "RefCnt": { + "offset": 0, + "type": { + "bit_length": 4, + "bit_position": 0, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "Value": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "kind": "struct", + "size": 4, + }, + "_TOKEN": { + "fields": { + "Privileges": { + "offset": 64, + "type": {"kind": "struct", "name": "_SEP_TOKEN_PRIVILEGES"}, + }, + "UserAndGroupCount": { + "offset": 124, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "UserAndGroups": { + "offset": 148, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_SID_AND_ATTRIBUTES"}, + }, + }, + }, + "kind": "struct", + "size": 656, + }, + "_OBJECT_HEADER": { + "fields": { + "Body": {"offset": 24, "type": {"kind": "struct", "name": "_QUAD"}}, + "InfoMask": { + "offset": 14, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "PointerCount": {"offset": 0, "type": {"kind": "base", "name": "long"}}, + "TypeIndex": { + "offset": 12, + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "kind": "struct", + "size": 32, + }, + "_FILE_OBJECT": { + "fields": { + "DeleteAccess": { + "offset": 40, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "DeviceObject": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_DEVICE_OBJECT"}, + }, + }, + "FileName": { + "offset": 48, + "type": {"kind": "struct", "name": "_UNICODE_STRING"}, + }, + "ReadAccess": { + "offset": 38, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "SharedDelete": { + "offset": 43, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "SharedRead": { + "offset": 41, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "SharedWrite": { + "offset": 42, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "WriteAccess": { + "offset": 39, + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "kind": "struct", + "size": 128, + }, + "_DEVICE_OBJECT": { + "fields": { + "AttachedDevice": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_DEVICE_OBJECT"}, + }, + }, + "Flags": { + "offset": 48, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "NextDevice": { + "offset": 12, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_DEVICE_OBJECT"}, + }, + }, + }, + "kind": "struct", + "size": 184, + }, + "_CM_KEY_BODY": { + "fields": { + "KeyControlBlock": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_CM_KEY_CONTROL_BLOCK"}, + }, + }, + "Type": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "kind": "struct", + "size": 44, + }, + "_CMHIVE": { + "fields": { + "FileFullPath": { + "offset": 1136, + "type": {"kind": "struct", "name": "_UNICODE_STRING"}, + }, + "FileUserName": { + "offset": 1144, + "type": {"kind": "struct", "name": "_UNICODE_STRING"}, + }, + "Hive": {"offset": 0, "type": {"kind": "struct", "name": "_HHIVE"}}, + "HiveRootPath": { + "offset": 1160, + "type": {"kind": "struct", "name": "_UNICODE_STRING"}, + }, + }, + "kind": "struct", + "size": 3104, + }, + "_CM_KEY_NODE": { + "fields": { + "Name": { + "offset": 76, + "type": { + "count": 1, + "kind": "array", + "subtype": {"kind": "base", "name": "wchar"}, + }, + }, + "NameLength": { + "offset": 72, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "Parent": { + "offset": 16, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "SubKeyLists": { + "offset": 28, + "type": { + "count": 2, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned long"}, + }, + }, + "ValueList": { + "offset": 36, + "type": {"kind": "struct", "name": "_CHILD_LIST"}, + }, + }, + "kind": "struct", + "size": 80, + }, + "_CM_KEY_VALUE": { + "fields": { + "Data": { + "offset": 8, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "DataLength": { + "offset": 4, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "Flags": { + "offset": 16, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "Name": { + "offset": 20, + "type": { + "count": 1, + "kind": "array", + "subtype": {"kind": "base", "name": "wchar"}, + }, + }, + "NameLength": { + "offset": 2, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "Signature": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "Spare": { + "offset": 18, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "Type": { + "offset": 12, + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "kind": "struct", + "size": 24, + }, + "_HMAP_ENTRY": { + "fields": { + "BinAddress": { + "offset": 4, + "type": {"kind": "base", "name": "unsigned long long"}, + }, + "BlockAddress": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned long long"}, + }, + "MemAlloc": { + "offset": 8, + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "kind": "struct", + "size": 12, + }, + "_MMVAD_SHORT": { + "fields": { + "EndingVpn": { + "offset": 16, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "NextVad": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_MMVAD_SHORT"}, + }, + }, + "StartingVpn": { + "offset": 12, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "VadNode": { + "offset": 0, + "type": {"kind": "struct", "name": "_RTL_BALANCED_NODE"}, + }, + }, + "kind": "struct", + "size": 40, + }, + "_MMVAD": { + "fields": { + "Core": { + "offset": 0, + "type": {"kind": "struct", "name": "_MMVAD_SHORT"}, + }, + "Subsection": { + "offset": 44, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_SUBSECTION"}, + }, + }, + }, + "kind": "struct", + "size": 72, + }, + "_KSYSTEM_TIME": { + "fields": { + "High1Time": {"offset": 4, "type": {"kind": "base", "name": "long"}}, + "High2Time": {"offset": 8, "type": {"kind": "base", "name": "long"}}, + "LowPart": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "kind": "struct", + "size": 12, + }, + "_KMUTANT": { + "fields": { + "Header": { + "offset": 0, + "type": {"kind": "struct", "name": "_DISPATCHER_HEADER"}, + } + }, + "kind": "struct", + "size": 32, + }, + "_DRIVER_OBJECT": { + "fields": { + "DeviceObject": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_DEVICE_OBJECT"}, + }, + } + }, + "kind": "struct", + "size": 168, + }, + "_OBJECT_SYMBOLIC_LINK": { + "fields": { + "CreationTime": { + "offset": 0, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + } + }, + "kind": "struct", + "size": 24, + }, + "_CONTROL_AREA": { + "fields": { + "FilePointer": { + "offset": 32, + "type": {"kind": "struct", "name": "_EX_FAST_REF"}, + } + }, + "kind": "struct", + "size": 80, + }, + "_SHARED_CACHE_MAP": { + "fields": { + "FileSize": { + "offset": 8, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + "InitialVacbs": { + "offset": 48, + "type": { + "count": 4, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_VACB"}, + }, + }, + }, + "Section": { + "offset": 108, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "SectionSize": { + "offset": 24, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + "Vacbs": { + "offset": 64, + "type": { + "kind": "pointer", + "subtype": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_VACB"}, + }, + }, + }, + "ValidDataLength": { + "offset": 32, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + }, + "kind": "struct", + "size": 368, + }, + "_VACB": { + "fields": { + "ArrayHead": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_VACB_ARRAY_HEADER"}, + }, + }, + "BaseAddress": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "Overlay": { + "offset": 8, + "type": {"kind": "union", "name": "__unnamed_1971"}, + }, + "SharedCacheMap": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_SHARED_CACHE_MAP"}, + }, + }, + }, + "kind": "struct", + "size": 24, + }, + "_POOL_TRACKER_BIG_PAGES": { + "fields": { + "Key": {"offset": 4, "type": {"kind": "base", "name": "unsigned long"}}, + "NumberOfBytes": { + "offset": 12, + "type": {"kind": "base", "name": "unsigned long long"}, + }, + "PoolType": { + "offset": 8, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "Va": {"offset": 0, "type": {"kind": "base", "name": "unsigned long"}}, + }, + "kind": "struct", + "size": 16, + }, + "_IMAGE_DOS_HEADER": { + "fields": { + "e_cblp": { + "offset": 2, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_cp": { + "offset": 4, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_cparhdr": { + "offset": 8, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_crlc": { + "offset": 6, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_cs": { + "offset": 22, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_csum": { + "offset": 18, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_ip": { + "offset": 20, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_lfanew": {"offset": 60, "type": {"kind": "base", "name": "long"}}, + "e_lfarlc": { + "offset": 24, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_magic": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_maxalloc": { + "offset": 12, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_minalloc": { + "offset": 10, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_oemid": { + "offset": 36, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_oeminfo": { + "offset": 38, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_ovno": { + "offset": 26, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_res": { + "offset": 28, + "type": { + "count": 4, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned short"}, + }, + }, + "e_res2": { + "offset": 40, + "type": { + "count": 10, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned short"}, + }, + }, + "e_sp": { + "offset": 16, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "e_ss": { + "offset": 14, + "type": {"kind": "base", "name": "unsigned short"}, + }, + }, + "kind": "struct", + "size": 64, + }, + "_SINGLE_LIST_ENTRY": { + "fields": { + "Next": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_SINGLE_LIST_ENTRY"}, + }, + } + }, + "kind": "struct", + "size": 4, + }, + "_LDRP_CSLIST": { + "fields": { + "Tail": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_SINGLE_LIST_ENTRY"}, + }, + } + }, + "kind": "struct", + "size": 4, + }, + "_RTL_BALANCED_NODE": { + "fields": { + "Balance": { + "offset": 8, + "type": { + "bit_length": 2, + "bit_position": 0, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "Children": { + "offset": 0, + "type": { + "count": 2, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_RTL_BALANCED_NODE"}, + }, + }, + }, + "Left": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_RTL_BALANCED_NODE"}, + }, + }, + "ParentValue": { + "offset": 8, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "Red": { + "offset": 8, + "type": { + "bit_length": 1, + "bit_position": 0, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "Right": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_RTL_BALANCED_NODE"}, + }, + }, + }, + "kind": "struct", + "size": 12, + }, + "_LIST_ENTRY": { + "fields": { + "Blink": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + }, + "Flink": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + }, + }, + "kind": "struct", + "size": 8, + }, + "LIST_ENTRY32": { + "fields": { + "Blink": { + "offset": 4, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "Flink": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "kind": "struct", + "size": 8, + }, + "_PEB_LDR_DATA": { + "fields": { + "EntryInProgress": { + "offset": 36, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "InInitializationOrderModuleList": { + "offset": 28, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + "InLoadOrderModuleList": { + "offset": 12, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + "InMemoryOrderModuleList": { + "offset": 20, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + "Initialized": { + "offset": 4, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "Length": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ShutdownInProgress": { + "offset": 40, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "ShutdownThreadId": { + "offset": 44, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "SsHandle": { + "offset": 8, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + }, + "kind": "struct", + "size": 48, + }, + "_LDR_DATA_TABLE_ENTRY": { + "fields": { + "BaseDllName": { + "offset": 44, + "type": {"kind": "struct", "name": "_UNICODE_STRING"}, + }, + "FullDllName": { + "offset": 36, + "type": {"kind": "struct", "name": "_UNICODE_STRING"}, + }, + "LoadTime": { + "offset": 256, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + "DllBase": { + "offset": 24, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "void"}, + }, + }, + "SizeOfImage": { + "offset": 32, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "InInitializationOrderLinks": { + "offset": 16, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + "InLoadOrderLinks": { + "offset": 0, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + "InMemoryOrderLinks": { + "offset": 8, + "type": {"kind": "struct", "name": "_LIST_ENTRY"}, + }, + }, + "kind": "struct", + "size": 160, + }, + "_PEB32": { + "fields": { + "ActivationContextData": { + "offset": 504, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ActiveProcessAffinityMask": { + "offset": 192, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "AnsiCodePageData": { + "offset": 88, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ApiSetMap": { + "offset": 56, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "AppCompatFlags": { + "offset": 472, + "type": {"kind": "union", "name": "_ULARGE_INTEGER"}, + }, + "AppCompatFlagsUser": { + "offset": 480, + "type": {"kind": "union", "name": "_ULARGE_INTEGER"}, + }, + "AppCompatInfo": { + "offset": 492, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "AtlThunkSListPtr": { + "offset": 32, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "AtlThunkSListPtr32": { + "offset": 52, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "BeingDebugged": { + "offset": 2, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "BitField": { + "offset": 3, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "CSDVersion": { + "offset": 496, + "type": {"kind": "struct", "name": "_STRING32"}, + }, + "CritSecTracingEnabled": { + "offset": 576, + "type": { + "bit_length": 1, + "bit_position": 1, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "CriticalSectionTimeout": { + "offset": 112, + "type": {"kind": "union", "name": "_LARGE_INTEGER"}, + }, + "CrossProcessFlags": { + "offset": 40, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "CsrServerReadOnlySharedMemoryBase": { + "offset": 584, + "type": {"kind": "base", "name": "unsigned long long"}, + }, + "FastPebLock": { + "offset": 28, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "FlsBitmap": { + "offset": 536, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "FlsBitmapBits": { + "offset": 540, + "type": { + "count": 4, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned long"}, + }, + }, + "FlsCallback": { + "offset": 524, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "FlsHighIndex": { + "offset": 556, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "FlsListHead": { + "offset": 528, + "type": {"kind": "struct", "name": "LIST_ENTRY32"}, + }, + "GdiDCAttributeList": { + "offset": 156, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "GdiHandleBuffer": { + "offset": 196, + "type": { + "count": 34, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned long"}, + }, + }, + "GdiSharedHandleTable": { + "offset": 148, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "HeapDeCommitFreeBlockThreshold": { + "offset": 132, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "HeapDeCommitTotalFreeThreshold": { + "offset": 128, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "HeapSegmentCommit": { + "offset": 124, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "HeapSegmentReserve": { + "offset": 120, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "HeapTracingEnabled": { + "offset": 576, + "type": { + "bit_length": 1, + "bit_position": 0, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "IFEOKey": { + "offset": 36, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ImageBaseAddress": { + "offset": 8, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ImageSubsystem": { + "offset": 180, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ImageSubsystemMajorVersion": { + "offset": 184, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ImageSubsystemMinorVersion": { + "offset": 188, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ImageUsesLargePages": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 0, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "InheritedAddressSpace": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "IsAppContainer": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 5, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "IsImageDynamicallyRelocated": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 2, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "IsPackagedProcess": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 4, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "IsProtectedProcess": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 1, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "IsProtectedProcessLight": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 6, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "KernelCallbackTable": { + "offset": 44, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "Ldr": { + "offset": 12, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "LibLoaderTracingEnabled": { + "offset": 576, + "type": { + "bit_length": 1, + "bit_position": 2, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "LoaderLock": { + "offset": 160, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "MaximumNumberOfHeaps": { + "offset": 140, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "MinimumStackCommit": { + "offset": 520, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "Mutant": { + "offset": 4, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "NtGlobalFlag": { + "offset": 104, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "NumberOfHeaps": { + "offset": 136, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "NumberOfProcessors": { + "offset": 100, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "OSBuildNumber": { + "offset": 172, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "OSCSDVersion": { + "offset": 174, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "OSMajorVersion": { + "offset": 164, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "OSMinorVersion": { + "offset": 168, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "OSPlatformId": { + "offset": 176, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "OemCodePageData": { + "offset": 92, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "PostProcessInitRoutine": { + "offset": 332, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ProcessAssemblyStorageMap": { + "offset": 508, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ProcessHeap": { + "offset": 24, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ProcessHeaps": { + "offset": 144, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ProcessInJob": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 0, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "ProcessInitializing": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 1, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "ProcessParameters": { + "offset": 16, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ProcessStarterHelper": { + "offset": 152, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ProcessUsingFTH": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 4, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "ProcessUsingVCH": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 3, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "ProcessUsingVEH": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 2, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "ReadImageFileExecOptions": { + "offset": 1, + "type": {"kind": "base", "name": "unsigned char"}, + }, + "ReadOnlySharedMemoryBase": { + "offset": 76, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ReadOnlyStaticServerData": { + "offset": 84, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "ReservedBits0": { + "offset": 40, + "type": { + "bit_length": 27, + "bit_position": 5, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "SessionId": { + "offset": 468, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "SkipPatchingUser32Forwarders": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 3, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "SpareBits": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 7, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned char"}, + }, + }, + "SparePvoid0": { + "offset": 80, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "SpareTracingBits": { + "offset": 576, + "type": { + "bit_length": 29, + "bit_position": 3, + "kind": "bitfield", + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "SubSystemData": { + "offset": 20, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "SystemAssemblyStorageMap": { + "offset": 516, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "SystemDefaultActivationContextData": { + "offset": 512, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "SystemReserved": { + "offset": 48, + "type": { + "count": 1, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned long"}, + }, + }, + "TlsBitmap": { + "offset": 64, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "TlsBitmapBits": { + "offset": 68, + "type": { + "count": 2, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned long"}, + }, + }, + "TlsExpansionBitmap": { + "offset": 336, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "TlsExpansionBitmapBits": { + "offset": 340, + "type": { + "count": 32, + "kind": "array", + "subtype": {"kind": "base", "name": "unsigned long"}, + }, + }, + "TlsExpansionCounter": { + "offset": 60, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "TracingFlags": { + "offset": 576, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "UnicodeCaseTableData": { + "offset": 96, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "UserSharedInfoPtr": { + "offset": 44, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "WerRegistrationData": { + "offset": 560, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "WerShipAssertPtr": { + "offset": 564, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "pImageHeaderHash": { + "offset": 572, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "pShimData": { + "offset": 488, + "type": {"kind": "base", "name": "unsigned long"}, + }, + "pUnused": { + "offset": 568, + "type": {"kind": "base", "name": "unsigned long"}, + }, + }, + "kind": "struct", + "size": 592, + }, + "_UNICODE_STRING": { + "fields": { + "Buffer": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": {"kind": "base", "name": "unsigned short"}, + }, + }, + "Length": { + "offset": 0, + "type": {"kind": "base", "name": "unsigned short"}, + }, + "MaximumLength": { + "offset": 2, + "type": {"kind": "base", "name": "unsigned short"}, + }, + }, + "kind": "struct", + "size": 8, + }, + }, +} From c317cad835f66e01d4ad6ee50f24967d5a8be7b7 Mon Sep 17 00:00:00 2001 From: hsarkey Date: Wed, 9 Oct 2024 15:53:59 -0400 Subject: [PATCH 0449/1352] Syntax changes to wow64.json --- .../framework/symbols/windows/wow64.json | 3941 ++++++++++------- 1 file changed, 2391 insertions(+), 1550 deletions(-) diff --git a/volatility3/framework/symbols/windows/wow64.json b/volatility3/framework/symbols/windows/wow64.json index e28d77241..4c5cdd4a4 100644 --- a/volatility3/framework/symbols/windows/wow64.json +++ b/volatility3/framework/symbols/windows/wow64.json @@ -1,1585 +1,2426 @@ { - "symbols": {}, - "enums": { - "_LDR_DLL_LOAD_REASON": { - "base": "int", - "constants": { - "LoadReasonAsDataLoad": 6, - "LoadReasonAsImageLoad": 5, - "LoadReasonDelayloadDependency": 3, - "LoadReasonDynamicForwarderDependency": 2, - "LoadReasonDynamicLoad": 4, - "LoadReasonStaticDependency": 0, - "LoadReasonStaticForwarderDependency": 1, - "LoadReasonUnknown": -1, - }, - "size": 4, - }, - "_LDR_DDAG_STATE": { - "base": "int", - "constants": { - "LdrModulesCondensed": 6, - "LdrModulesInitError": -4, - "LdrModulesInitializing": 8, - "LdrModulesMapped": 2, - "LdrModulesMapping": 1, - "LdrModulesMerged": -5, - "LdrModulesPlaceHolder": 0, - "LdrModulesReadyToInit": 7, - "LdrModulesReadyToRun": 9, - "LdrModulesSnapError": -3, - "LdrModulesSnapped": 5, - "LdrModulesSnapping": 4, - "LdrModulesUnloaded": -2, - "LdrModulesUnloading": -1, - "LdrModulesWaitingForDependencies": 3, - }, - "size": 4, - }, + "symbols": { + }, + "enums": { + "_LDR_DLL_LOAD_REASON": { + "base": "int", + "constants": { + "LoadReasonAsDataLoad": 6, + "LoadReasonAsImageLoad": 5, + "LoadReasonDelayloadDependency": 3, + "LoadReasonDynamicForwarderDependency": 2, + "LoadReasonDynamicLoad": 4, + "LoadReasonStaticDependency": 0, + "LoadReasonStaticForwarderDependency": 1, + "LoadReasonUnknown": -1 + }, + "size": 4 }, + "_LDR_DDAG_STATE": { + "base": "int", + "constants": { + "LdrModulesCondensed": 6, + "LdrModulesInitError": -4, + "LdrModulesInitializing": 8, + "LdrModulesMapped": 2, + "LdrModulesMapping": 1, + "LdrModulesMerged": -5, + "LdrModulesPlaceHolder": 0, + "LdrModulesReadyToInit": 7, + "LdrModulesReadyToRun": 9, + "LdrModulesSnapError": -3, + "LdrModulesSnapped": 5, + "LdrModulesSnapping": 4, + "LdrModulesUnloaded": -2, + "LdrModulesUnloading": -1, + "LdrModulesWaitingForDependencies": 3 + }, + "size": 4 + } + }, "base_types": { "unsigned long": { "kind": "int", "size": 4, "signed": false, - "endian": "little", + "endian": "little" + }, + "int": { + "endian": "little", + "kind": "int", + "signed": true, + "size": 4 }, - "int": {"endian": "little", "kind": "int", "signed": true, "size": 4}, "unsigned long long": { "kind": "int", "size": 8, "signed": false, - "endian": "little", + "endian": "little" }, "unsigned char": { "kind": "char", "size": 1, "signed": false, - "endian": "little", + "endian": "little" + }, + "pointer": { + "kind": "int", + "size": 4, + "signed": false, + "endian": "little" + }, + "unsigned int": { + "kind": "int", + "size": 4, + "signed": false, + "endian": "little" }, - "pointer": {"kind": "int", "size": 4, "signed": false, "endian": "little"}, - "unsigned int": {"kind": "int", "size": 4, "signed": false, "endian": "little"}, "unsigned short": { "kind": "int", "size": 2, "signed": false, + "endian": "little" + }, + "long": { + "kind": "int", + "size": 4, + "signed": false, + "endian": "little" + }, + "long long": { "endian": "little", + "kind": "int", + "signed": true, + "size": 8 }, - "long": {"kind": "int", "size": 4, "signed": false, "endian": "little"}, - "long long": {"endian": "little", "kind": "int", "signed": true, "size": 8}, - "void": {"endian": "little", "kind": "void", "signed": true, "size": 0}, + "void": { + "endian": "little", + "kind": "void", + "signed": true, + "size": 0 + } }, - "metadata": { - "format": "4.1.0", - "producer": { - "datetime": "2024-05-30T17:02:06.755760", - "name": "awalters-by-hand", - "version": "0.0.2", + "metadata": { + "format": "4.1.0", + "producer": { + "datetime": "2024-05-30T17:02:06.755760", + "name": "awalters-by-hand", + "version": "0.0.2" + } + }, + "user_types": { + "_LDR_SERVICE_TAG_RECORD": { + "fields": { + "Next": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_LDR_SERVICE_TAG_RECORD" + } + } }, + "ServiceTag": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 8 }, - "user_types": { - "_LDR_SERVICE_TAG_RECORD": { - "fields": { - "Next": { - "offset": 0, - "type": { - "kind": "pointer", - "subtype": { - "kind": "struct", - "name": "_LDR_SERVICE_TAG_RECORD", - }, - }, - }, - "ServiceTag": { - "offset": 4, - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "kind": "struct", - "size": 8, + "_KTIMER": { + "fields": { + "Dpc": { + "offset": 32, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_KDPC" + } + } }, - "_KTIMER": { - "fields": { - "Dpc": { - "offset": 32, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_KDPC"}, - }, - }, - "DueTime": { - "offset": 16, - "type": {"kind": "union", "name": "_ULARGE_INTEGER"}, - }, - "Header": { - "offset": 0, - "type": {"kind": "struct", "name": "_DISPATCHER_HEADER"}, - }, - "Period": { - "offset": 36, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "TimerListEntry": { - "offset": 24, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - }, - "kind": "struct", - "size": 40, - }, - "_ERESOURCE": { - "fields": { - "ActiveCount": { - "offset": 12, - "type": {"kind": "base", "name": "short"}, - }, - "ActiveEntries": { - "offset": 32, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "Address": { - "offset": 48, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "ContentionCount": { - "offset": 36, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "CreatorBackTraceIndex": { - "offset": 48, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ExclusiveWaiters": { - "offset": 20, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_KEVENT"}, - }, - }, - "Flag": { - "offset": 14, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "NumberOfExclusiveWaiters": { - "offset": 44, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "NumberOfSharedWaiters": { - "offset": 40, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "OwnerEntry": { - "offset": 24, - "type": {"kind": "struct", "name": "_OWNER_ENTRY"}, - }, - "OwnerTable": { - "offset": 8, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_OWNER_ENTRY"}, - }, - }, - "ReservedLowFlags": { - "offset": 14, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "SharedWaiters": { - "offset": 16, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_KSEMAPHORE"}, - }, - }, - "SpinLock": { - "offset": 52, - "type": {"kind": "base", "name": "unsigned long long"}, - }, - "SystemResourcesList": { - "offset": 0, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - "WaiterPriority": { - "offset": 15, - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "kind": "struct", - "size": 56, - }, - "_LARGE_INTEGER": { - "fields": { - "HighPart": {"offset": 4, "type": {"kind": "base", "name": "long"}}, - "LowPart": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "QuadPart": { - "offset": 0, - "type": {"kind": "base", "name": "long long"}, - }, - "u": { - "offset": 0, - "type": {"kind": "struct", "name": "__unnamed_1083"}, - }, - }, + "DueTime": { + "offset": 16, + "type": { "kind": "union", - "size": 8, + "name": "_ULARGE_INTEGER" + } }, - "_ETHREAD": { - "fields": { - "Cid": { - "offset": 868, - "type": {"kind": "struct", "name": "_CLIENT_ID"}, - }, - "CreateTime": { - "offset": 824, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - "CrossThreadFlags": { - "offset": 952, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ExitTime": { - "offset": 832, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - "Tcb": {"offset": 0, "type": {"kind": "struct", "name": "_KTHREAD"}}, - }, + "Header": { + "offset": 0, + "type": { "kind": "struct", - "size": 1048, + "name": "_DISPATCHER_HEADER" + } }, - "_KTHREAD": { - "fields": { - "State": { - "offset": 144, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "WaitReason": { - "offset": 395, - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, + "Period": { + "offset": 36, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "TimerListEntry": { + "offset": 24, + "type": { "kind": "struct", - "size": 824, - }, - "_EPROCESS": { - "fields": { - "CreateTime": { - "offset": 168, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - "ExitTime": { - "offset": 688, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - "ImageFileName": { - "offset": 1080, - "type": { - "count": 368, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned char"}, - }, - }, - "ObjectTable": { - "offset": 336, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_HANDLE_TABLE"}, - }, - }, - "Pcb": {"offset": 0, "type": {"kind": "struct", "name": "_KPROCESS"}}, - "Peb": { - "offset": 320, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_PEB"}, - }, - }, - "Session": { - "offset": 324, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "ThreadListHead": { - "offset": 404, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - "UniqueProcessId": { - "offset": 180, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "VadRoot": { - "offset": 628, - "type": {"kind": "struct", "name": "_RTL_AVL_TREE"}, - }, - }, - "kind": "struct", - "size": 760, - }, - "_EX_FAST_REF": { - "fields": { - "Object": { - "offset": 0, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "RefCnt": { - "offset": 0, - "type": { - "bit_length": 4, - "bit_position": 0, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "Value": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "kind": "struct", - "size": 4, - }, - "_TOKEN": { - "fields": { - "Privileges": { - "offset": 64, - "type": {"kind": "struct", "name": "_SEP_TOKEN_PRIVILEGES"}, - }, - "UserAndGroupCount": { - "offset": 124, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "UserAndGroups": { - "offset": 148, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_SID_AND_ATTRIBUTES"}, - }, - }, - }, - "kind": "struct", - "size": 656, - }, - "_OBJECT_HEADER": { - "fields": { - "Body": {"offset": 24, "type": {"kind": "struct", "name": "_QUAD"}}, - "InfoMask": { - "offset": 14, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "PointerCount": {"offset": 0, "type": {"kind": "base", "name": "long"}}, - "TypeIndex": { - "offset": 12, - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "kind": "struct", - "size": 32, - }, - "_FILE_OBJECT": { - "fields": { - "DeleteAccess": { - "offset": 40, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "DeviceObject": { - "offset": 4, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_DEVICE_OBJECT"}, - }, - }, - "FileName": { - "offset": 48, - "type": {"kind": "struct", "name": "_UNICODE_STRING"}, - }, - "ReadAccess": { - "offset": 38, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "SharedDelete": { - "offset": 43, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "SharedRead": { - "offset": 41, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "SharedWrite": { - "offset": 42, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "WriteAccess": { - "offset": 39, - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "kind": "struct", - "size": 128, - }, - "_DEVICE_OBJECT": { - "fields": { - "AttachedDevice": { - "offset": 16, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_DEVICE_OBJECT"}, - }, - }, - "Flags": { - "offset": 48, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "NextDevice": { - "offset": 12, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_DEVICE_OBJECT"}, - }, - }, - }, - "kind": "struct", - "size": 184, - }, - "_CM_KEY_BODY": { - "fields": { - "KeyControlBlock": { - "offset": 4, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_CM_KEY_CONTROL_BLOCK"}, - }, - }, - "Type": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "kind": "struct", - "size": 44, - }, - "_CMHIVE": { - "fields": { - "FileFullPath": { - "offset": 1136, - "type": {"kind": "struct", "name": "_UNICODE_STRING"}, - }, - "FileUserName": { - "offset": 1144, - "type": {"kind": "struct", "name": "_UNICODE_STRING"}, - }, - "Hive": {"offset": 0, "type": {"kind": "struct", "name": "_HHIVE"}}, - "HiveRootPath": { - "offset": 1160, - "type": {"kind": "struct", "name": "_UNICODE_STRING"}, - }, - }, - "kind": "struct", - "size": 3104, - }, - "_CM_KEY_NODE": { - "fields": { - "Name": { - "offset": 76, - "type": { - "count": 1, - "kind": "array", - "subtype": {"kind": "base", "name": "wchar"}, - }, - }, - "NameLength": { - "offset": 72, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "Parent": { - "offset": 16, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "SubKeyLists": { - "offset": 28, - "type": { - "count": 2, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned long"}, - }, - }, - "ValueList": { - "offset": 36, - "type": {"kind": "struct", "name": "_CHILD_LIST"}, - }, - }, - "kind": "struct", - "size": 80, - }, - "_CM_KEY_VALUE": { - "fields": { - "Data": { - "offset": 8, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "DataLength": { - "offset": 4, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "Flags": { - "offset": 16, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "Name": { - "offset": 20, - "type": { - "count": 1, - "kind": "array", - "subtype": {"kind": "base", "name": "wchar"}, - }, - }, - "NameLength": { - "offset": 2, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "Signature": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "Spare": { - "offset": 18, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "Type": { - "offset": 12, - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "kind": "struct", - "size": 24, - }, - "_HMAP_ENTRY": { - "fields": { - "BinAddress": { - "offset": 4, - "type": {"kind": "base", "name": "unsigned long long"}, - }, - "BlockAddress": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned long long"}, - }, - "MemAlloc": { - "offset": 8, - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "kind": "struct", - "size": 12, - }, - "_MMVAD_SHORT": { - "fields": { - "EndingVpn": { - "offset": 16, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "NextVad": { - "offset": 0, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_MMVAD_SHORT"}, - }, - }, - "StartingVpn": { - "offset": 12, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "VadNode": { - "offset": 0, - "type": {"kind": "struct", "name": "_RTL_BALANCED_NODE"}, - }, - }, - "kind": "struct", - "size": 40, - }, - "_MMVAD": { - "fields": { - "Core": { - "offset": 0, - "type": {"kind": "struct", "name": "_MMVAD_SHORT"}, - }, - "Subsection": { - "offset": 44, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_SUBSECTION"}, - }, - }, - }, - "kind": "struct", - "size": 72, - }, - "_KSYSTEM_TIME": { - "fields": { - "High1Time": {"offset": 4, "type": {"kind": "base", "name": "long"}}, - "High2Time": {"offset": 8, "type": {"kind": "base", "name": "long"}}, - "LowPart": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "kind": "struct", - "size": 12, - }, - "_KMUTANT": { - "fields": { - "Header": { - "offset": 0, - "type": {"kind": "struct", "name": "_DISPATCHER_HEADER"}, - } - }, - "kind": "struct", - "size": 32, - }, - "_DRIVER_OBJECT": { - "fields": { - "DeviceObject": { - "offset": 4, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_DEVICE_OBJECT"}, - }, - } - }, - "kind": "struct", - "size": 168, - }, - "_OBJECT_SYMBOLIC_LINK": { - "fields": { - "CreationTime": { - "offset": 0, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - } - }, - "kind": "struct", - "size": 24, - }, - "_CONTROL_AREA": { - "fields": { - "FilePointer": { - "offset": 32, - "type": {"kind": "struct", "name": "_EX_FAST_REF"}, - } - }, - "kind": "struct", - "size": 80, - }, - "_SHARED_CACHE_MAP": { - "fields": { - "FileSize": { - "offset": 8, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - "InitialVacbs": { - "offset": 48, - "type": { - "count": 4, - "kind": "array", - "subtype": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_VACB"}, - }, - }, - }, - "Section": { - "offset": 108, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "SectionSize": { - "offset": 24, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - "Vacbs": { - "offset": 64, - "type": { - "kind": "pointer", - "subtype": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_VACB"}, - }, - }, - }, - "ValidDataLength": { - "offset": 32, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - }, - "kind": "struct", - "size": 368, - }, - "_VACB": { - "fields": { - "ArrayHead": { - "offset": 16, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_VACB_ARRAY_HEADER"}, - }, - }, - "BaseAddress": { - "offset": 0, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "Overlay": { - "offset": 8, - "type": {"kind": "union", "name": "__unnamed_1971"}, - }, - "SharedCacheMap": { - "offset": 4, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_SHARED_CACHE_MAP"}, - }, - }, - }, - "kind": "struct", - "size": 24, - }, - "_POOL_TRACKER_BIG_PAGES": { - "fields": { - "Key": {"offset": 4, "type": {"kind": "base", "name": "unsigned long"}}, - "NumberOfBytes": { - "offset": 12, - "type": {"kind": "base", "name": "unsigned long long"}, - }, - "PoolType": { - "offset": 8, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "Va": {"offset": 0, "type": {"kind": "base", "name": "unsigned long"}}, - }, - "kind": "struct", - "size": 16, - }, - "_IMAGE_DOS_HEADER": { - "fields": { - "e_cblp": { - "offset": 2, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_cp": { - "offset": 4, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_cparhdr": { - "offset": 8, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_crlc": { - "offset": 6, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_cs": { - "offset": 22, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_csum": { - "offset": 18, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_ip": { - "offset": 20, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_lfanew": {"offset": 60, "type": {"kind": "base", "name": "long"}}, - "e_lfarlc": { - "offset": 24, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_magic": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_maxalloc": { - "offset": 12, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_minalloc": { - "offset": 10, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_oemid": { - "offset": 36, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_oeminfo": { - "offset": 38, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_ovno": { - "offset": 26, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_res": { - "offset": 28, - "type": { - "count": 4, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned short"}, - }, - }, - "e_res2": { - "offset": 40, - "type": { - "count": 10, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned short"}, - }, - }, - "e_sp": { - "offset": 16, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "e_ss": { - "offset": 14, - "type": {"kind": "base", "name": "unsigned short"}, - }, - }, - "kind": "struct", - "size": 64, - }, - "_SINGLE_LIST_ENTRY": { - "fields": { - "Next": { - "offset": 0, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_SINGLE_LIST_ENTRY"}, - }, - } - }, - "kind": "struct", - "size": 4, - }, - "_LDRP_CSLIST": { - "fields": { - "Tail": { - "offset": 0, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_SINGLE_LIST_ENTRY"}, - }, - } - }, - "kind": "struct", - "size": 4, - }, - "_RTL_BALANCED_NODE": { - "fields": { - "Balance": { - "offset": 8, - "type": { - "bit_length": 2, - "bit_position": 0, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "Children": { - "offset": 0, - "type": { - "count": 2, - "kind": "array", - "subtype": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_RTL_BALANCED_NODE"}, - }, - }, - }, - "Left": { - "offset": 0, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_RTL_BALANCED_NODE"}, - }, - }, - "ParentValue": { - "offset": 8, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "Red": { - "offset": 8, - "type": { - "bit_length": 1, - "bit_position": 0, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "Right": { - "offset": 4, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_RTL_BALANCED_NODE"}, - }, - }, - }, - "kind": "struct", - "size": 12, - }, - "_LIST_ENTRY": { - "fields": { - "Blink": { - "offset": 4, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - }, - "Flink": { - "offset": 0, - "type": { - "kind": "pointer", - "subtype": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - }, - }, - "kind": "struct", - "size": 8, - }, - "LIST_ENTRY32": { - "fields": { - "Blink": { - "offset": 4, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "Flink": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "kind": "struct", - "size": 8, - }, - "_PEB_LDR_DATA": { - "fields": { - "EntryInProgress": { - "offset": 36, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "InInitializationOrderModuleList": { - "offset": 28, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - "InLoadOrderModuleList": { - "offset": 12, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - "InMemoryOrderModuleList": { - "offset": 20, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - "Initialized": { - "offset": 4, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "Length": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ShutdownInProgress": { - "offset": 40, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "ShutdownThreadId": { - "offset": 44, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "SsHandle": { - "offset": 8, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - }, - "kind": "struct", - "size": 48, - }, - "_LDR_DATA_TABLE_ENTRY": { - "fields": { - "BaseDllName": { - "offset": 44, - "type": {"kind": "struct", "name": "_UNICODE_STRING"}, - }, - "FullDllName": { - "offset": 36, - "type": {"kind": "struct", "name": "_UNICODE_STRING"}, - }, - "LoadTime": { - "offset": 256, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - "DllBase": { - "offset": 24, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "void"}, - }, - }, - "SizeOfImage": { - "offset": 32, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "InInitializationOrderLinks": { - "offset": 16, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - "InLoadOrderLinks": { - "offset": 0, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - "InMemoryOrderLinks": { - "offset": 8, - "type": {"kind": "struct", "name": "_LIST_ENTRY"}, - }, - }, - "kind": "struct", - "size": 160, - }, - "_PEB32": { - "fields": { - "ActivationContextData": { - "offset": 504, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ActiveProcessAffinityMask": { - "offset": 192, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "AnsiCodePageData": { - "offset": 88, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ApiSetMap": { - "offset": 56, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "AppCompatFlags": { - "offset": 472, - "type": {"kind": "union", "name": "_ULARGE_INTEGER"}, - }, - "AppCompatFlagsUser": { - "offset": 480, - "type": {"kind": "union", "name": "_ULARGE_INTEGER"}, - }, - "AppCompatInfo": { - "offset": 492, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "AtlThunkSListPtr": { - "offset": 32, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "AtlThunkSListPtr32": { - "offset": 52, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "BeingDebugged": { - "offset": 2, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "BitField": { - "offset": 3, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "CSDVersion": { - "offset": 496, - "type": {"kind": "struct", "name": "_STRING32"}, - }, - "CritSecTracingEnabled": { - "offset": 576, - "type": { - "bit_length": 1, - "bit_position": 1, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "CriticalSectionTimeout": { - "offset": 112, - "type": {"kind": "union", "name": "_LARGE_INTEGER"}, - }, - "CrossProcessFlags": { - "offset": 40, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "CsrServerReadOnlySharedMemoryBase": { - "offset": 584, - "type": {"kind": "base", "name": "unsigned long long"}, - }, - "FastPebLock": { - "offset": 28, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "FlsBitmap": { - "offset": 536, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "FlsBitmapBits": { - "offset": 540, - "type": { - "count": 4, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned long"}, - }, - }, - "FlsCallback": { - "offset": 524, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "FlsHighIndex": { - "offset": 556, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "FlsListHead": { - "offset": 528, - "type": {"kind": "struct", "name": "LIST_ENTRY32"}, - }, - "GdiDCAttributeList": { - "offset": 156, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "GdiHandleBuffer": { - "offset": 196, - "type": { - "count": 34, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned long"}, - }, - }, - "GdiSharedHandleTable": { - "offset": 148, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "HeapDeCommitFreeBlockThreshold": { - "offset": 132, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "HeapDeCommitTotalFreeThreshold": { - "offset": 128, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "HeapSegmentCommit": { - "offset": 124, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "HeapSegmentReserve": { - "offset": 120, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "HeapTracingEnabled": { - "offset": 576, - "type": { - "bit_length": 1, - "bit_position": 0, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "IFEOKey": { - "offset": 36, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ImageBaseAddress": { - "offset": 8, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ImageSubsystem": { - "offset": 180, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ImageSubsystemMajorVersion": { - "offset": 184, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ImageSubsystemMinorVersion": { - "offset": 188, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ImageUsesLargePages": { - "offset": 3, - "type": { - "bit_length": 1, - "bit_position": 0, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "InheritedAddressSpace": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "IsAppContainer": { - "offset": 3, - "type": { - "bit_length": 1, - "bit_position": 5, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "IsImageDynamicallyRelocated": { - "offset": 3, - "type": { - "bit_length": 1, - "bit_position": 2, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "IsPackagedProcess": { - "offset": 3, - "type": { - "bit_length": 1, - "bit_position": 4, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "IsProtectedProcess": { - "offset": 3, - "type": { - "bit_length": 1, - "bit_position": 1, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "IsProtectedProcessLight": { - "offset": 3, - "type": { - "bit_length": 1, - "bit_position": 6, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "KernelCallbackTable": { - "offset": 44, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "Ldr": { - "offset": 12, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "LibLoaderTracingEnabled": { - "offset": 576, - "type": { - "bit_length": 1, - "bit_position": 2, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "LoaderLock": { - "offset": 160, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "MaximumNumberOfHeaps": { - "offset": 140, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "MinimumStackCommit": { - "offset": 520, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "Mutant": { - "offset": 4, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "NtGlobalFlag": { - "offset": 104, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "NumberOfHeaps": { - "offset": 136, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "NumberOfProcessors": { - "offset": 100, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "OSBuildNumber": { - "offset": 172, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "OSCSDVersion": { - "offset": 174, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "OSMajorVersion": { - "offset": 164, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "OSMinorVersion": { - "offset": 168, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "OSPlatformId": { - "offset": 176, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "OemCodePageData": { - "offset": 92, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "PostProcessInitRoutine": { - "offset": 332, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ProcessAssemblyStorageMap": { - "offset": 508, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ProcessHeap": { - "offset": 24, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ProcessHeaps": { - "offset": 144, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ProcessInJob": { - "offset": 40, - "type": { - "bit_length": 1, - "bit_position": 0, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "ProcessInitializing": { - "offset": 40, - "type": { - "bit_length": 1, - "bit_position": 1, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "ProcessParameters": { - "offset": 16, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ProcessStarterHelper": { - "offset": 152, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ProcessUsingFTH": { - "offset": 40, - "type": { - "bit_length": 1, - "bit_position": 4, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "ProcessUsingVCH": { - "offset": 40, - "type": { - "bit_length": 1, - "bit_position": 3, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "ProcessUsingVEH": { - "offset": 40, - "type": { - "bit_length": 1, - "bit_position": 2, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "ReadImageFileExecOptions": { - "offset": 1, - "type": {"kind": "base", "name": "unsigned char"}, - }, - "ReadOnlySharedMemoryBase": { - "offset": 76, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ReadOnlyStaticServerData": { - "offset": 84, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "ReservedBits0": { - "offset": 40, - "type": { - "bit_length": 27, - "bit_position": 5, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "SessionId": { - "offset": 468, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "SkipPatchingUser32Forwarders": { - "offset": 3, - "type": { - "bit_length": 1, - "bit_position": 3, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "SpareBits": { - "offset": 3, - "type": { - "bit_length": 1, - "bit_position": 7, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned char"}, - }, - }, - "SparePvoid0": { - "offset": 80, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "SpareTracingBits": { - "offset": 576, - "type": { - "bit_length": 29, - "bit_position": 3, - "kind": "bitfield", - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "SubSystemData": { - "offset": 20, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "SystemAssemblyStorageMap": { - "offset": 516, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "SystemDefaultActivationContextData": { - "offset": 512, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "SystemReserved": { - "offset": 48, - "type": { - "count": 1, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned long"}, - }, - }, - "TlsBitmap": { - "offset": 64, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "TlsBitmapBits": { - "offset": 68, - "type": { - "count": 2, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned long"}, - }, - }, - "TlsExpansionBitmap": { - "offset": 336, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "TlsExpansionBitmapBits": { - "offset": 340, - "type": { - "count": 32, - "kind": "array", - "subtype": {"kind": "base", "name": "unsigned long"}, - }, - }, - "TlsExpansionCounter": { - "offset": 60, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "TracingFlags": { - "offset": 576, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "UnicodeCaseTableData": { - "offset": 96, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "UserSharedInfoPtr": { - "offset": 44, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "WerRegistrationData": { - "offset": 560, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "WerShipAssertPtr": { - "offset": 564, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "pImageHeaderHash": { - "offset": 572, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "pShimData": { - "offset": 488, - "type": {"kind": "base", "name": "unsigned long"}, - }, - "pUnused": { - "offset": 568, - "type": {"kind": "base", "name": "unsigned long"}, - }, - }, - "kind": "struct", - "size": 592, - }, - "_UNICODE_STRING": { - "fields": { - "Buffer": { - "offset": 4, - "type": { - "kind": "pointer", - "subtype": {"kind": "base", "name": "unsigned short"}, - }, - }, - "Length": { - "offset": 0, - "type": {"kind": "base", "name": "unsigned short"}, - }, - "MaximumLength": { - "offset": 2, - "type": {"kind": "base", "name": "unsigned short"}, - }, - }, - "kind": "struct", - "size": 8, - }, + "name": "_LIST_ENTRY" + } + } + }, + "kind": "struct", + "size": 40 }, + "_ERESOURCE": { + "fields": { + "ActiveCount": { + "offset": 12, + "type": { + "kind": "base", + "name": "short" + } + }, + "ActiveEntries": { + "offset": 32, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "Address": { + "offset": 48, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "ContentionCount": { + "offset": 36, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "CreatorBackTraceIndex": { + "offset": 48, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ExclusiveWaiters": { + "offset": 20, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_KEVENT" + } + } + }, + "Flag": { + "offset": 14, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "NumberOfExclusiveWaiters": { + "offset": 44, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NumberOfSharedWaiters": { + "offset": 40, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "OwnerEntry": { + "offset": 24, + "type": { + "kind": "struct", + "name": "_OWNER_ENTRY" + } + }, + "OwnerTable": { + "offset": 8, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_OWNER_ENTRY" + } + } + }, + "ReservedLowFlags": { + "offset": 14, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "SharedWaiters": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_KSEMAPHORE" + } + } + }, + "SpinLock": { + "offset": 52, + "type": { + "kind": "base", + "name": "unsigned long long" + } + }, + "SystemResourcesList": { + "offset": 0, + "type": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + }, + "WaiterPriority": { + "offset": 15, + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "kind": "struct", + "size": 56 + }, + "_LARGE_INTEGER": { + "fields": { + "HighPart": { + "offset": 4, + "type": { + "kind": "base", + "name": "long" + } + }, + "LowPart": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "QuadPart": { + "offset": 0, + "type": { + "kind": "base", + "name": "long long" + } + }, + "u": { + "offset": 0, + "type": { + "kind": "struct", + "name": "__unnamed_1083" + } + } + }, + "kind": "union", + "size": 8 + }, + "_ETHREAD": { + "fields": { + "Cid": { + "offset": 868, + "type": { + "kind": "struct", + "name": "_CLIENT_ID" + } + }, + "CreateTime": { + "offset": 824, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + }, + "CrossThreadFlags": { + "offset": 952, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ExitTime": { + "offset": 832, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + }, + "Tcb": { + "offset": 0, + "type": { + "kind": "struct", + "name": "_KTHREAD" + } + } + }, + "kind": "struct", + "size": 1048 + }, + "_KTHREAD": { + "fields": { + "State": { + "offset": 144, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "WaitReason": { + "offset": 395, + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "kind": "struct", + "size": 824 + }, + "_EPROCESS": { + "fields": { + "CreateTime": { + "offset": 168, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + }, + "ExitTime": { + "offset": 688, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + }, + "ImageFileName": { + "offset": 1080, + "type": { + "count": 368, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "ObjectTable": { + "offset": 336, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_HANDLE_TABLE" + } + } + }, + "Pcb": { + "offset": 0, + "type": { + "kind": "struct", + "name": "_KPROCESS" + } + }, + "Peb": { + "offset": 320, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_PEB" + } + } + }, + "Session": { + "offset": 324, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "ThreadListHead": { + "offset": 404, + "type": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + }, + "UniqueProcessId": { + "offset": 180, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "VadRoot": { + "offset": 628, + "type": { + "kind": "struct", + "name": "_RTL_AVL_TREE" + } + } + }, + "kind": "struct", + "size": 760 + }, + "_EX_FAST_REF": { + "fields": { + "Object": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "RefCnt": { + "offset": 0, + "type": { + "bit_length": 4, + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "Value": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 4 + }, + "_TOKEN": { + "fields": { + "Privileges": { + "offset": 64, + "type": { + "kind": "struct", + "name": "_SEP_TOKEN_PRIVILEGES" + } + }, + "UserAndGroupCount": { + "offset": 124, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "UserAndGroups": { + "offset": 148, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_SID_AND_ATTRIBUTES" + } + } + } + }, + "kind": "struct", + "size": 656 + }, + "_OBJECT_HEADER": { + "fields": { + "Body": { + "offset": 24, + "type": { + "kind": "struct", + "name": "_QUAD" + } + }, + "InfoMask": { + "offset": 14, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "PointerCount": { + "offset": 0, + "type": { + "kind": "base", + "name": "long" + } + }, + "TypeIndex": { + "offset": 12, + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "kind": "struct", + "size": 32 + }, + "_FILE_OBJECT": { + "fields": { + "DeleteAccess": { + "offset": 40, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "DeviceObject": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_DEVICE_OBJECT" + } + } + }, + "FileName": { + "offset": 48, + "type": { + "kind": "struct", + "name": "_UNICODE_STRING" + } + }, + "ReadAccess": { + "offset": 38, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "SharedDelete": { + "offset": 43, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "SharedRead": { + "offset": 41, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "SharedWrite": { + "offset": 42, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "WriteAccess": { + "offset": 39, + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "kind": "struct", + "size": 128 + }, + "_DEVICE_OBJECT": { + "fields": { + "AttachedDevice": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_DEVICE_OBJECT" + } + } + }, + "Flags": { + "offset": 48, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NextDevice": { + "offset": 12, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_DEVICE_OBJECT" + } + } + } + }, + "kind": "struct", + "size": 184 + }, + "_CM_KEY_BODY": { + "fields": { + "KeyControlBlock": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_CM_KEY_CONTROL_BLOCK" + } + } + }, + "Type": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 44 + }, + "_CMHIVE": { + "fields": { + "FileFullPath": { + "offset": 1136, + "type": { + "kind": "struct", + "name": "_UNICODE_STRING" + } + }, + "FileUserName": { + "offset": 1144, + "type": { + "kind": "struct", + "name": "_UNICODE_STRING" + } + }, + "Hive": { + "offset": 0, + "type": { + "kind": "struct", + "name": "_HHIVE" + } + }, + "HiveRootPath": { + "offset": 1160, + "type": { + "kind": "struct", + "name": "_UNICODE_STRING" + } + } + }, + "kind": "struct", + "size": 3104 + }, + "_CM_KEY_NODE": { + "fields": { + "Name": { + "offset": 76, + "type": { + "count": 1, + "kind": "array", + "subtype": { + "kind": "base", + "name": "wchar" + } + } + }, + "NameLength": { + "offset": 72, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "Parent": { + "offset": 16, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "SubKeyLists": { + "offset": 28, + "type": { + "count": 2, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "ValueList": { + "offset": 36, + "type": { + "kind": "struct", + "name": "_CHILD_LIST" + } + } + }, + "kind": "struct", + "size": 80 + }, + "_CM_KEY_VALUE": { + "fields": { + "Data": { + "offset": 8, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "DataLength": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "Flags": { + "offset": 16, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "Name": { + "offset": 20, + "type": { + "count": 1, + "kind": "array", + "subtype": { + "kind": "base", + "name": "wchar" + } + } + }, + "NameLength": { + "offset": 2, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "Signature": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "Spare": { + "offset": 18, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "Type": { + "offset": 12, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 24 + }, + "_HMAP_ENTRY": { + "fields": { + "BinAddress": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long long" + } + }, + "BlockAddress": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned long long" + } + }, + "MemAlloc": { + "offset": 8, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 12 + }, + "_MMVAD_SHORT": { + "fields": { + "EndingVpn": { + "offset": 16, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NextVad": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_MMVAD_SHORT" + } + } + }, + "StartingVpn": { + "offset": 12, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "VadNode": { + "offset": 0, + "type": { + "kind": "struct", + "name": "_RTL_BALANCED_NODE" + } + } + }, + "kind": "struct", + "size": 40 + }, + "_MMVAD": { + "fields": { + "Core": { + "offset": 0, + "type": { + "kind": "struct", + "name": "_MMVAD_SHORT" + } + }, + "Subsection": { + "offset": 44, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_SUBSECTION" + } + } + } + }, + "kind": "struct", + "size": 72 + }, + "_KSYSTEM_TIME": { + "fields": { + "High1Time": { + "offset": 4, + "type": { + "kind": "base", + "name": "long" + } + }, + "High2Time": { + "offset": 8, + "type": { + "kind": "base", + "name": "long" + } + }, + "LowPart": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 12 + }, + "_KMUTANT": { + "fields": { + "Header": { + "offset": 0, + "type": { + "kind": "struct", + "name": "_DISPATCHER_HEADER" + } + } + }, + "kind": "struct", + "size": 32 + }, + "_DRIVER_OBJECT": { + "fields": { + "DeviceObject": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_DEVICE_OBJECT" + } + } + } + }, + "kind": "struct", + "size": 168 + }, + "_OBJECT_SYMBOLIC_LINK": { + "fields": { + "CreationTime": { + "offset": 0, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + } + }, + "kind": "struct", + "size": 24 + }, + "_CONTROL_AREA": { + "fields": { + "FilePointer": { + "offset": 32, + "type": { + "kind": "struct", + "name": "_EX_FAST_REF" + } + } + }, + "kind": "struct", + "size": 80 + }, + "_SHARED_CACHE_MAP": { + "fields": { + "FileSize": { + "offset": 8, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + }, + "InitialVacbs": { + "offset": 48, + "type": { + "count": 4, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_VACB" + } + } + } + }, + "Section": { + "offset": 108, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "SectionSize": { + "offset": 24, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + }, + "Vacbs": { + "offset": 64, + "type": { + "kind": "pointer", + "subtype": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_VACB" + } + } + } + }, + "ValidDataLength": { + "offset": 32, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + } + }, + "kind": "struct", + "size": 368 + }, + "_VACB": { + "fields": { + "ArrayHead": { + "offset": 16, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_VACB_ARRAY_HEADER" + } + } + }, + "BaseAddress": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "Overlay": { + "offset": 8, + "type": { + "kind": "union", + "name": "__unnamed_1971" + } + }, + "SharedCacheMap": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_SHARED_CACHE_MAP" + } + } + } + }, + "kind": "struct", + "size": 24 + }, + "_POOL_TRACKER_BIG_PAGES": { + "fields": { + "Key": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NumberOfBytes": { + "offset": 12, + "type": { + "kind": "base", + "name": "unsigned long long" + } + }, + "PoolType": { + "offset": 8, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "Va": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 16 + }, + "_IMAGE_DOS_HEADER": { + "fields": { + "e_cblp": { + "offset": 2, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_cp": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_cparhdr": { + "offset": 8, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_crlc": { + "offset": 6, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_cs": { + "offset": 22, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_csum": { + "offset": 18, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_ip": { + "offset": 20, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_lfanew": { + "offset": 60, + "type": { + "kind": "base", + "name": "long" + } + }, + "e_lfarlc": { + "offset": 24, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_magic": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_maxalloc": { + "offset": 12, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_minalloc": { + "offset": 10, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_oemid": { + "offset": 36, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_oeminfo": { + "offset": 38, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_ovno": { + "offset": 26, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_res": { + "offset": 28, + "type": { + "count": 4, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "e_res2": { + "offset": 40, + "type": { + "count": 10, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "e_sp": { + "offset": 16, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "e_ss": { + "offset": 14, + "type": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "kind": "struct", + "size": 64 + }, + "_SINGLE_LIST_ENTRY": { + "fields": { + "Next": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_SINGLE_LIST_ENTRY" + } + } + } + }, + "kind": "struct", + "size": 4 + }, + "_LDRP_CSLIST": { + "fields": { + "Tail": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_SINGLE_LIST_ENTRY" + } + } + } + }, + "kind": "struct", + "size": 4 + }, + "_RTL_BALANCED_NODE": { + "fields": { + "Balance": { + "offset": 8, + "type": { + "bit_length": 2, + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "Children": { + "offset": 0, + "type": { + "count": 2, + "kind": "array", + "subtype": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_RTL_BALANCED_NODE" + } + } + } + }, + "Left": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_RTL_BALANCED_NODE" + } + } + }, + "ParentValue": { + "offset": 8, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "Red": { + "offset": 8, + "type": { + "bit_length": 1, + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "Right": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_RTL_BALANCED_NODE" + } + } + } + }, + "kind": "struct", + "size": 12 + }, + "_LIST_ENTRY": { + "fields": { + "Blink": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + } + }, + "Flink": { + "offset": 0, + "type": { + "kind": "pointer", + "subtype": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + } + } + }, + "kind": "struct", + "size": 8 + }, + "LIST_ENTRY32": { + "fields": { + "Blink": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "Flink": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 8 + }, + "_PEB_LDR_DATA": { + "fields": { + "EntryInProgress": { + "offset": 36, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "InInitializationOrderModuleList": { + "offset": 28, + "type": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + }, + "InLoadOrderModuleList": { + "offset": 12, + "type": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + }, + "InMemoryOrderModuleList": { + "offset": 20, + "type": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + }, + "Initialized": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "Length": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ShutdownInProgress": { + "offset": 40, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "ShutdownThreadId": { + "offset": 44, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "SsHandle": { + "offset": 8, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + } + }, + "kind": "struct", + "size": 48 + }, + "_LDR_DATA_TABLE_ENTRY": { + "fields": { + "BaseDllName": { + "offset": 44, + "type": { + "kind": "struct", + "name": "_UNICODE_STRING" + } + }, + "FullDllName": { + "offset": 36, + "type": { + "kind": "struct", + "name": "_UNICODE_STRING" + } + }, + "LoadTime": { + "offset": 256, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + }, + "DllBase": { + "offset": 24, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "void" + } + } + }, + "SizeOfImage": { + "offset": 32, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "InInitializationOrderLinks": { + "offset": 16, + "type": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + }, + "InLoadOrderLinks": { + "offset": 0, + "type": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + }, + "InMemoryOrderLinks": { + "offset": 8, + "type": { + "kind": "struct", + "name": "_LIST_ENTRY" + } + } + }, + "kind": "struct", + "size": 160 + }, + "_PEB32": { + "fields": { + "ActivationContextData": { + "offset": 504, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ActiveProcessAffinityMask": { + "offset": 192, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "AnsiCodePageData": { + "offset": 88, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ApiSetMap": { + "offset": 56, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "AppCompatFlags": { + "offset": 472, + "type": { + "kind": "union", + "name": "_ULARGE_INTEGER" + } + }, + "AppCompatFlagsUser": { + "offset": 480, + "type": { + "kind": "union", + "name": "_ULARGE_INTEGER" + } + }, + "AppCompatInfo": { + "offset": 492, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "AtlThunkSListPtr": { + "offset": 32, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "AtlThunkSListPtr32": { + "offset": 52, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "BeingDebugged": { + "offset": 2, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "BitField": { + "offset": 3, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "CSDVersion": { + "offset": 496, + "type": { + "kind": "struct", + "name": "_STRING32" + } + }, + "CritSecTracingEnabled": { + "offset": 576, + "type": { + "bit_length": 1, + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "CriticalSectionTimeout": { + "offset": 112, + "type": { + "kind": "union", + "name": "_LARGE_INTEGER" + } + }, + "CrossProcessFlags": { + "offset": 40, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "CsrServerReadOnlySharedMemoryBase": { + "offset": 584, + "type": { + "kind": "base", + "name": "unsigned long long" + } + }, + "FastPebLock": { + "offset": 28, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "FlsBitmap": { + "offset": 536, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "FlsBitmapBits": { + "offset": 540, + "type": { + "count": 4, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "FlsCallback": { + "offset": 524, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "FlsHighIndex": { + "offset": 556, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "FlsListHead": { + "offset": 528, + "type": { + "kind": "struct", + "name": "LIST_ENTRY32" + } + }, + "GdiDCAttributeList": { + "offset": 156, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "GdiHandleBuffer": { + "offset": 196, + "type": { + "count": 34, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "GdiSharedHandleTable": { + "offset": 148, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "HeapDeCommitFreeBlockThreshold": { + "offset": 132, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "HeapDeCommitTotalFreeThreshold": { + "offset": 128, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "HeapSegmentCommit": { + "offset": 124, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "HeapSegmentReserve": { + "offset": 120, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "HeapTracingEnabled": { + "offset": 576, + "type": { + "bit_length": 1, + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "IFEOKey": { + "offset": 36, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ImageBaseAddress": { + "offset": 8, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ImageSubsystem": { + "offset": 180, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ImageSubsystemMajorVersion": { + "offset": 184, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ImageSubsystemMinorVersion": { + "offset": 188, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ImageUsesLargePages": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "InheritedAddressSpace": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "IsAppContainer": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "IsImageDynamicallyRelocated": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "IsPackagedProcess": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "IsProtectedProcess": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "IsProtectedProcessLight": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "KernelCallbackTable": { + "offset": 44, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "Ldr": { + "offset": 12, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "LibLoaderTracingEnabled": { + "offset": 576, + "type": { + "bit_length": 1, + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "LoaderLock": { + "offset": 160, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "MaximumNumberOfHeaps": { + "offset": 140, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "MinimumStackCommit": { + "offset": 520, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "Mutant": { + "offset": 4, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NtGlobalFlag": { + "offset": 104, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NumberOfHeaps": { + "offset": 136, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "NumberOfProcessors": { + "offset": 100, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "OSBuildNumber": { + "offset": 172, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "OSCSDVersion": { + "offset": 174, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "OSMajorVersion": { + "offset": 164, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "OSMinorVersion": { + "offset": 168, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "OSPlatformId": { + "offset": 176, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "OemCodePageData": { + "offset": 92, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "PostProcessInitRoutine": { + "offset": 332, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ProcessAssemblyStorageMap": { + "offset": 508, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ProcessHeap": { + "offset": 24, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ProcessHeaps": { + "offset": 144, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ProcessInJob": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "ProcessInitializing": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "ProcessParameters": { + "offset": 16, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ProcessStarterHelper": { + "offset": 152, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ProcessUsingFTH": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "ProcessUsingVCH": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "ProcessUsingVEH": { + "offset": 40, + "type": { + "bit_length": 1, + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "ReadImageFileExecOptions": { + "offset": 1, + "type": { + "kind": "base", + "name": "unsigned char" + } + }, + "ReadOnlySharedMemoryBase": { + "offset": 76, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ReadOnlyStaticServerData": { + "offset": 84, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "ReservedBits0": { + "offset": 40, + "type": { + "bit_length": 27, + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "SessionId": { + "offset": 468, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "SkipPatchingUser32Forwarders": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "SpareBits": { + "offset": 3, + "type": { + "bit_length": 1, + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + } + } + }, + "SparePvoid0": { + "offset": 80, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "SpareTracingBits": { + "offset": 576, + "type": { + "bit_length": 29, + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "SubSystemData": { + "offset": 20, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "SystemAssemblyStorageMap": { + "offset": 516, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "SystemDefaultActivationContextData": { + "offset": 512, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "SystemReserved": { + "offset": 48, + "type": { + "count": 1, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "TlsBitmap": { + "offset": 64, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "TlsBitmapBits": { + "offset": 68, + "type": { + "count": 2, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "TlsExpansionBitmap": { + "offset": 336, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "TlsExpansionBitmapBits": { + "offset": 340, + "type": { + "count": 32, + "kind": "array", + "subtype": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "TlsExpansionCounter": { + "offset": 60, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "TracingFlags": { + "offset": 576, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "UnicodeCaseTableData": { + "offset": 96, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "UserSharedInfoPtr": { + "offset": 44, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "WerRegistrationData": { + "offset": 560, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "WerShipAssertPtr": { + "offset": 564, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "pImageHeaderHash": { + "offset": 572, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "pShimData": { + "offset": 488, + "type": { + "kind": "base", + "name": "unsigned long" + } + }, + "pUnused": { + "offset": 568, + "type": { + "kind": "base", + "name": "unsigned long" + } + } + }, + "kind": "struct", + "size": 592 + }, + "_UNICODE_STRING": { + "fields": { + "Buffer": { + "offset": 4, + "type": { + "kind": "pointer", + "subtype": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "Length": { + "offset": 0, + "type": { + "kind": "base", + "name": "unsigned short" + } + }, + "MaximumLength": { + "offset": 2, + "type": { + "kind": "base", + "name": "unsigned short" + } + } + }, + "kind": "struct", + "size": 8 + } + } } From d172e1271716c27e1c3d0145fb651eef552916d8 Mon Sep 17 00:00:00 2001 From: hsarkey Date: Fri, 24 Jan 2025 08:08:57 -0500 Subject: [PATCH 0450/1352] Updated fixes after internal review. Allows windows.dlllist to report back DLLs from wow64 processes. --- .../symbols/windows/extensions/__init__.py | 73 ++++++++----------- 1 file changed, 31 insertions(+), 42 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 2b73fa625..3ac737ac8 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -790,13 +790,13 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): # Determine if process is running under WOW64. if self.get_is_wow64(): - peb32 = self.get_wow_64_process() + proc = self.get_wow_64_process() else: return None # Confirm WoW64Process points to a valid process address - if not proc_layer.is_valid(peb32): + if not proc_layer.is_valid(proc): raise exceptions.InvalidAddressException( - proc_layer_name, peb32, f"Invalid Wow64Process address at {self.Peb:0x}" + proc_layer_name, proc, f"Invalid Wow64Process address at {self.Peb:0x}" ) # Leverage the context of existing symbol table to help configure @@ -816,50 +816,41 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): if self._context.symbol_space.has_type( sym_table + constants.BANG + "_EWOW64PROCESS" ): - peb32 = self._context.object( - f"{self._32bit_table_name}{constants.BANG}_PEB32", - layer_name=proc_layer_name, - offset=peb32.Peb, - ) - return peb32 + offset=proc.Peb # vista sp0-sp1 and 2003 sp1-sp2 elif self._context.symbol_space.has_type( sym_table + constants.BANG + "_WOW64_PROCESS" ): - peb32 = self._context.object( - f"{self._32bit_table_name}{constants.BANG}_PEB32", - layer_name=proc_layer_name, - offset=peb32.Wow64, - ) - return peb32 + offset=proc.Wow64 else: - peb32 = self._context.object( - f"{self._32bit_table_name}{constants.BANG}_PEB32", - layer_name=proc_layer_name, - offset=peb32, - ) - return peb32 + offset=proc + + peb32 = self._context.object( + f"{self._32bit_table_name}{constants.BANG}_PEB32", + layer_name=proc_layer_name, + offset=offset, + ) + return peb32 def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were loaded.""" try: pebs = [ - [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], - [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + self.get_peb(), self.get_peb32(), ] - for peb, table_name in pebs: - if peb != None: + for peb in pebs: + if peb: sym_table = self.get_symbol_table_name() if peb.Ldr.vol.type_name.endswith("unsigned long"): - Ldr_data = self._context.symbol_space.get_type( + ldr_data = self._context.symbol_space.get_type( self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name for entry in peb.Ldr.InLoadOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + table_name, + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks", ): yield entry @@ -871,20 +862,19 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): try: pebs = [ - [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], - [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + self.get_peb(), self.get_peb32(), ] - for peb, table_name in pebs: - if peb != None: + for peb in pebs: + if peb: sym_table = self.get_symbol_table_name() if peb.Ldr.vol.type_name.endswith("unsigned long"): - Ldr_data = self._context.symbol_space.get_type( + ldr_data = self._context.symbol_space.get_type( self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name for entry in peb.Ldr.InInitializationOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + table_name, + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InInitializationOrderLinks", ): yield entry @@ -895,20 +885,19 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): """Generator for DLLs in the order that they appear in memory""" try: pebs = [ - [self.get_peb(), "_LDR_DATA_TABLE_ENTRY"], - [self.get_peb32(), "_LDR_DATA_TABLE_ENTRY"], + self.get_peb(), self.get_peb32(), ] - for peb, table_name in pebs: - if peb != None: + for peb in pebs: + if peb: sym_table = self.get_symbol_table_name() if peb.Ldr.vol.type_name.endswith("unsigned long"): - Ldr_data = self._context.symbol_space.get_type( + ldr_data = self._context.symbol_space.get_type( self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=Ldr_data) + peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name for entry in peb.Ldr.InMemoryOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + table_name, + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks", ): yield entry From 9ce1fd7ac054dad51602a710c6628550786dc7aa Mon Sep 17 00:00:00 2001 From: hsarkey Date: Fri, 24 Jan 2025 08:37:02 -0500 Subject: [PATCH 0451/1352] Black formatting updates --- .../symbols/windows/extensions/__init__.py | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 3ac737ac8..9c4fbb1b6 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -816,17 +816,17 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): if self._context.symbol_space.has_type( sym_table + constants.BANG + "_EWOW64PROCESS" ): - offset=proc.Peb + offset = proc.Peb # vista sp0-sp1 and 2003 sp1-sp2 elif self._context.symbol_space.has_type( sym_table + constants.BANG + "_WOW64_PROCESS" ): - offset=proc.Wow64 + offset = proc.Wow64 else: - offset=proc - + offset = proc + peb32 = self._context.object( f"{self._32bit_table_name}{constants.BANG}_PEB32", layer_name=proc_layer_name, @@ -838,7 +838,8 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): """Generator for DLLs in the order that they were loaded.""" try: pebs = [ - self.get_peb(), self.get_peb32(), + self.get_peb(), + self.get_peb32(), ] for peb in pebs: if peb: @@ -850,7 +851,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name for entry in peb.Ldr.InLoadOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks", ): yield entry @@ -862,7 +863,8 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): try: pebs = [ - self.get_peb(), self.get_peb32(), + self.get_peb(), + self.get_peb32(), ] for peb in pebs: if peb: @@ -885,7 +887,8 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): """Generator for DLLs in the order that they appear in memory""" try: pebs = [ - self.get_peb(), self.get_peb32(), + self.get_peb(), + self.get_peb32(), ] for peb in pebs: if peb: From 02d0790475e61cf4af15452980478a82a8f6ec0e Mon Sep 17 00:00:00 2001 From: hsarkey Date: Fri, 24 Jan 2025 11:32:48 -0500 Subject: [PATCH 0452/1352] Updated black and ruff formatting errors --- .../symbols/windows/extensions/__init__.py | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 9c4fbb1b6..f84c4105f 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -850,11 +850,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name - for entry in peb.Ldr.InLoadOrderModuleList.to_list( + yield from peb.Ldr.InLoadOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks", - ): - yield entry + ) except exceptions.InvalidAddressException: return None @@ -875,11 +874,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name - for entry in peb.Ldr.InInitializationOrderModuleList.to_list( + yield from peb.Ldr.InInitializationOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InInitializationOrderLinks", - ): - yield entry + ) except exceptions.InvalidAddressException: return None @@ -899,11 +897,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) sym_table = self._32bit_table_name - for entry in peb.Ldr.InMemoryOrderModuleList.to_list( + yield from peb.Ldr.InMemoryOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks", - ): - yield entry + ) except exceptions.InvalidAddressException: return None From af9bd53cae0e69b00fe14845f437688f883013b0 Mon Sep 17 00:00:00 2001 From: hsarkey Date: Fri, 24 Jan 2025 13:35:39 -0500 Subject: [PATCH 0453/1352] Resolving conflicts and formatting issues --- .../framework/symbols/windows/extensions/__init__.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index f84c4105f..818c8c83f 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -485,10 +485,10 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): ].is_valid(self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: - name: Union[ - str, interfaces.renderers.BaseAbsentValue - ] = renderers.UnreadableValue() - + name: Union[str, interfaces.renderers.BaseAbsentValue] = ( + renderers.UnreadableValue() + ) + # this pointer needs to be checked against native_layer_name because the object may # be instantiated from a primary (virtual) layer or a memory (physical) layer. if self._context.layers[self.vol.native_layer_name].is_valid(self.DeviceObject): From 495d6466821c2b491edff3b4ba1834ff83cf1b45 Mon Sep 17 00:00:00 2001 From: hsarkey Date: Fri, 24 Jan 2025 13:53:21 -0500 Subject: [PATCH 0454/1352] Black and ruff fixes --- .../framework/symbols/windows/extensions/__init__.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 818c8c83f..814681a61 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -485,10 +485,8 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): ].is_valid(self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: - name: Union[str, interfaces.renderers.BaseAbsentValue] = ( - renderers.UnreadableValue() - ) - + name: Union[str, interfaces.renderers.BaseAbsentValue] = renderers.UnreadableValue() + # this pointer needs to be checked against native_layer_name because the object may # be instantiated from a primary (virtual) layer or a memory (physical) layer. if self._context.layers[self.vol.native_layer_name].is_valid(self.DeviceObject): From 17d52c27bfc31ad9ecad7fb0b8604586039ce2b0 Mon Sep 17 00:00:00 2001 From: Daniel Davidov <35842733+Danking555@users.noreply.github.com> Date: Fri, 24 Jan 2025 21:09:28 +0200 Subject: [PATCH 0455/1352] Update method_low_stub_offset & run ruff & black * Eliminate unnecessary scanning for 32 bit processors where the structure PROCESSOR_START_BLOCK doesn't exist * Put offsets as values of constants in a class - LowStubLayout. * Add documentation in the class and in the function method_low_stub_offset * Run "ruff check --fix" and "black ." * Checked the method works on 3 physical machines --- volatility3/framework/automagic/pdbscan.py | 74 ++++++++++++++++++---- 1 file changed, 60 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 1ccecf97a..7d289bcb6 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -11,7 +11,6 @@ import contextlib import logging import math import os -import struct from typing import Any, Callable, Dict, Iterable, List, Optional, Set, Tuple, Union from volatility3.framework import constants, exceptions, interfaces, layers @@ -377,25 +376,73 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): valid_kernel = (virtual_layer_name, address, res[0]) return valid_kernel - def method_low_stub_offset(self, + class LowStubLayout: + """ + Represents the layout of the Low Stub which exists only on x64 machines with no virtualization/emulation, + responsible for transitioning from Real Mode(16 bit) to Protected Mode(32 bit) and Long Mode(64 bit) on boot/return from sleep. + Contains offsets to fields and structures within the undocumented structure _PROCESSOR_START_BLOCK. + Here's a reference: https://github.com/mic101/windows/blob/master/WRK-v1.2/base/ntos/inc/amd64.h#L3334 + """ + + # Expected signature for validation, constructed from: + # PROCESSOR_START_BLOCK->Jmp->OpCode | PROCESSOR_START_BLOCK->Jmp->Offset | PROCESSOR_START_BLOCK->CompletionFlag + JMP_AND_COMPLETION_SIGNATURE = 0x00000001000600E9 + + # Address of LmTarget (Long Mode target) + PROCESSOR_START_BLOCK_LM_TARGET_OFFSET = ( + 0x70 # PROCESSOR_START_BLOCK->LmTarget, PVOID 8 bytes + ) + + # CR3 register within structures describing initial processor state to be started + PROCESSOR_START_BLOCK_CR3_OFFSET = 0xA0 # PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3, ULONG64 8 bytes + + def method_low_stub_offset( + self, context: interfaces.context.ContextInterface, vlayer: layers.intel.Intel, progress_callback: constants.ProgressCallback = None, ) -> Optional[ValidKernelType]: + # This method is only valid for x64 systems + if not isinstance(vlayer, intel.Intel32e): + return None kernel_hint = 0 kernel_base = 0 - physical_layer = context.layers.get('memory_layer') + physical_layer = context.layers.get("memory_layer") - # try locating kernel base via x64 Low Stub in lower 1MB starting from second page (4KB) - # if "Discard Low Memory" setting is disabled in BIOS, the Low Stub may be at the third/fourth or further pages - for offset in range(0x1000,0x100000, 0x1000): - if 0xffffffffffff00ff & int.from_bytes(physical_layer.read(offset, 0x8), "little") != 0x00000001000600E9: - continue # not _PROCESSOR_START_BLOCK->Jmp - potential_kernel_hint = int.from_bytes(physical_layer.read(offset + 0x70, 0x8), "little") - if (0xfffff80000000003 & potential_kernel_hint) != 0xfffff80000000000: - continue # not _PROCESSOR_START_BLOCK->LmTarget - kernel_hint = potential_kernel_hint & 0xffffffffffff - kernel_base = kernel_hint & (~0x1fffff) & 0xffffffffffff + # Try locating kernel base via x64 Low Stub in lower 1MB starting from second page (4KB) + # If "Discard Low Memory" setting is disabled in BIOS, the Low Stub may be at the third/fourth or further pages + for offset in range(0x1000, 0x100000, 0x1000): + jmp_and_completion_values = int.from_bytes( + physical_layer.read(offset, 0x8), "little" + ) + if ( + 0xFFFFFFFFFFFF00FF & jmp_and_completion_values + != self.LowStubLayout.JMP_AND_COMPLETION_SIGNATURE + ): + continue + cr3_value = int.from_bytes( + physical_layer.read( + offset + self.LowStubLayout.PROCESSOR_START_BLOCK_CR3_OFFSET, 0x8 + ), + "little", + ) + + # Compare previously observed valid page table address that's stored in vlayer._initial_entry + # with PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3 + # which was observed to be an invalid page address, so add 1 (to make it valid too) + if (cr3_value + 1) != vlayer._initial_entry: + continue + potential_kernel_hint = int.from_bytes( + physical_layer.read( + offset + self.LowStubLayout.PROCESSOR_START_BLOCK_LM_TARGET_OFFSET, + 0x8, + ), + "little", + ) + if 0x3 & potential_kernel_hint: + continue + kernel_hint = potential_kernel_hint & 0xFFFFFFFFFFFF + kernel_base = kernel_hint & (~0x1FFFFF) & 0xFFFFFFFFFFFF break if kernel_base: @@ -408,7 +455,6 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): if valid_kernel: return valid_kernel kernel_base -= 0x200000 - return None # List of methods to be run, in order, to determine the valid kernels From 830c28a7bb6e6014d5df63e558ac8a114de51f2c Mon Sep 17 00:00:00 2001 From: hsarkey Date: Fri, 24 Jan 2025 14:16:10 -0500 Subject: [PATCH 0456/1352] Updated with current black version --- volatility3/framework/symbols/windows/extensions/__init__.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 814681a61..cda2dd615 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -485,7 +485,9 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): ].is_valid(self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: - name: Union[str, interfaces.renderers.BaseAbsentValue] = renderers.UnreadableValue() + name: Union[str, interfaces.renderers.BaseAbsentValue] = ( + renderers.UnreadableValue() + ) # this pointer needs to be checked against native_layer_name because the object may # be instantiated from a primary (virtual) layer or a memory (physical) layer. From e9088be0d86fa2f68774d47371ebd2736287f1c5 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 28 Dec 2024 22:46:39 +0000 Subject: [PATCH 0457/1352] Prevent infinite looping and out of memory errors #1482 --- .../framework/symbols/windows/extensions/registry.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index c9544a8ba..b282b13cf 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -133,8 +133,17 @@ class CM_KEY_BODY(objects.StructType): def get_full_key_name(self) -> str: output = [] + seen = set() + kcb = self.KeyControlBlock while kcb.ParentKcb: + if kcb.ParentKcb.vol.offset in seen: + return "" + seen.add(kcb.ParentKcb.vol.offset) + + if len(output) > 128: + return "" + if kcb.NameBlock.Name is None: break From 506a61d8846e6a3399ab1f964d41b09a197592a6 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 24 Jan 2025 22:09:24 +0000 Subject: [PATCH 0458/1352] Address feedback --- volatility3/framework/plugins/windows/handles.py | 4 ++-- volatility3/framework/symbols/windows/extensions/registry.py | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 38ccfbfbc..6a391fe35 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -341,7 +341,7 @@ class Handles(interfaces.plugins.PluginInterface): try: obj_name = entry.NameInfo.Name.String except (ValueError, exceptions.InvalidAddressException): - obj_name = "" + obj_name = None except exceptions.InvalidAddressException: vollog.log( @@ -359,7 +359,7 @@ class Handles(interfaces.plugins.PluginInterface): format_hints.Hex(entry.HandleValue), obj_type, format_hints.Hex(entry.GrantedAccess), - obj_name, + obj_name or renderers.NotAvailableValue(), ), ) diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index b282b13cf..a8cc7703c 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -138,11 +138,11 @@ class CM_KEY_BODY(objects.StructType): kcb = self.KeyControlBlock while kcb.ParentKcb: if kcb.ParentKcb.vol.offset in seen: - return "" + return None seen.add(kcb.ParentKcb.vol.offset) if len(output) > 128: - return "" + return None if kcb.NameBlock.Name is None: break From 8b0165b6f6ea7a6ebb70ddb01b2de29b627ddcfd Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 25 Jan 2025 14:45:21 +0100 Subject: [PATCH 0459/1352] add linux_utilities_modules requirement --- volatility3/framework/plugins/linux/check_idt.py | 5 +++++ volatility3/framework/plugins/linux/keyboard_notifiers.py | 5 +++++ volatility3/framework/plugins/linux/kthreads.py | 5 +++++ volatility3/framework/plugins/linux/netfilter.py | 5 +++++ volatility3/framework/plugins/linux/tty_check.py | 5 +++++ 5 files changed, 25 insertions(+) diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index 5859e73d6..ffb707af5 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -28,6 +28,11 @@ class Check_idt(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index c1b7572c6..8577de848 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -27,6 +27,11 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(1, 0, 0), + ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) ), diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index 2e1bbed47..bd0e895a4 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -31,6 +31,11 @@ class Kthreads(plugins.PluginInterface): description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) ), diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index ccb831b61..33a8ca7cc 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -691,6 +691,11 @@ class Netfilter(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(1, 0, 0), + ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=cls._required_lsmod_version ), diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index f375968a4..9bbca246c 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -30,6 +30,11 @@ class tty_check(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(1, 0, 0), + ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) ), From ce671bb2fa3a7d03042a993814b4c11f19650cf4 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 25 Jan 2025 15:02:25 +0100 Subject: [PATCH 0460/1352] transfer deprecated_method into framework module --- volatility3/framework/__init__.py | 29 ++++++++++++++++++- .../framework/configuration/requirements.py | 23 --------------- .../framework/symbols/linux/__init__.py | 17 +++++++---- 3 files changed, 39 insertions(+), 30 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index a1925faef..12254ca77 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -11,7 +11,8 @@ import inspect import logging import os import traceback -from typing import Any, Dict, Generator, List, Optional, Tuple, Type, TypeVar +import functools +from typing import Any, Callable, Dict, Generator, List, Optional, Tuple, Type, TypeVar from volatility3.framework import constants, interfaces @@ -52,6 +53,32 @@ def require_interface_version(*args) -> None: ) +class Deprecation: + """Deprecation related methods.""" + + @staticmethod + def deprecated_method(replacement: Callable, additional_information: str = ""): + """A decorator for marking functions as deprecated. + + Args: + replacement: The replacement function overriding the deprecated API, in the form of a Callable (typically a method) + additional_information: Information appended at the end of the deprecation message + """ + + def decorator(deprecated_func): + @functools.wraps(deprecated_func) + def wrapper(*args, **kwargs): + nonlocal replacement, additional_information + deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__name__}\" is deprecated, use \"{replacement.__module__ + '.' + replacement.__name__}\" instead. {additional_information}" + vollog.warning(deprecation_msg) + # Return the wrapped function with its original arguments + return deprecated_func(*args, **kwargs) + + return wrapper + + return decorator + + class NonInheritable: def __init__(self, value: Any, cls: Type) -> None: self.default_value = value diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 3af5601dc..3e3608000 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -11,7 +11,6 @@ expect to be in the context (such as particular layers or symboltables). import abc import logging import os -import functools from typing import Any, ClassVar, Dict, List, Optional, Set, Tuple, Type from urllib import parse, request @@ -724,25 +723,3 @@ class ModuleRequirement( """Builds the appropriate configuration for the specified requirement.""" return context.modules[value].build_configuration() - - -def deprecated_method(replacement: str, additional_information: str = ""): - """A decorator for marking functions as deprecated. - - Args: - replacement: The replacement function overriding the deprecated API (full path preferred, starting from "volatility3."). String was preferred, for convenience and to prevent import conflicts on caller side. - additional_information: Information appended at the end of the deprecation message - """ - - def decorator(deprecated_func): - @functools.wraps(deprecated_func) - def wrapper(*args, **kwargs): - nonlocal replacement, additional_information - deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__name__}\" is deprecated, use \"{replacement}\" instead. {additional_information}" - vollog.warning(deprecation_msg) - # Return the wrapped function with its original arguments - return deprecated_func(*args, **kwargs) - - return wrapper - - return decorator diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 3dc744f78..0b7ef751c 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -10,11 +10,16 @@ from typing import Iterator, List, Tuple, Optional, Union import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3 import framework -from volatility3.framework import constants, exceptions, interfaces, objects +from volatility3.framework import ( + constants, + exceptions, + interfaces, + objects, + Deprecation, +) from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux import extensions -from volatility3.framework.configuration import requirements vollog = logging.getLogger(__name__) @@ -455,8 +460,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): ## Deprecated APIs ## @classmethod - @requirements.deprecated_method( - replacement="volatility3.framework.symbols.linux.utilities.modules.Modules.mask_mods_list" + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.mask_mods_list ) def mask_mods_list( cls, @@ -472,8 +477,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return linux_utilities_modules.Modules.mask_mods_list(context, layer_name, mods) @classmethod - @requirements.deprecated_method( - replacement="volatility3.framework.symbols.linux.utilities.modules.Modules.lookup_module_address" + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.lookup_module_address ) def lookup_module_address( cls, From 2e1b77f4b3186bae3dfbc7e51e2ba51e9fd850e3 Mon Sep 17 00:00:00 2001 From: Daniel Davidov <35842733+Danking555@users.noreply.github.com> Date: Sat, 25 Jan 2025 16:22:49 +0200 Subject: [PATCH 0461/1352] Move LowStubLayout constants to windows.constants * Moved constants out of the class and moved to constants.windows * Applied ruff and black --- volatility3/framework/automagic/pdbscan.py | 26 +++---------------- .../framework/constants/windows/__init__.py | 18 +++++++++++++ 2 files changed, 21 insertions(+), 23 deletions(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 7d289bcb6..f9c0d853d 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -376,26 +376,6 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): valid_kernel = (virtual_layer_name, address, res[0]) return valid_kernel - class LowStubLayout: - """ - Represents the layout of the Low Stub which exists only on x64 machines with no virtualization/emulation, - responsible for transitioning from Real Mode(16 bit) to Protected Mode(32 bit) and Long Mode(64 bit) on boot/return from sleep. - Contains offsets to fields and structures within the undocumented structure _PROCESSOR_START_BLOCK. - Here's a reference: https://github.com/mic101/windows/blob/master/WRK-v1.2/base/ntos/inc/amd64.h#L3334 - """ - - # Expected signature for validation, constructed from: - # PROCESSOR_START_BLOCK->Jmp->OpCode | PROCESSOR_START_BLOCK->Jmp->Offset | PROCESSOR_START_BLOCK->CompletionFlag - JMP_AND_COMPLETION_SIGNATURE = 0x00000001000600E9 - - # Address of LmTarget (Long Mode target) - PROCESSOR_START_BLOCK_LM_TARGET_OFFSET = ( - 0x70 # PROCESSOR_START_BLOCK->LmTarget, PVOID 8 bytes - ) - - # CR3 register within structures describing initial processor state to be started - PROCESSOR_START_BLOCK_CR3_OFFSET = 0xA0 # PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3, ULONG64 8 bytes - def method_low_stub_offset( self, context: interfaces.context.ContextInterface, @@ -417,12 +397,12 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): ) if ( 0xFFFFFFFFFFFF00FF & jmp_and_completion_values - != self.LowStubLayout.JMP_AND_COMPLETION_SIGNATURE + != constants.windows.JMP_AND_COMPLETION_SIGNATURE ): continue cr3_value = int.from_bytes( physical_layer.read( - offset + self.LowStubLayout.PROCESSOR_START_BLOCK_CR3_OFFSET, 0x8 + offset + constants.windows.PROCESSOR_START_BLOCK_CR3_OFFSET, 0x8 ), "little", ) @@ -434,7 +414,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): continue potential_kernel_hint = int.from_bytes( physical_layer.read( - offset + self.LowStubLayout.PROCESSOR_START_BLOCK_LM_TARGET_OFFSET, + offset + constants.windows.PROCESSOR_START_BLOCK_LM_TARGET_OFFSET, 0x8, ), "little", diff --git a/volatility3/framework/constants/windows/__init__.py b/volatility3/framework/constants/windows/__init__.py index 7face984a..6f37acd2d 100644 --- a/volatility3/framework/constants/windows/__init__.py +++ b/volatility3/framework/constants/windows/__init__.py @@ -10,3 +10,21 @@ KERNEL_MODULE_NAMES = ["ntkrnlmp", "ntkrnlpa", "ntkrpamp", "ntoskrnl"] """The list of names that kernel modules can have within the windows OS""" PE_MAX_EXTRACTION_SIZE = 1024 * 1024 * 256 + +""" +The following constants represent the layout of the Low Stub which exists only on x64 machines with no virtualization/emulation, +responsible for transitioning from Real Mode(16 bit) to Protected Mode(32 bit) and Long Mode(64 bit) on boot/return from sleep. +Contains offsets to fields and structures within the undocumented structure _PROCESSOR_START_BLOCK. +Here's a reference: https://github.com/mic101/windows/blob/master/WRK-v1.2/base/ntos/inc/amd64.h#L3334 +""" +# Expected signature for validation, constructed from: +# PROCESSOR_START_BLOCK->Jmp->OpCode | PROCESSOR_START_BLOCK->Jmp->Offset | PROCESSOR_START_BLOCK->CompletionFlag +JMP_AND_COMPLETION_SIGNATURE = 0x00000001000600E9 + +# Address of LmTarget (Long Mode target) +PROCESSOR_START_BLOCK_LM_TARGET_OFFSET = ( + 0x70 # PROCESSOR_START_BLOCK->LmTarget, PVOID 8 bytes +) + +# CR3 register within structures describing initial processor state to be started +PROCESSOR_START_BLOCK_CR3_OFFSET = 0xA0 # PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3, ULONG64 8 bytes From d8658f0729f7abbd8410f76571aad6369deabee6 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 25 Jan 2025 17:08:27 +0100 Subject: [PATCH 0462/1352] put deprecated functions order back --- .../framework/symbols/linux/__init__.py | 75 +++++++++---------- 1 file changed, 37 insertions(+), 38 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 0b7ef751c..bc2492f7a 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -345,6 +345,23 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): yield fd_num, filp, full_path + @classmethod + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.mask_mods_list + ) + def mask_mods_list( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + mods: Iterator[interfaces.objects.ObjectInterface], + ) -> List[Tuple[str, int, int]]: + """ + DEPRECATED: use "volatility3.framework.symbols.linux.utilities.modules.Modules.mask_mods_list" instead. + + A helper function to mask the starting and end address of kernel modules + """ + return linux_utilities_modules.Modules.mask_mods_list(context, layer_name, mods) + @classmethod def generate_kernel_handler_info( cls, @@ -372,6 +389,26 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): context, kernel.layer_name, mods_list ) + @classmethod + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.lookup_module_address + ) + def lookup_module_address( + cls, + kernel_module: interfaces.context.ModuleInterface, + handlers: List[Tuple[str, int, int]], + target_address: int, + ) -> Tuple[str, str]: + """ + DEPRECATED: use "volatility3.framework.symbols.linux.utilities.modules.Modules.lookup_module_address" instead. + + Searches between the start and end address of the kernel module using target_address. + Returns the module and symbol name of the address provided. + """ + return linux_utilities_modules.Modules.lookup_module_address( + kernel_module.context, kernel_module.name, handlers, target_address + ) + @classmethod def walk_internal_list(cls, vmlinux, struct_name, list_member, list_start): while list_start: @@ -458,44 +495,6 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): [chr((code >> (i * 8)) & 0xFF) for i in range(code_bytes_length)] ) - ## Deprecated APIs ## - @classmethod - @Deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.mask_mods_list - ) - def mask_mods_list( - cls, - context: interfaces.context.ContextInterface, - layer_name: str, - mods: Iterator[interfaces.objects.ObjectInterface], - ) -> List[Tuple[str, int, int]]: - """ - DEPRECATED: use "volatility3.framework.symbols.linux.utilities.modules.Modules.mask_mods_list" instead. - - A helper function to mask the starting and end address of kernel modules - """ - return linux_utilities_modules.Modules.mask_mods_list(context, layer_name, mods) - - @classmethod - @Deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.lookup_module_address - ) - def lookup_module_address( - cls, - kernel_module: interfaces.context.ModuleInterface, - handlers: List[Tuple[str, int, int]], - target_address: int, - ) -> Tuple[str, str]: - """ - DEPRECATED: use "volatility3.framework.symbols.linux.utilities.modules.Modules.lookup_module_address" instead. - - Searches between the start and end address of the kernel module using target_address. - Returns the module and symbol name of the address provided. - """ - return linux_utilities_modules.Modules.lookup_module_address( - kernel_module.context, kernel_module.name, handlers, target_address - ) - class IDStorage(ABC): """Abstraction to support both XArray and RadixTree""" From 825720ed5d8f290b244735c758149e5b9d208c12 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 25 Jan 2025 19:48:31 +0100 Subject: [PATCH 0463/1352] catch UnsatisfiedException at plugin runtime --- volatility3/cli/__init__.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 82a2a4205..d3ce74847 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -500,6 +500,16 @@ class CommandLine: renderer.filter = text_filter.CLIFilter(grid, args.filters) renderer.column_hide_list = args.hide_columns renderer.render(grid) + except exceptions.UnsatisfiedException as excp: + output = sys.stderr + output.write( + "An unsatisfied framework exception was encountered post plugin construction:\n" + ) + self.process_unsatisfied_exceptions(excp) + output.write( + f"Unable to validate the requirements: {[x for x in excp.unsatisfied]}\n", + ) + sys.exit(1) except exceptions.VolatilityException as excp: self.process_exceptions(excp) From 2ed00cc91a6764d05162c01055fc17c18124c6aa Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 25 Jan 2025 19:52:47 +0100 Subject: [PATCH 0464/1352] add optional version requirement to deprecated_method --- volatility3/framework/__init__.py | 56 ++++++++++++++++++++++++++++--- 1 file changed, 51 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 12254ca77..bf4ec4447 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -12,9 +12,11 @@ import logging import os import traceback import functools +import warnings from typing import Any, Callable, Dict, Generator, List, Optional, Tuple, Type, TypeVar -from volatility3.framework import constants, interfaces +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements # ## @@ -57,20 +59,64 @@ class Deprecation: """Deprecation related methods.""" @staticmethod - def deprecated_method(replacement: Callable, additional_information: str = ""): + def deprecated_method( + replacement: Callable, + replacement_base_class_required_version: Tuple[int, int, int] = None, + additional_information: str = "", + ): """A decorator for marking functions as deprecated. Args: replacement: The replacement function overriding the deprecated API, in the form of a Callable (typically a method) + replacement_base_class_required_version: The "replacement" base class version that the deprecated method expects before proxying to it. This implies that "replacement" is a method from a class that inherits from VersionableInterface. additional_information: Information appended at the end of the deprecation message """ def decorator(deprecated_func): @functools.wraps(deprecated_func) def wrapper(*args, **kwargs): - nonlocal replacement, additional_information - deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__name__}\" is deprecated, use \"{replacement.__module__ + '.' + replacement.__name__}\" instead. {additional_information}" - vollog.warning(deprecation_msg) + nonlocal replacement, replacement_base_class_required_version, additional_information + # Prevent version mismatches between deprecated (proxy) methods and the ones they proxy + if replacement_base_class_required_version is not None and callable( + replacement + ): + # example: replacement = volatility3.MyClass.my_dummy_function + # "MyClass.my_dummy_function" -> "MyClass" + replacement_base_class_name = replacement.__qualname__.split(".")[0] + # replacement.__globals__ example: {'MyClass': } + replacement_base_class = replacement.__globals__.get( + replacement_base_class_name + ) + + # Verify that the base class inherits from VersionableInterface + if inspect.isclass(replacement_base_class) and issubclass( + replacement_base_class, + interfaces.configuration.VersionableInterface, + ): + # Construct a requirement + req = requirements.VersionRequirement( + name=replacement_base_class.__name__, + component=replacement_base_class, + version=replacement_base_class_required_version, + ) + # Verify the requirement + if not req.matches_required( + req._version, req._component.version + ): + full_unsat_req_path = ( + deprecated_func.__module__ + + "." + + deprecated_func.__qualname__ + + "." + + req.name + ) + # Catched by the cli and redirected to process_unsatisfied_exceptions + raise exceptions.UnsatisfiedException( + {full_unsat_req_path: req} + ) + + deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__qualname__}\" is deprecated, use \"{replacement.__module__ + '.' + replacement.__qualname__}\" instead. {additional_information}" + warnings.warn(deprecation_msg, FutureWarning) # Return the wrapped function with its original arguments return deprecated_func(*args, **kwargs) From 3657c6fe5e8db92b1a6364a962b778a89e802624 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 25 Jan 2025 19:54:20 +0100 Subject: [PATCH 0465/1352] require Modules >= 1.0.0 on deprecated methods --- volatility3/framework/symbols/linux/__init__.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index bc2492f7a..6a01efc3a 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -347,7 +347,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @Deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.mask_mods_list + replacement=linux_utilities_modules.Modules.mask_mods_list, + replacement_base_class_required_version=(1, 0, 0), ) def mask_mods_list( cls, @@ -391,7 +392,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @Deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.lookup_module_address + replacement=linux_utilities_modules.Modules.lookup_module_address, + replacement_base_class_required_version=(1, 0, 0), ) def lookup_module_address( cls, From 4262eff8898b3fbc017abe3c1d1e4f13fa6fb189 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 25 Jan 2025 20:04:51 +0100 Subject: [PATCH 0466/1352] adhere to AbstractNetfilter requirement checking --- .../framework/plugins/linux/netfilter.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index 33a8ca7cc..ccb7509aa 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -99,6 +99,20 @@ class AbstractNetfilter(ABC): f"linux.LinuxUtilities version not suitable: required {linuxutils_required_version} found {linuxutils_current_version}" ) + linux_utilities_modules_required_version = ( + Netfilter._required_linux_utilities_modules_version + ) + linux_utilities_modules_current_version = ( + linux_utilities_modules.Modules._version + ) + if not requirements.VersionRequirement.matches_required( + linux_utilities_modules_required_version, + linux_utilities_modules_current_version, + ): + raise exceptions.PluginRequirementException( + f"linux_utilities_modules.Modules version not suitable: required {linux_utilities_modules_required_version} found {linux_utilities_modules_current_version}" + ) + modules = lsmod.Lsmod.list_modules(context, kernel_module_name) self.handlers = linux.LinuxUtilities.generate_kernel_handler_info( context, kernel_module_name, modules @@ -680,6 +694,7 @@ class Netfilter(interfaces.plugins.PluginInterface): _version = (1, 1, 0) + _required_linux_utilities_modules_version = (1, 0, 0) _required_linuxutils_version = (2, 1, 0) _required_lsmod_version = (2, 0, 0) @@ -694,7 +709,7 @@ class Netfilter(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(1, 0, 0), + version=cls._required_linux_utilities_modules_version, ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=cls._required_lsmod_version From 6d43dcd3a842d308705f3ecd3c023c94be473846 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 10:31:46 +0100 Subject: [PATCH 0467/1352] add VersionMismatchException --- volatility3/framework/exceptions.py | 31 ++++++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/exceptions.py b/volatility3/framework/exceptions.py index 41c67b88d..0409ae5f0 100644 --- a/volatility3/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -8,9 +8,10 @@ space or symbol tables, and by layers when an address is invalid. The :class:`PagedInvalidAddressException` contains information about the size of the invalid page. """ -from typing import Dict, Optional +from typing import Callable, Dict, Optional, Tuple from volatility3.framework import interfaces +from volatility3.framework.interfaces.configuration import VersionableInterface class VolatilityException(Exception): @@ -134,3 +135,31 @@ class RenderException(VolatilityException): class LinuxPageCacheException(VolatilityException): """Thrown if there is an error during Linux Page Cache processing""" + + +class VersionMismatchException(VolatilityException): + """Thrown if a version mismatch has been encountered between two components.""" + + def __init__( + self, + source_component: Callable, + target_component: VersionableInterface, + target_version: Tuple[int, int, int], + failure_reason: str = None, + *args, + ): + """ + Args: + source_component: The component that required the target component + target_component: The component that is required. Must inherit from VersionableInterface + target_version: The version of the target component that was required, and ultimately was not satisfied + failure_reason: A detailed failure reason to enhande debugging and bug tracking + """ + super().__init__(*args) + self.source_component = source_component + self.target_component = target_component + self.target_version = target_version + self.failure_reason = failure_reason + + def __str__(self): + return f"{self.source_component.__module__+ '.' + self.source_component.__qualname__}: Version {self.target_version} dependency on {self.target_component.__module__+ '.' + self.target_component.__qualname__} {self.target_component.version} unmet." From 4bd385cc9dadbfe8800fddc2bce9cef1ae4dadd5 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 10:33:02 +0100 Subject: [PATCH 0468/1352] handle VersionMismatchException --- volatility3/cli/__init__.py | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index d3ce74847..b57d9a3f3 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -500,16 +500,6 @@ class CommandLine: renderer.filter = text_filter.CLIFilter(grid, args.filters) renderer.column_hide_list = args.hide_columns renderer.render(grid) - except exceptions.UnsatisfiedException as excp: - output = sys.stderr - output.write( - "An unsatisfied framework exception was encountered post plugin construction:\n" - ) - self.process_unsatisfied_exceptions(excp) - output.write( - f"Unable to validate the requirements: {[x for x in excp.unsatisfied]}\n", - ) - sys.exit(1) except exceptions.VolatilityException as excp: self.process_exceptions(excp) @@ -583,6 +573,8 @@ class CommandLine: fulltrace = traceback.TracebackException.from_exception(excp).format(chain=True) vollog.debug("".join(fulltrace)) + file_a_bug_msg = f"Please re-run with -vvv and file a bug with the output at {constants.BUG_URL}" + if isinstance(excp, exceptions.InvalidAddressException): general = "Volatility was unable to read a requested page:" if isinstance(excp, exceptions.SwappedInvalidAddressException): @@ -627,9 +619,7 @@ class CommandLine: elif isinstance(excp, exceptions.LayerException): general = f"Volatility experienced a layer-related issue: {excp.layer_name}" detail = f"{excp}" - caused_by = [ - "A faulty layer implementation (re-run with -vvv and file a bug)" - ] + caused_by = [f"A faulty layer implementation. {file_a_bug_msg}"] elif isinstance(excp, exceptions.MissingModuleException): general = f"Volatility could not import a necessary module: {excp.module}" detail = f"{excp}" @@ -640,13 +630,17 @@ class CommandLine: general = "Volatility experienced an issue when rendering the output:" detail = f"{excp}" caused_by = ["An invalid renderer option, such as no visible columns"] + elif isinstance(excp, exceptions.VersionMismatchException): + general = "A version mismatch was detected between two components:" + detail = f"{excp}" + caused_by = [ + excp.failure_reason or "An outdated API caller, such as a method.", + file_a_bug_msg, + ] else: general = "Volatility encountered an unexpected situation." detail = "" - caused_by = [ - "Please re-run using with -vvv and file a bug with the output", - f"at {constants.BUG_URL}", - ] + caused_by = [file_a_bug_msg] # Code that actually renders the exception output = sys.stderr From ba6b709aba9496f75a61a806f06719189ac97491 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 10:34:18 +0100 Subject: [PATCH 0469/1352] use VersionMismatchException --- volatility3/framework/__init__.py | 37 ++++++++++--------------------- 1 file changed, 12 insertions(+), 25 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index bf4ec4447..5d4e0f3c4 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -61,25 +61,23 @@ class Deprecation: @staticmethod def deprecated_method( replacement: Callable, - replacement_base_class_required_version: Tuple[int, int, int] = None, + replacement_version: Tuple[int, int, int] = None, additional_information: str = "", ): """A decorator for marking functions as deprecated. Args: replacement: The replacement function overriding the deprecated API, in the form of a Callable (typically a method) - replacement_base_class_required_version: The "replacement" base class version that the deprecated method expects before proxying to it. This implies that "replacement" is a method from a class that inherits from VersionableInterface. + replacement_version: The "replacement" base class version that the deprecated method expects before proxying to it. This implies that "replacement" is a method from a class that inherits from VersionableInterface. additional_information: Information appended at the end of the deprecation message """ def decorator(deprecated_func): @functools.wraps(deprecated_func) def wrapper(*args, **kwargs): - nonlocal replacement, replacement_base_class_required_version, additional_information + nonlocal replacement, replacement_version, additional_information # Prevent version mismatches between deprecated (proxy) methods and the ones they proxy - if replacement_base_class_required_version is not None and callable( - replacement - ): + if replacement_version is not None and callable(replacement): # example: replacement = volatility3.MyClass.my_dummy_function # "MyClass.my_dummy_function" -> "MyClass" replacement_base_class_name = replacement.__qualname__.split(".")[0] @@ -93,26 +91,15 @@ class Deprecation: replacement_base_class, interfaces.configuration.VersionableInterface, ): - # Construct a requirement - req = requirements.VersionRequirement( - name=replacement_base_class.__name__, - component=replacement_base_class, - version=replacement_base_class_required_version, - ) - # Verify the requirement - if not req.matches_required( - req._version, req._component.version + # SemVer check + if not requirements.VersionRequirement.matches_required( + replacement_version, replacement_base_class.version ): - full_unsat_req_path = ( - deprecated_func.__module__ - + "." - + deprecated_func.__qualname__ - + "." - + req.name - ) - # Catched by the cli and redirected to process_unsatisfied_exceptions - raise exceptions.UnsatisfiedException( - {full_unsat_req_path: req} + raise exceptions.VersionMismatchException( + deprecated_func, + replacement_base_class, + replacement_version, + "A deprecated method was unable to proxy the call to its replacement", ) deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__qualname__}\" is deprecated, use \"{replacement.__module__ + '.' + replacement.__qualname__}\" instead. {additional_information}" From 28081ed989599bc395b190cf503e8d83ef5b8fed Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 10:35:25 +0100 Subject: [PATCH 0470/1352] tidy up replacement_base_class_required_version --- volatility3/framework/symbols/linux/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 6a01efc3a..397c36c01 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -348,7 +348,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @Deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.mask_mods_list, - replacement_base_class_required_version=(1, 0, 0), + replacement_version=(1, 0, 0), ) def mask_mods_list( cls, @@ -393,7 +393,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @Deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.lookup_module_address, - replacement_base_class_required_version=(1, 0, 0), + replacement_version=(1, 0, 0), ) def lookup_module_address( cls, From 459483651b847241cb4189c4d1449fd18c0bdca7 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 10:53:33 +0100 Subject: [PATCH 0471/1352] typo --- volatility3/framework/exceptions.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/exceptions.py b/volatility3/framework/exceptions.py index 0409ae5f0..99c5f155e 100644 --- a/volatility3/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -153,7 +153,7 @@ class VersionMismatchException(VolatilityException): source_component: The component that required the target component target_component: The component that is required. Must inherit from VersionableInterface target_version: The version of the target component that was required, and ultimately was not satisfied - failure_reason: A detailed failure reason to enhande debugging and bug tracking + failure_reason: A detailed failure reason to enhance debugging and bug tracking """ super().__init__(*args) self.source_component = source_component From 80eebd2f49bee665f194e4adba92cf12a192a997 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 13:18:30 +0100 Subject: [PATCH 0472/1352] use classmethod instead of staticmethod --- volatility3/framework/symbols/linux/utilities/modules.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index ac9b2afaf..82c63fc18 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -13,8 +13,9 @@ class Modules(interfaces.configuration.VersionableInterface): framework.require_interface_version(*_required_framework_version) - @staticmethod + @classmethod def mask_mods_list( + cls, context: interfaces.context.ContextInterface, layer_name: str, mods: Iterator[interfaces.objects.ObjectInterface], @@ -33,8 +34,9 @@ class Modules(interfaces.configuration.VersionableInterface): for mod in mods ] - @staticmethod + @classmethod def lookup_module_address( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str, handlers: List[Tuple[str, int, int]], From 5d58ba63dbd6a60fd36faca6f23a3a1b4a11e724 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 13:19:01 +0100 Subject: [PATCH 0473/1352] use __name__ instead of overkill __qualname__ --- volatility3/framework/exceptions.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/exceptions.py b/volatility3/framework/exceptions.py index 99c5f155e..a3d660444 100644 --- a/volatility3/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -162,4 +162,4 @@ class VersionMismatchException(VolatilityException): self.failure_reason = failure_reason def __str__(self): - return f"{self.source_component.__module__+ '.' + self.source_component.__qualname__}: Version {self.target_version} dependency on {self.target_component.__module__+ '.' + self.target_component.__qualname__} {self.target_component.version} unmet." + return f"{self.source_component.__module__+ '.' + self.source_component.__qualname__}: Version {self.target_version} dependency on {self.target_component.__module__+ '.' + self.target_component.__name__} {self.target_component.version} unmet." From 4cb386858ebe7c62f05b16c9f869fdf762084121 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 13:20:48 +0100 Subject: [PATCH 0474/1352] use __self__ and enhance exception msg --- volatility3/framework/__init__.py | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 5d4e0f3c4..aa93340cd 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -77,14 +77,12 @@ class Deprecation: def wrapper(*args, **kwargs): nonlocal replacement, replacement_version, additional_information # Prevent version mismatches between deprecated (proxy) methods and the ones they proxy - if replacement_version is not None and callable(replacement): - # example: replacement = volatility3.MyClass.my_dummy_function - # "MyClass.my_dummy_function" -> "MyClass" - replacement_base_class_name = replacement.__qualname__.split(".")[0] - # replacement.__globals__ example: {'MyClass': } - replacement_base_class = replacement.__globals__.get( - replacement_base_class_name - ) + if ( + replacement_version is not None + and callable(replacement) + and hasattr(replacement, "__self__") + ): + replacement_base_class = replacement.__self__ # Verify that the base class inherits from VersionableInterface if inspect.isclass(replacement_base_class) and issubclass( @@ -99,7 +97,7 @@ class Deprecation: deprecated_func, replacement_base_class, replacement_version, - "A deprecated method was unable to proxy the call to its replacement", + "This is a bug, the deprecated call needs to be removed and the caller needs to update their code to use the new method.", ) deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__qualname__}\" is deprecated, use \"{replacement.__module__ + '.' + replacement.__qualname__}\" instead. {additional_information}" From a25165d935c02c07510b8b4721b074d7bed21258 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 13:44:23 +0100 Subject: [PATCH 0475/1352] 2.18.1 -> 2.19.0 bump --- volatility3/framework/constants/_version.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 689e39664..f2403cf4a 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 18 # Number of changes that only add to the interface -VERSION_PATCH = 1 # Number of changes that do not change the interface +VERSION_MINOR = 19 # Number of changes that only add to the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From 1ac2dbc49c10552d1d26debe2eb54e0f6922c1c8 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 26 Jan 2025 13:44:33 +0000 Subject: [PATCH 0476/1352] Shift exposed staticmethods to classmethods --- .../framework/plugins/linux/capabilities.py | 4 ++- volatility3/framework/plugins/linux/envars.py | 5 +-- .../framework/plugins/linux/hidden_modules.py | 6 ++-- .../framework/plugins/linux/pagecache.py | 11 +++--- .../framework/plugins/linux/vmayarascan.py | 5 +-- .../framework/plugins/windows/cachedump.py | 18 +++++----- .../plugins/windows/direct_system_calls.py | 13 +++---- .../framework/plugins/windows/mftscan.py | 21 ++++++----- .../framework/plugins/windows/netscan.py | 6 ++-- .../framework/plugins/windows/pe_symbols.py | 35 +++++++++++-------- .../framework/plugins/windows/poolscanner.py | 6 ++-- .../framework/plugins/windows/shimcachemem.py | 4 ++- .../framework/plugins/windows/svcscan.py | 5 +-- .../plugins/windows/unloadedmodules.py | 5 +-- .../framework/plugins/windows/vadyarascan.py | 5 +-- volatility3/framework/plugins/yarascan.py | 14 ++++---- 16 files changed, 93 insertions(+), 70 deletions(-) diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index 1d0c60c11..b758a04b4 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -35,7 +35,9 @@ class CapabilitiesData: cap_permitted: interfaces.objects.ObjectInterface cap_effective: interfaces.objects.ObjectInterface cap_bset: interfaces.objects.ObjectInterface - cap_ambient: interfaces.objects.ObjectInterface + cap_ambient: ( + interfaces.objects.ObjectInterface | interfaces.renderers.BaseAbsentValue + ) def astuple(self) -> Tuple: """Returns a shallow copy of the capability sets in a tuple. diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index 8cdbfe493..cc43c4130 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -18,7 +18,7 @@ class Envars(plugins.PluginInterface): """Lists processes with their environment variables""" _required_framework_version = (2, 13, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) @classmethod def get_requirements(cls): @@ -40,8 +40,9 @@ class Envars(plugins.PluginInterface): ), ] - @staticmethod + @classmethod def get_task_env_variables( + cls, context: interfaces.context.ContextInterface, task: interfaces.objects.ObjectInterface, env_area_max_size: int = 8192, diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index fd4b28943..e1ba40926 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -16,8 +16,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): """Carves memory to find hidden kernel modules""" _required_framework_version = (2, 10, 0) - - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -32,8 +31,9 @@ class Hidden_modules(interfaces.plugins.PluginInterface): ), ] - @staticmethod + @classmethod def get_modules_memory_boundaries( + cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str, ) -> Tuple[int]: diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 32b176b72..4d1250255 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -104,7 +104,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - _version = (1, 0, 2) + _version = (1, 0, 3) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -360,8 +360,8 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): yield description, timeliner.TimeLinerType.MODIFIED, inode_out.modification_time yield description, timeliner.TimeLinerType.CHANGED, inode_out.change_time - @staticmethod - def format_fields_with_headers(headers, generator): + @classmethod + def format_fields_with_headers(cls, headers, generator): """Uses the headers type to cast the fields obtained from the generator""" for level, fields in generator: formatted_fields = [] @@ -405,7 +405,7 @@ class InodePages(plugins.PluginInterface): _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + _version = (2, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -436,8 +436,9 @@ class InodePages(plugins.PluginInterface): ), ] - @staticmethod + @classmethod def write_inode_content_to_file( + cls, inode: interfaces.objects.ObjectInterface, filename: str, open_method: Type[interfaces.plugins.FileHandlerInterface], diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 4db23e50b..e9e56dd0f 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -18,7 +18,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): """Scans all virtual memory areas for tasks using yara.""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 2) + _version = (1, 0, 3) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -105,8 +105,9 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): value, ) - @staticmethod + @classmethod def get_vma_maps( + cls, task: interfaces.objects.ObjectInterface, ) -> Iterable[Tuple[int, int]]: """Creates a map of start/end addresses for each virtual memory area in a task. diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 6c730e6ae..f4f2e061e 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -22,7 +22,7 @@ class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -43,16 +43,16 @@ class Cachedump(interfaces.plugins.PluginInterface): ), ] - @staticmethod + @classmethod def get_nlkm( - sechive: registry.RegistryHive, lsakey: bytes, is_vista_or_later: bool + cls, sechive: registry.RegistryHive, lsakey: bytes, is_vista_or_later: bool ): return lsadump.Lsadump.get_secret_by_name( sechive, "NL$KM", lsakey, is_vista_or_later ) - @staticmethod - def decrypt_hash(edata: bytes, nlkm: bytes, ch, xp: bool): + @classmethod + def decrypt_hash(cls, edata: bytes, nlkm: bytes, ch, xp: bool): if xp: hmac_md5 = HMAC.new(nlkm, ch) rc4key = hmac_md5.digest() @@ -69,8 +69,8 @@ class Cachedump(interfaces.plugins.PluginInterface): data += aes.decrypt(buf) return data - @staticmethod - def parse_cache_entry(cache_data: bytes) -> Tuple[int, int, int, bytes, bytes]: + @classmethod + def parse_cache_entry(cls, cache_data: bytes) -> Tuple[int, int, int, bytes, bytes]: (uname_len, domain_len) = unpack(" Tuple[str, str, str, bytes]: """Get the data from the cache and separate it into the username, domain name, and hash data""" uname_offset = 72 diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 183e4095c..af626f511 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -53,7 +53,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): """Detects the Direct System Call technique used to bypass EDRs""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) # DLLs that are expected to host system call invocations valid_syscall_handlers = ("ntdll.dll", "win32u.dll") @@ -200,8 +200,8 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): return disasm_bytes, end_inst - @staticmethod - def get_disasm_function(architecture: str) -> Callable: + @classmethod + def get_disasm_function(cls, architecture: str) -> Callable: """ Returns the disassembly handler for the given architecture .detail is used to get full instruction information @@ -284,8 +284,9 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): return None - @staticmethod + @classmethod def get_vad_maps( + cls, task: interfaces.objects.ObjectInterface, ) -> List[Tuple[int, int, str]]: """Creates a map of start/end addresses within a virtual address @@ -310,9 +311,9 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): return vads - @staticmethod + @classmethod def get_range_path( - ranges: List[Tuple[int, int, str]], address: int + cls, ranges: List[Tuple[int, int, str]], address: int ) -> Optional[str]: """ Returns the path for the range holding `address`, if found diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index c4d05e634..2c5827a25 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -22,7 +22,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) @classmethod def get_requirements(cls): @@ -37,8 +37,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ), ] - @staticmethod + @classmethod def enumerate_mft_records( + cls, context: interfaces.context.ContextInterface, config_path: str, primary_layer_name: str, @@ -128,8 +129,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): layer_name=layer.name, ) - @staticmethod + @classmethod def parse_mft_records( + cls, record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, @@ -191,8 +193,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): file_name, ) - @staticmethod + @classmethod def parse_data_record( + cls, mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, record_map: Dict[int, Tuple[str, int, int]], @@ -325,7 +328,7 @@ class ADS(interfaces.plugins.PluginInterface): _required_framework_version = (2, 7, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -343,8 +346,9 @@ class ADS(interfaces.plugins.PluginInterface): ), ] - @staticmethod + @classmethod def parse_ads_data_records( + cls, record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, @@ -394,7 +398,7 @@ class ResidentData(interfaces.plugins.PluginInterface): _required_framework_version = (2, 7, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -412,8 +416,9 @@ class ResidentData(interfaces.plugins.PluginInterface): ), ] - @staticmethod + @classmethod def parse_first_data_records( + cls, record_map: Dict[int, Tuple[str, int, int]], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index 162031104..c30792908 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -23,7 +23,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for network objects present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -50,9 +50,9 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ), ] - @staticmethod + @classmethod def create_netscan_constraints( - context: interfaces.context.ContextInterface, symbol_table: str + cls, context: interfaces.context.ContextInterface, symbol_table: str ) -> List[poolscanner.PoolConstraint]: """Creates a list of Pool Tag Constraints for network objects. diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 21e657ab3..88ced7e06 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -244,7 +244,7 @@ class PESymbols(interfaces.plugins.PluginInterface): _required_framework_version = (2, 7, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) # used for special handling of the kernel PDB file. See later notes os_module_name = "ntoskrnl.exe" @@ -330,9 +330,9 @@ class PESymbols(interfaces.plugins.PluginInterface): return pe_ret - @staticmethod + @classmethod def range_info_for_address( - ranges: ranges_type, address: int + cls, ranges: ranges_type, address: int ) -> Optional[range_type]: """ Helper for getting the range information for an address. @@ -351,8 +351,8 @@ class PESymbols(interfaces.plugins.PluginInterface): return None - @staticmethod - def filepath_for_address(ranges: ranges_type, address: int) -> Optional[str]: + @classmethod + def filepath_for_address(cls, ranges: ranges_type, address: int) -> Optional[str]: """ Helper to get the file path for an address @@ -369,8 +369,8 @@ class PESymbols(interfaces.plugins.PluginInterface): return None - @staticmethod - def filename_for_path(filepath: str) -> str: + @classmethod + def filename_for_path(cls, filepath: str) -> str: """ Consistent way to get the filename regardless of platform @@ -382,8 +382,9 @@ class PESymbols(interfaces.plugins.PluginInterface): """ return ntpath.basename(filepath).lower() - @staticmethod + @classmethod def addresses_for_process_symbols( + cls, context: interfaces.context.ContextInterface, config_path: str, layer_name: str, @@ -416,8 +417,9 @@ class PESymbols(interfaces.plugins.PluginInterface): return found_symbols - @staticmethod + @classmethod def path_and_symbol_for_address( + cls, context: interfaces.context.ContextInterface, config_path: str, collected_modules: collected_modules_type, @@ -733,8 +735,9 @@ class PESymbols(interfaces.plugins.PluginInterface): return found, remaining - @staticmethod + @classmethod def find_symbols( + cls, context: interfaces.context.ContextInterface, config_path: str, wanted_modules: PESymbolFinder.cached_value_dict, @@ -775,8 +778,9 @@ class PESymbols(interfaces.plugins.PluginInterface): return found_symbols, missing_symbols - @staticmethod + @classmethod def get_kernel_modules( + cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, @@ -837,8 +841,9 @@ class PESymbols(interfaces.plugins.PluginInterface): return found_modules - @staticmethod + @classmethod def get_vads_for_process_cache( + cls, vads_cache: Dict[int, ranges_type], owner_proc: interfaces.objects.ObjectInterface, ) -> Optional[ranges_type]: @@ -865,8 +870,9 @@ class PESymbols(interfaces.plugins.PluginInterface): return vads - @staticmethod + @classmethod def get_proc_vads_with_file_paths( + cls, proc: interfaces.objects.ObjectInterface, ) -> ranges_type: """ @@ -928,8 +934,9 @@ class PESymbols(interfaces.plugins.PluginInterface): yield proc, proc_layer_name, vads - @staticmethod + @classmethod def get_process_modules( + cls, context: interfaces.context.ContextInterface, layer_name: str, symbol_table: str, diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index efde09638..5be0e7fa8 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -127,8 +127,8 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface): class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" - _version = (1, 0, 0) _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -181,9 +181,9 @@ class PoolScanner(plugins.PluginInterface): ), ) - @staticmethod + @classmethod def builtin_constraints( - symbol_table: str, tags_filter: Optional[List[bytes]] = None + cls, symbol_table: str, tags_filter: Optional[List[bytes]] = None ) -> List[PoolConstraint]: """Get built-in PoolConstraints given a list of pool tags. diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 9d968c30a..1e1024656 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -24,6 +24,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf """Reads Shimcache entries from the ahcache.sys AVL tree""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) # These checks must be completed from newest -> oldest OS version. _win_version_file_map: List[Tuple[versions.OsDistinguisher, bool, str]] = [ @@ -74,8 +75,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf ), ] - @staticmethod + @classmethod def create_shimcache_table( + cls, context: interfaces.context.ContextInterface, symbol_table: str, config_path: str, diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 17baac5b0..6645fa6a3 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -35,7 +35,7 @@ class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 1) + _version = (3, 0, 2) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -61,8 +61,9 @@ class SvcScan(interfaces.plugins.PluginInterface): ), ] - @staticmethod + @classmethod def get_record_tuple( + cls, service_record: interfaces.objects.ObjectInterface, binary_info: ServiceBinaryInfo, ): diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index 077fe33cb..d9f104ae8 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -22,7 +22,7 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt """Lists the unloaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -34,8 +34,9 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt ), ] - @staticmethod + @classmethod def create_unloadedmodules_table( + cls, context: interfaces.context.ContextInterface, symbol_table: str, config_path: str, diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 2e9cc44ea..11ddc3716 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -18,7 +18,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" _required_framework_version = (2, 4, 0) - _version = (1, 1, 1) + _version = (1, 1, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -104,8 +104,9 @@ class VadYaraScan(interfaces.plugins.PluginInterface): value, ) - @staticmethod + @classmethod def get_vad_maps( + cls, task: interfaces.objects.ObjectInterface, ) -> Iterable[Tuple[int, int]]: """Creates a map of start/end addresses within a virtual address diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 310bbd072..38c8b6085 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -37,7 +37,7 @@ except ImportError: class YaraScanner(interfaces.layers.ScannerInterface): - _version = (2, 1, 0) + _version = (2, 1, 1) # yara.Rules isn't exposed, so we can't type this properly def __init__(self, rules) -> None: @@ -79,23 +79,23 @@ class YaraScanner(interfaces.layers.ScannerInterface): for offset, name, value in match.strings: yield (offset + data_offset, match.rule, name, value) - @staticmethod - def get_rule(rule): + @classmethod + def get_rule(cls, rule): if USE_YARA_X: return yara_x.compile(f"rule r1 {{strings: $a = {rule} condition: $a}}") return yara.compile( sources={"n": f"rule r1 {{strings: $a = {rule} condition: $a}}"} ) - @staticmethod - def from_compiled_file(filepath): + @classmethod + def from_compiled_file(cls, filepath): with resources.ResourceAccessor().open(filepath, "rb") as fp: if USE_YARA_X: return yara_x.Rules.deserialize_from(file=fp) return yara.load(file=fp) - @staticmethod - def from_file(filepath): + @classmethod + def from_file(cls, filepath): with resources.ResourceAccessor().open(filepath, "rb") as fp: if USE_YARA_X: return yara_x.compile(fp.read().decode()) From e4e54a5c58e24b053b0509de952ea1647e07877f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 26 Jan 2025 13:48:00 +0000 Subject: [PATCH 0477/1352] Don't fix the type error as part of the shift. --- volatility3/framework/plugins/linux/capabilities.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index b758a04b4..1d0c60c11 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -35,9 +35,7 @@ class CapabilitiesData: cap_permitted: interfaces.objects.ObjectInterface cap_effective: interfaces.objects.ObjectInterface cap_bset: interfaces.objects.ObjectInterface - cap_ambient: ( - interfaces.objects.ObjectInterface | interfaces.renderers.BaseAbsentValue - ) + cap_ambient: interfaces.objects.ObjectInterface def astuple(self) -> Tuple: """Returns a shallow copy of the capability sets in a tuple. From f75a4be0517f772ebe05aeaef4d0eb21fe9d98a4 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 15:24:06 +0100 Subject: [PATCH 0478/1352] rename modules_utilities to linux_utilities_modules --- volatility3/framework/plugins/linux/tracing/ftrace.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 009d48ce8..39df2ccc7 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -14,7 +14,7 @@ from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue from volatility3.framework.symbols.linux import extensions -from volatility3.framework.symbols.linux.utilities import modules as modules_utilities +from volatility3.framework.symbols.linux.utilities import modules as linux_utilities_modules from volatility3.framework.constants import architectures vollog = logging.getLogger(__name__) @@ -78,8 +78,8 @@ class CheckFtrace(interfaces.plugins.PluginInterface): architectures=architectures.LINUX_ARCHS, ), requirements.VersionRequirement( - name="modules_utilities", - component=modules_utilities.Modules, + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, version=(1, 0, 0), ), requirements.PluginRequirement( @@ -153,7 +153,7 @@ if the "hidden_modules" key is present in known_modules. callback_symbol = module_address = module_name = None # Try to lookup within the known modules if the callback address fits - module = modules_utilities.Modules.module_lookup_by_address( + module = linux_utilities_modules.Modules.module_lookup_by_address( context, kernel.layer_name, modxview.Modxview.flatten_run_modules_results(known_modules), @@ -189,7 +189,7 @@ if the "hidden_modules" key is present in known_modules. ) # Lookup the updated list to see if hidden_modules was able # to find the missing module - module = modules_utilities.Modules.module_lookup_by_address( + module = linux_utilities_modules.Modules.module_lookup_by_address( context, kernel.layer_name, modxview.Modxview.flatten_run_modules_results(known_modules), From 48eca36b00c885517e607e268b1fa11bea5f6bda Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 15:25:11 +0100 Subject: [PATCH 0479/1352] 1.0.0 -> 1.1.0 Modules bump --- volatility3/framework/symbols/linux/utilities/modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 692aa8d3a..f529a61ae 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -9,7 +9,7 @@ from volatility3.framework.symbols.linux import extensions class Modules(interfaces.configuration.VersionableInterface): """Kernel modules related utilities.""" - _version = (1, 0, 0) + _version = (1, 1, 0) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) From c57f60759faa7a6991e5a93f56889a44d1b4f3d2 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 15:27:27 +0100 Subject: [PATCH 0480/1352] require Modules >= 1.1.0 --- volatility3/framework/plugins/linux/tracing/ftrace.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 39df2ccc7..c35a6f561 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -9,12 +9,12 @@ from typing import Dict, List, Iterable, Optional from enum import auto, IntFlag from dataclasses import dataclass +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.plugins.linux import hidden_modules, modxview from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue from volatility3.framework.symbols.linux import extensions -from volatility3.framework.symbols.linux.utilities import modules as linux_utilities_modules from volatility3.framework.constants import architectures vollog = logging.getLogger(__name__) @@ -80,7 +80,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(1, 0, 0), + version=(1, 1, 0), ), requirements.PluginRequirement( name="modxview", plugin=modxview.Modxview, version=(1, 0, 0) From f2ac62122013971a7c2828cb8afa21a7a902ab52 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 26 Jan 2025 15:30:37 +0100 Subject: [PATCH 0481/1352] use classmethod instead of staticmethod --- volatility3/framework/plugins/linux/tracing/ftrace.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index c35a6f561..6e1a4e470 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -69,8 +69,8 @@ class CheckFtrace(interfaces.plugins.PluginInterface): additional_description = """Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged to hook kernel functions and modify their behaviour.""" - @staticmethod - def get_requirements() -> List[interfaces.configuration.RequirementInterface]: + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ requirements.ModuleRequirement( name="kernel", @@ -98,8 +98,9 @@ class CheckFtrace(interfaces.plugins.PluginInterface): ), ] - @staticmethod + @classmethod def extract_hash_table_filters( + cls, ftrace_ops: interfaces.objects.ObjectInterface, ) -> Optional[Iterable[interfaces.objects.ObjectInterface]]: """Wrap the process of walking to every ftrace_func_entry of an ftrace_ops. @@ -231,9 +232,9 @@ if the "hidden_modules" key is present in known_modules. return None - @staticmethod + @classmethod def iterate_ftrace_ops_list( - context: interfaces.context.ContextInterface, kernel_name: str + cls, context: interfaces.context.ContextInterface, kernel_name: str ) -> Optional[Iterable[interfaces.objects.ObjectInterface]]: """Iterate over (ftrace_ops *)ftrace_ops_list. From 3fc8b9cd31aaaf9a01b5fe12b4745e4884448c7b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 27 Jan 2025 00:04:28 +0000 Subject: [PATCH 0482/1352] Documentation: Initial version of the coding style guide. --- CODING_STYLE.md | 62 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 CODING_STYLE.md diff --git a/CODING_STYLE.md b/CODING_STYLE.md new file mode 100644 index 000000000..f67afefb4 --- /dev/null +++ b/CODING_STYLE.md @@ -0,0 +1,62 @@ +Coding Standards +================ + +The coding standards for volatility are mostly by our linter and our code formatter. +All code submissions will be vetted automatically through tests from both and the submission +will not be accepted if either of these fail. + +Code Linter: Ruff +Code Formatter: Black + +In additio, there are some coding practices that we employ to prevent specific failure cases and +ensure consistency across the codebase. These are documented below along with the rationale for the decision. + +Imports +------- + +Import should be of a module (not a class or a method), and ideally just one module except where naming would cause confusion. +This is to prevent people importing an imported method (which can lead to confusion and add in an unnecessary dependency in the import chain). + +Good example: + +``` +from module import submodule +from module.submodule import submodule as subsubmodule + +class NewClass(submodule.Class): + def method(self): + submodule.Class.classmethod() +``` + +Bad example: + +``` +from module import method +from module.submodule import Class +``` + +Versioning +---------- + +Modules that inherit from `VersionableInterface` define a `_version` attribute which states their version. +This is a tuple of `(MAJOR, MINOR, PATCH)` numbers, which can then be used for Semantic Versioning (where +modifications that change the API in a non-backwards compatible way bump the `MAJOR` version (and set +the `MINOR` and `PATCH` to 0) and additive changes increase the `MINOR` version (and set the `PATCH` to 0). +Changes that have no effect on the external interface (either input or output form) should have their `PATCH` +number incremented. This allows for callers of the interface to determine when changes have happened and whether +their code will still work with it. Volatility carries out these checks through the requirements system, where +a plugin can define what requirements it has. + +Shared functionality +-------------------- + +Within a plugin, there may be functions that are useful to other plugins. These are created as `classmethod`s +so that the plugin can be depended upon by other plugins in their requirements section, without needing to +instantiate a whole copy of the plugin. It is not a staticmethod, because the caller may wish to determine +information about the class the method is defined in, and this is not easily accessible for staticmethods. + +A classmethod usually takes a `context` for its first method (and if it requires one, a configuration string for +it second). All other parameters should generally be basic types (such as strings, numbers, etc) so that future +work requiring paralellization does not have complex types to have to keep in sync. In particular, the idea was +to ensure only one context was used per method (and each object brings its own context with it, meaning the +function signature should not include objects to avoid discrepancies). From ffd0363c4b987b3e5e981d8adf7e5ea88c4b97fa Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 27 Jan 2025 00:28:51 +0000 Subject: [PATCH 0483/1352] Bulk out with text from the google python style guide where this aligns --- CODING_STYLE.md | 102 +++++++++++++++++++++++++++++++----------------- 1 file changed, 66 insertions(+), 36 deletions(-) diff --git a/CODING_STYLE.md b/CODING_STYLE.md index f67afefb4..3695301eb 100644 --- a/CODING_STYLE.md +++ b/CODING_STYLE.md @@ -2,61 +2,91 @@ Coding Standards ================ The coding standards for volatility are mostly by our linter and our code formatter. -All code submissions will be vetted automatically through tests from both and the submission -will not be accepted if either of these fail. +All code submissions will be vetted automatically through tests from both and the submission will not be accepted if either of these fail. Code Linter: Ruff Code Formatter: Black -In additio, there are some coding practices that we employ to prevent specific failure cases and -ensure consistency across the codebase. These are documented below along with the rationale for the decision. +In additiom, there are some coding practices that we employ to prevent specific failure cases and ensure consistency across the codebase. These are documented below along with the rationale for the decision. + +This is heavily based upon https://google.github.io/styleguide/pyguide.html with minor modifications for volatility use. Imports ------- -Import should be of a module (not a class or a method), and ideally just one module except where naming would cause confusion. -This is to prevent people importing an imported method (which can lead to confusion and add in an unnecessary dependency in the import chain). +Use import statements for packages and modules only, not for individual types, classes, or functions and ideally not aliased naming would cause confusion. This is to prevent people importing an imported method (which can lead to confusion and add in an unnecessary dependency in the import chain). -Good example: +* Use `import x` for importing packages and modules. +* Use `from x import y where x` is the package prefix and y is the module name with no prefix. +* Use `from x import y as z` in any of the following circumstances: + * Two modules named `y` are to be imported. + * `y` conflicts with a top-level name defined in the current module. + * `y` conflicts with a common parameter name that is part of the public API (e.g., `features`). + * `y` is an inconveniently long name. + * `y` is too generic in the context of your code (e.g., `from storage.file_system import options as fs_options`). -``` -from module import submodule -from module.submodule import submodule as subsubmodule +Exemptions from this rule: -class NewClass(submodule.Class): - def method(self): - submodule.Class.classmethod() -``` + * Symbols from the following modules are used to support static analysis and type checking: + * `typing` module + * `collections.abc` module + * `typing_extensions` module -Bad example: +Global Mutable State +-------------------- -``` -from module import method -from module.submodule import Class -``` +Avoid mutable global state. + +In those rare cases where using global state is warranted, mutable global entities should be declared at the module level or as a class attribute and made internal by prepending an _ to the name. If necessary, external access to mutable global state must be done through public functions or class methods. See Naming below. Please explain the design reasons why mutable global state is being used in a comment or a doc linked to from a comment. + +Module-level constants are permitted and encouraged. For example: _MAX_HOLY_HANDGRENADE_COUNT = 3 for an internal use constant or SIR_LANCELOTS_FAVORITE_COLOR = "blue" for a public API constant. Constants must be named using all caps with underscores. See Naming below. + +Exceptions +---------- + +Never use catch-all except: statements, or catch Exception or StandardError, unless you are + + * re-raising the exception, or + * creating an isolation point in the program where exceptions are not propagated but are recorded and suppressed instead, such as protecting a thread from crashing by guarding its outermost block. + +Python is very tolerant in this regard and except: will really catch everything including misspelled names, sys.exit() calls, Ctrl+C interrupts, unittest failures and all kinds of other exceptions that you simply don’t want to catch. Versioning ---------- -Modules that inherit from `VersionableInterface` define a `_version` attribute which states their version. -This is a tuple of `(MAJOR, MINOR, PATCH)` numbers, which can then be used for Semantic Versioning (where -modifications that change the API in a non-backwards compatible way bump the `MAJOR` version (and set -the `MINOR` and `PATCH` to 0) and additive changes increase the `MINOR` version (and set the `PATCH` to 0). -Changes that have no effect on the external interface (either input or output form) should have their `PATCH` -number incremented. This allows for callers of the interface to determine when changes have happened and whether -their code will still work with it. Volatility carries out these checks through the requirements system, where -a plugin can define what requirements it has. +Modules that inherit from `VersionableInterface` define a `_version` attribute which states their version. This is a tuple of `(MAJOR, MINOR, PATCH)` numbers, which can then be used for Semantic Versioning (where modifications that change the API in a non-backwards compatible way bump the `MAJOR` version (and set the `MINOR` and `PATCH` to 0) and additive changes increase the `MINOR` version (and set the `PATCH` to 0). Changes that have no effect on the external interface (either input or output form) should have their `PATCH` number incremented. This allows for callers of the interface to determine when changes have happened and whether their code will still work with it. Volatility carries out these checks through the requirements system, where a plugin can define what requirements it has. Shared functionality -------------------- -Within a plugin, there may be functions that are useful to other plugins. These are created as `classmethod`s -so that the plugin can be depended upon by other plugins in their requirements section, without needing to -instantiate a whole copy of the plugin. It is not a staticmethod, because the caller may wish to determine -information about the class the method is defined in, and this is not easily accessible for staticmethods. +Within a plugin, there may be functions that are useful to other plugins. These are created as `classmethod`s so that the plugin can be depended upon by other plugins in their requirements section, without needing to instantiate a whole copy of the plugin. It is not a staticmethod, because the caller may wish to determine information about the class the method is defined in, and this is not easily accessible for staticmethods. +A classmethod usually takes a `context` for its first method (and if it requires one, a configuration string for it second). All other parameters should generally be basic types (such as strings, numbers, etc) so that future work requiring paralellization does not have complex types to have to keep in sync. In particular, the idea was to ensure only one context was used per method (and each object brings its own context with it, meaning the function signature should not include objects to avoid discrepancies). -A classmethod usually takes a `context` for its first method (and if it requires one, a configuration string for -it second). All other parameters should generally be basic types (such as strings, numbers, etc) so that future -work requiring paralellization does not have complex types to have to keep in sync. In particular, the idea was -to ensure only one context was used per method (and each object brings its own context with it, meaning the -function signature should not include objects to avoid discrepancies). +Comprehensions +-------------- + +Comprehensions are allowed, however multiple for clauses or filter expressions are not permitted. Optimize for readability, not conciseness. + +Lambda functions +---------------- + +Okay for one-liners. Prefer generator expressions over map() or filter() with a lambda. + +Default Arguments +----------------- + +Default arguments are fine, but not with mutable types (because they're consructed once at module load time and can lead to confusion/errors.) + +True/False Evaluations +---------------------- + +Use the “implicit” false if possible, e.g., if foo: rather than if foo != []:. There are a few caveats that you should keep in mind though: + + * Always use `if foo is None:` (or `is not None`) to check for a `None` value. E.g., when testing whether a variable or argument that defaults to `None` was set to some other value. The other value might be a value that’s false in a boolean context! + * Never compare a boolean variable to `False` using `==`. Use `if not x:` instead. If you need to distinguish `False` from `None` then chain the expressions, such as `if not x and x is not None:`. + * For sequences (strings, lists, tuples), use the fact that empty sequences are false, so `if seq:` and `if not seq:` are preferable to `if len(seq):` and `if not len(seq):` respectively. + +Logging +------- + +We do allow f-string usage in log messages, although technically it should be avoided since it will be evaluated even if the log message is never emitted. From 8b31ae612f8458e349cf0a063a578b97ec7ef8e9 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 27 Jan 2025 09:32:33 +0000 Subject: [PATCH 0484/1352] Layers: Make the low-stub method less brittle --- volatility3/framework/automagic/pdbscan.py | 64 ++++++++++++---------- 1 file changed, 34 insertions(+), 30 deletions(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index f9c0d853d..dd2ad0683 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -392,38 +392,42 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): # Try locating kernel base via x64 Low Stub in lower 1MB starting from second page (4KB) # If "Discard Low Memory" setting is disabled in BIOS, the Low Stub may be at the third/fourth or further pages for offset in range(0x1000, 0x100000, 0x1000): - jmp_and_completion_values = int.from_bytes( - physical_layer.read(offset, 0x8), "little" - ) - if ( - 0xFFFFFFFFFFFF00FF & jmp_and_completion_values - != constants.windows.JMP_AND_COMPLETION_SIGNATURE - ): - continue - cr3_value = int.from_bytes( - physical_layer.read( - offset + constants.windows.PROCESSOR_START_BLOCK_CR3_OFFSET, 0x8 - ), - "little", - ) + try: + jmp_and_completion_values = int.from_bytes( + physical_layer.read(offset, 0x8), "little" + ) + if ( + 0xFFFFFFFFFFFF00FF & jmp_and_completion_values + != constants.windows.JMP_AND_COMPLETION_SIGNATURE + ): + continue + cr3_value = int.from_bytes( + physical_layer.read( + offset + constants.windows.PROCESSOR_START_BLOCK_CR3_OFFSET, 0x8 + ), + "little", + ) - # Compare previously observed valid page table address that's stored in vlayer._initial_entry - # with PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3 - # which was observed to be an invalid page address, so add 1 (to make it valid too) - if (cr3_value + 1) != vlayer._initial_entry: + # Compare previously observed valid page table address that's stored in vlayer._initial_entry + # with PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3 + # which was observed to be an invalid page address, so add 1 (to make it valid too) + if (cr3_value + 1) != vlayer._initial_entry: + continue + potential_kernel_hint = int.from_bytes( + physical_layer.read( + offset + + constants.windows.PROCESSOR_START_BLOCK_LM_TARGET_OFFSET, + 0x8, + ), + "little", + ) + if 0x3 & potential_kernel_hint: + continue + kernel_hint = potential_kernel_hint & 0xFFFFFFFFFFFF + kernel_base = kernel_hint & (~0x1FFFFF) & 0xFFFFFFFFFFFF + break + except exceptions.InvalidAddressException: continue - potential_kernel_hint = int.from_bytes( - physical_layer.read( - offset + constants.windows.PROCESSOR_START_BLOCK_LM_TARGET_OFFSET, - 0x8, - ), - "little", - ) - if 0x3 & potential_kernel_hint: - continue - kernel_hint = potential_kernel_hint & 0xFFFFFFFFFFFF - kernel_base = kernel_hint & (~0x1FFFFF) & 0xFFFFFFFFFFFF - break if kernel_base: # Scanning 32mb in 2mb chunks for the 'ntoskrnl' base address From 22a2fe17d8d82e7eaf02f1338c73f3b8f4408e15 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 11:03:08 +0100 Subject: [PATCH 0485/1352] clarify generator variable --- volatility3/framework/plugins/linux/tracing/ftrace.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 6e1a4e470..629f1bab8 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -214,7 +214,10 @@ if the "hidden_modules" key is present in known_modules. # Determine the symbols associated with a hook hooked_symbols = kernel.get_symbols_by_absolute_location(hook_address) hooked_symbols = ",".join( - [s.split(constants.BANG)[-1] for s in hooked_symbols] + [ + hooked_symbol.split(constants.BANG)[-1] + for hooked_symbol in hooked_symbols + ] ) yield ParsedFtraceOps( ftrace_ops.vol.offset, From 03cf84f9cff90aaa135190b025e28fe436fff69e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 11:05:08 +0100 Subject: [PATCH 0486/1352] assign kernel layer to variable early --- volatility3/framework/plugins/linux/tracing/ftrace.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 629f1bab8..99961c931 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -150,6 +150,7 @@ if the "hidden_modules" key is present in known_modules. An iterable of ParsedFtraceOps dataclasses, containing a selection of useful fields (callback, hook, module) related to an ftrace_ops struct """ kernel = context.modules[kernel_name] + kernel_layer = context.layers[kernel.layer_name] callback = ftrace_ops.func callback_symbol = module_address = module_name = None @@ -170,7 +171,7 @@ if the "hidden_modules" key is present in known_modules. "A callback module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", ) known_modules_addresses = set( - context.layers[kernel.layer_name].canonicalize(module.vol.offset) + kernel_layer.canonicalize(module.vol.offset) for module in modxview.Modxview.flatten_run_modules_results( known_modules ) From 9d11c1f460844eb25f60c038a4bc81a0e78be5c9 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 11:50:28 +0100 Subject: [PATCH 0487/1352] prevent modules memory space overlap scenario --- .../symbols/linux/utilities/modules.py | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index f529a61ae..baaeff683 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -1,3 +1,4 @@ +import warnings from typing import Iterable, Iterator, List, Optional, Tuple from volatility3 import framework @@ -31,12 +32,29 @@ class Modules(interfaces.configuration.VersionableInterface): layer_name: The name of the layer on which to operate modules: An iterable containing the modules to match the address against target_address: The address to check for a match - """ + Returns: + The first memory module in which the address fits + """ + matches = [] + seen_addresses = set() for module in modules: _, start, end = cls.mask_mods_list(context, layer_name, [module])[0] - if start <= target_address <= end: - return module + if ( + start <= target_address <= end + and module.vol.offset not in seen_addresses + ): + matches.append(module) + seen_addresses.add(module.vol.offset) + + if len(matches) > 1: + warnings.warn( + f"Address {hex(target_address)} fits in modules at {[hex(module.vol.offset) for module in matches]}, indicating potential modules memory space overlap.", + UserWarning, + ) + return matches[0] + elif len(matches) == 1: + return matches[0] return None From 7d14f4c778d1f624a35a6db103f99b9c00cfd8b0 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 14:57:39 +0100 Subject: [PATCH 0488/1352] remove additional_description in favor of the docstring implementation --- volatility3/framework/interfaces/plugins.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility3/framework/interfaces/plugins.py b/volatility3/framework/interfaces/plugins.py index 7ad78d0ba..f763815a6 100644 --- a/volatility3/framework/interfaces/plugins.py +++ b/volatility3/framework/interfaces/plugins.py @@ -112,8 +112,6 @@ class PluginInterface( # Be careful with inheritance around this (We default to requiring a version which doesn't exist, so it must be set) _required_framework_version: Tuple[int, int, int] = (0, 0, 0) """The _version variable is a quick way for plugins to define their current interface, it should follow SemVer rules""" - additional_description: str = None - """Display additional description of the plugin after the description of the arguments. See: https://docs.python.org/3/library/argparse.html#epilog""" def __init__( self, From d2859f2390070111f42e470dc9e1c6d6ad38a802 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 15:00:03 +0100 Subject: [PATCH 0489/1352] remove additional_description in favor of the docstring implementation --- volatility3/cli/__init__.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index b57d9a3f3..020dac2d2 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -363,11 +363,20 @@ class CommandLine: metavar="PLUGIN", ) for plugin in sorted(plugin_list): + # First line of a plugin docstring will be the short description for -h + # Following lines will be the additional description (argparse epilog) + short_help = additional_help = None + if plugin_list[plugin].__doc__ is not None: + doc_split = plugin_list[plugin].__doc__.strip().split("\n", 1) + short_help = doc_split[0] + if len(doc_split) > 1: + additional_help = doc_split[1].strip() + plugin_parser = subparser.add_parser( plugin, - help=plugin_list[plugin].__doc__, - description=plugin_list[plugin].__doc__, - epilog=plugin_list[plugin].additional_description, + help=short_help, + description=short_help, + epilog=additional_help, ) self.populate_requirements_argparse(plugin_parser, plugin_list[plugin]) From 08f03642807056c0f3857eaa78cd4053fc7f391b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 15:02:02 +0100 Subject: [PATCH 0490/1352] adapt plugins docstring to fit short and additional help format --- volatility3/framework/plugins/configwriter.py | 4 ++-- volatility3/framework/plugins/linux/modxview.py | 4 ++-- volatility3/framework/plugins/linux/pstree.py | 3 +-- volatility3/framework/plugins/mac/mount.py | 4 ++-- volatility3/framework/plugins/mac/pstree.py | 3 +-- volatility3/framework/plugins/timeliner.py | 4 ++-- volatility3/framework/plugins/windows/pstree.py | 3 +-- volatility3/framework/plugins/windows/psxview.py | 7 ++++--- volatility3/framework/plugins/windows/registry/hivescan.py | 3 +-- volatility3/framework/plugins/windows/scheduled_tasks.py | 5 ++--- 10 files changed, 18 insertions(+), 22 deletions(-) diff --git a/volatility3/framework/plugins/configwriter.py b/volatility3/framework/plugins/configwriter.py index eca01a84a..a567a6acd 100644 --- a/volatility3/framework/plugins/configwriter.py +++ b/volatility3/framework/plugins/configwriter.py @@ -14,8 +14,8 @@ vollog = logging.getLogger(__name__) class ConfigWriter(plugins.PluginInterface): - """Runs the automagics and both prints and outputs configuration in the - output directory.""" + """Runs the automagics and both prints and outputs configuration in the \ +output directory.""" _required_framework_version = (2, 0, 0) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index c74bf28e8..0dd503829 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -15,8 +15,8 @@ vollog = logging.getLogger(__name__) class Modxview(interfaces.plugins.PluginInterface): - """Centralize lsmod, check_modules and hidden_modules results to efficiently - spot modules presence and taints.""" + """Centralize lsmod, check_modules and hidden_modules results to efficiently \ +spot modules presence and taints.""" _version = (1, 0, 0) _required_framework_version = (2, 17, 0) diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index 74e172139..fd28fcbbd 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -9,8 +9,7 @@ from volatility3.plugins.linux import pslist class PsTree(interfaces.plugins.PluginInterface): - """Plugin for listing processes in a tree based on their parent process - ID.""" + """Plugin for listing processes in a tree based on their parent process ID.""" _required_framework_version = (2, 13, 0) _version = (1, 1, 1) diff --git a/volatility3/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py index 1a1e33571..0f3aa745c 100644 --- a/volatility3/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -11,8 +11,8 @@ from volatility3.framework.symbols import mac class Mount(plugins.PluginInterface): - """A module containing a collection of plugins that produce data typically - found in Mac's mount command""" + """A module containing a collection of plugins that produce data typically \ +found in Mac's mount command""" _required_framework_version = (2, 0, 0) diff --git a/volatility3/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py index e62d5eb72..ad5bb309b 100644 --- a/volatility3/framework/plugins/mac/pstree.py +++ b/volatility3/framework/plugins/mac/pstree.py @@ -10,8 +10,7 @@ from volatility3.plugins.mac import pslist class PsTree(plugins.PluginInterface): - """Plugin for listing processes in a tree based on their parent process - ID.""" + """Plugin for listing processes in a tree based on their parent process ID.""" _required_framework_version = (2, 0, 0) diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index 0f4064d79..6000704eb 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -41,8 +41,8 @@ class TimeLinerInterface(metaclass=abc.ABCMeta): class Timeliner(interfaces.plugins.PluginInterface): - """Runs all relevant plugins that provide time related information and - orders the results by time.""" + """Runs all relevant plugins that provide time related information and \ +orders the results by time.""" _required_framework_version = (2, 0, 0) _version = (1, 1, 0) diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 2be96277c..4f3fe0455 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -14,8 +14,7 @@ vollog = logging.getLogger(__name__) class PsTree(interfaces.plugins.PluginInterface): - """Plugin for listing processes in a tree based on their parent process - ID.""" + """Plugin for listing processes in a tree based on their parent process ID.""" _required_framework_version = (2, 0, 0) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index b5ddd2ee5..aa379bdc5 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -21,9 +21,10 @@ vollog = logging.getLogger(__name__) class PsXView(plugins.PluginInterface): - """Lists all processes found via four of the methods described in \"The Art of Memory Forensics,\" which may help - identify processes that are trying to hide themselves. I recommend using -r pretty if you are looking at this - plugin's output in a terminal.""" + """Lists all processes found via four of the methods described in \"The Art of Memory Forensics\" which may help \ +identify processes that are trying to hide themselves. + +We recommend using -r pretty if you are looking at this plugin's output in a terminal.""" # I've omitted the desktop thread scanning method because Volatility3 doesn't appear to have the functionality # which the original plugin used to do it. diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index 7b3c0b622..6e0171a78 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -12,8 +12,7 @@ from volatility3.plugins.windows import poolscanner, bigpools class HiveScan(interfaces.plugins.PluginInterface): - """Scans for registry hives present in a particular windows memory - image.""" + """Scans for registry hives present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 6dd5613c4..31aaec4f0 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -1099,9 +1099,8 @@ class DynamicInfo: class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): - """Decodes scheduled task information from the Windows registry, including - information about triggers, actions, run times, and creation times. - """ + """Decodes scheduled task information from the Windows registry, including \ +information about triggers, actions, run times, and creation times.""" _required_framework_version = (2, 11, 0) _version = (1, 0, 0) From f64291faec4991bbe13f0e5cda655ae463b1f3bb Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 17:44:18 +0100 Subject: [PATCH 0491/1352] split help on two consecutive newlines --- volatility3/cli/__init__.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 020dac2d2..a41cf95a3 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -363,12 +363,13 @@ class CommandLine: metavar="PLUGIN", ) for plugin in sorted(plugin_list): - # First line of a plugin docstring will be the short description for -h - # Following lines will be the additional description (argparse epilog) + # First line of a plugin docstring will be the short description for -h. + # Text after the first two consecutive new lines will be + # the additional description (argparse epilog). short_help = additional_help = None if plugin_list[plugin].__doc__ is not None: - doc_split = plugin_list[plugin].__doc__.strip().split("\n", 1) - short_help = doc_split[0] + doc_split = plugin_list[plugin].__doc__.split("\n\n", 1) + short_help = doc_split[0].strip() if len(doc_split) > 1: additional_help = doc_split[1].strip() From c000e812a6a402ea7380cdd817f6d95ad6619366 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 27 Jan 2025 19:40:47 +0100 Subject: [PATCH 0492/1352] tune with the new additional_description mechanism --- volatility3/framework/plugins/linux/tracing/ftrace.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 99961c931..29216187c 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -62,12 +62,13 @@ class ParsedFtraceOps: class CheckFtrace(interfaces.plugins.PluginInterface): - """Detect ftrace hooking""" + """Detect ftrace hooking + + Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged + to hook kernel functions and modify their behaviour.""" _version = (1, 0, 0) _required_framework_version = (2, 19, 0) - additional_description = """Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged - to hook kernel functions and modify their behaviour.""" @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 105df4e140767045e51c69c9a24ad17d231564bc Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 27 Jan 2025 22:29:59 +0000 Subject: [PATCH 0493/1352] Windows: Fix vadyarascan typo --- volatility3/framework/plugins/windows/vadyarascan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 2e9cc44ea..9758c5994 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -84,7 +84,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): if not vad_maps_to_scan: vollog.warning( - f"No VADs were found for task {task.UniqueProcessID}, not scanning" + f"No VADs were found for task {task.UniqueProcessId}, not scanning" ) continue From 6ef57d1e89b0b7853993600b643c3efeaeede218 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 27 Jan 2025 23:12:28 +0000 Subject: [PATCH 0494/1352] Windows: Allow get_pefile_obj to be shared --- .../framework/plugins/windows/pe_symbols.py | 9 ++-- .../plugins/windows/skeleton_key_check.py | 44 +++---------------- 2 files changed, 12 insertions(+), 41 deletions(-) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 21e657ab3..690e6f6ac 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -244,7 +244,7 @@ class PESymbols(interfaces.plugins.PluginInterface): _required_framework_version = (2, 7, 0) - _version = (1, 0, 0) + _version = (1, 1, 0) # used for special handling of the kernel PDB file. See later notes os_module_name = "ntoskrnl.exe" @@ -292,8 +292,9 @@ class PESymbols(interfaces.plugins.PluginInterface): ), ] - @staticmethod - def _get_pefile_obj( + @classmethod + def get_pefile_obj( + cls, context: interfaces.context.ContextInterface, pe_table_name: str, layer_name: str, @@ -484,7 +485,7 @@ class PESymbols(interfaces.plugins.PluginInterface): module_start = module_info[1] # we need a valid PE with an export table - pe_module = PESymbols._get_pefile_obj( + pe_module = PESymbols.get_pefile_obj( context, pe_table_name, layer_name, module_start ) if not pe_module: diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index 6ae07381a..d7bd02683 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -26,7 +26,7 @@ from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import pdbutil from volatility3.framework.symbols.windows.extensions import pe -from volatility3.plugins.windows import pslist, vadinfo +from volatility3.plugins.windows import pslist, vadinfo, pe_symbols try: import capstone @@ -61,43 +61,11 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) ), + requirements.VersionRequirement( + name="pe_symbols", component=pe_symbols.PESymbols, version=(1, 1, 0) + ), ] - def _get_pefile_obj( - self, pe_table_name: str, layer_name: str, base_address: int - ) -> pefile.PE: - """ - Attempts to pefile object from the bytes of the PE file - - Args: - pe_table_name: name of the pe types table - layer_name: name of the lsass.exe process layer - base_address: base address of cryptdll.dll in lsass.exe - - Returns: - the constructed pefile object - """ - pe_data = io.BytesIO() - - try: - dos_header = self.context.object( - pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", - offset=base_address, - layer_name=layer_name, - ) - - for offset, data in dos_header.reconstruct(): - pe_data.seek(offset) - pe_data.write(data) - - pe_ret = pefile.PE(data=pe_data.getvalue(), fast_load=True) - - except exceptions.InvalidAddressException: - vollog.debug("Unable to reconstruct cryptdll.dll in memory") - pe_ret = None - - return pe_ret - def _check_for_skeleton_key_vad( self, csystem: interfaces.objects.ObjectInterface, @@ -497,7 +465,9 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): self.context, self.config_path, "windows", "pe", class_types=pe.class_types ) - cryptdll = self._get_pefile_obj(pe_table_name, proc_layer_name, cryptdll_base) + cryptdll = pe_symbols.PESymbols.get_pefile_obj( + self.context, pe_table_name, proc_layer_name, cryptdll_base + ) if not cryptdll: return None From 10743b101929cea944197996feead44d4d81fd98 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 27 Jan 2025 23:14:02 +0000 Subject: [PATCH 0495/1352] Windows: Fix ruff issues in skeleton_key_check --- volatility3/framework/plugins/windows/skeleton_key_check.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index d7bd02683..ce5bb41f4 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -11,14 +11,13 @@ # # https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html -import io import logging from typing import Iterable, Tuple, List, Optional import pefile from volatility3.framework import interfaces, symbols, exceptions -from volatility3.framework import renderers, constants +from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.layers import scanners from volatility3.framework.objects import utility From b055848576697547fc2bc139738f7c3a4d70fa13 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 29 Jan 2025 12:04:32 +0100 Subject: [PATCH 0496/1352] explicit powers of two instead of auto() --- .../framework/plugins/linux/tracing/ftrace.py | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 29216187c..da88d1de1 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -6,7 +6,7 @@ import logging from typing import Dict, List, Iterable, Optional -from enum import auto, IntFlag +from enum import IntFlag from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules @@ -26,25 +26,25 @@ class FtraceOpsFlags(IntFlag): Based on https://elixir.bootlin.com/linux/v6.13-rc3/source/include/linux/ftrace.h#L255. """ - FTRACE_OPS_FL_ENABLED = auto() - FTRACE_OPS_FL_DYNAMIC = auto() - FTRACE_OPS_FL_SAVE_REGS = auto() - FTRACE_OPS_FL_SAVE_REGS_IF_SUPPORTED = auto() - FTRACE_OPS_FL_RECURSION = auto() - FTRACE_OPS_FL_STUB = auto() - FTRACE_OPS_FL_INITIALIZED = auto() - FTRACE_OPS_FL_DELETED = auto() - FTRACE_OPS_FL_ADDING = auto() - FTRACE_OPS_FL_REMOVING = auto() - FTRACE_OPS_FL_MODIFYING = auto() - FTRACE_OPS_FL_ALLOC_TRAMP = auto() - FTRACE_OPS_FL_IPMODIFY = auto() - FTRACE_OPS_FL_PID = auto() - FTRACE_OPS_FL_RCU = auto() - FTRACE_OPS_FL_TRACE_ARRAY = auto() - FTRACE_OPS_FL_PERMANENT = auto() - FTRACE_OPS_FL_DIRECT = auto() - FTRACE_OPS_FL_SUBOP = auto() + FTRACE_OPS_FL_ENABLED = 1 << 0 + FTRACE_OPS_FL_DYNAMIC = 1 << 1 + FTRACE_OPS_FL_SAVE_REGS = 1 << 2 + FTRACE_OPS_FL_SAVE_REGS_IF_SUPPORTED = 1 << 3 + FTRACE_OPS_FL_RECURSION = 1 << 4 + FTRACE_OPS_FL_STUB = 1 << 5 + FTRACE_OPS_FL_INITIALIZED = 1 << 6 + FTRACE_OPS_FL_DELETED = 1 << 7 + FTRACE_OPS_FL_ADDING = 1 << 8 + FTRACE_OPS_FL_REMOVING = 1 << 9 + FTRACE_OPS_FL_MODIFYING = 1 << 10 + FTRACE_OPS_FL_ALLOC_TRAMP = 1 << 11 + FTRACE_OPS_FL_IPMODIFY = 1 << 12 + FTRACE_OPS_FL_PID = 1 << 13 + FTRACE_OPS_FL_RCU = 1 << 14 + FTRACE_OPS_FL_TRACE_ARRAY = 1 << 15 + FTRACE_OPS_FL_PERMANENT = 1 << 16 + FTRACE_OPS_FL_DIRECT = 1 << 17 + FTRACE_OPS_FL_SUBOP = 1 << 18 @dataclass From 74a834b6de089a0ba8cca62d9e86314996faa9fb Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 09:22:58 +1100 Subject: [PATCH 0497/1352] linux: vfsmount: improve kernel implementation detection --- volatility3/framework/symbols/linux/extensions/__init__.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index f612dfc3b..ec79b0203 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1575,13 +1575,11 @@ class vfsmount(objects.StructType): # the 'mnt_parent' member was relocated from the 'vfsmount' struct to the newly # introduced 'mount' struct. - Alternatively, vmlinux.has_type('mount') can be used here but it is faster. - Returns: 'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3. """ - return self.has_member("mnt_parent") + return not self._context.symbol_space.has_type("mount") def is_equal(self, vfsmount_ptr) -> bool: """Helper to make sure it is comparing two pointers to 'vfsmount'. From 53364f7dab197b4d3b83de259cc7ff632016e8ad Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 10:41:00 +1100 Subject: [PATCH 0498/1352] linux: LinuxUtilities: Revert do_get_path() typing --- volatility3/framework/symbols/linux/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 4634a2bfb..af0697c10 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -6,7 +6,7 @@ import contextlib import functools import logging from abc import ABC, abstractmethod -from typing import Iterator, List, Tuple, Optional +from typing import Iterator, List, Tuple, Optional, Union import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3 import framework @@ -133,7 +133,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return cls.do_get_path(rdentry, rmnt, dentry, vfsmnt) @classmethod - def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> str: + def do_get_path(cls, rdentry, rmnt, dentry, vfsmnt) -> Union[None, str]: """Returns a pathname of the mount point or file It mimics the Linux kernel prepend_path function. From 3bd1c70a9bc3732bf4ab4131c4ee5170cffaa945 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 11:31:06 +1100 Subject: [PATCH 0499/1352] linux: kmsg plugin: improve return types --- volatility3/framework/plugins/linux/kmsg.py | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index 248e37dd8..a5ce84ae9 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -5,7 +5,7 @@ import re import logging from abc import ABC, abstractmethod from enum import Enum -from typing import Generator, Iterator, List, Tuple +from typing import Generator, Iterator, List, Tuple, Union from volatility3.framework import ( class_subclasses, @@ -135,10 +135,11 @@ class ABCKmsg(ABC): bool: True if the kernel being analyzed fulfill the class requirements. """ - def get_string(self, addr: int, length: int) -> str: + def get_string(self, addr: int, length: int) -> Union[str, None]: layer = self._context.layers[self.layer_name] if not layer.is_valid(addr, length): - return "" + vollog.error("Failed to read log record at address 0x%x", addr) + return None txt = layer.read(addr, length) @@ -268,7 +269,7 @@ class Kmsg_3_5_to_3_11(ABCKmsg): def _get_log_struct_name(self): return "log" - def get_text_from_log(self, msg) -> str: + def get_text_from_log(self, msg) -> Union[str, None]: log_struct_name = self._get_log_struct_name() log_struct_size = self.vmlinux.get_type(log_struct_name).size msg_offset = msg.vol.offset + log_struct_size @@ -277,7 +278,8 @@ class Kmsg_3_5_to_3_11(ABCKmsg): def get_log_lines(self, msg) -> Generator[str, None, None]: if msg.text_len > 0: text = self.get_text_from_log(msg) - yield from text.splitlines() + if text: + yield from text.splitlines() def get_dict_lines(self, msg) -> Generator[str, None, None]: if msg.dict_len == 0: @@ -412,7 +414,7 @@ class Kmsg_5_10_to_(ABCKmsg): def symtab_checks(cls, vmlinux) -> bool: return vmlinux.has_symbol("prb") - def get_text_from_data_ring(self, text_data_ring, desc, info) -> str: + def get_text_from_data_ring(self, text_data_ring, desc, info) -> Union[str, None]: text_data_sz = text_data_ring.size_bits text_data_mask = 1 << text_data_sz @@ -440,7 +442,8 @@ class Kmsg_5_10_to_(ABCKmsg): def get_log_lines(self, text_data_ring, desc, info) -> Generator[str, None, None]: text = self.get_text_from_data_ring(text_data_ring, desc, info) - yield from text.splitlines() + if text: + yield from text.splitlines() def get_dict_lines(self, info) -> Generator[str, None, None]: dict_text = utility.array_to_string(info.dev_info.subsystem) From 4466d9accda1fbb125a34292422b3ad046e5bd2f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 11:47:01 +1100 Subject: [PATCH 0500/1352] linux: kmsg plugin: log warning instead of error --- volatility3/framework/plugins/linux/kmsg.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index a5ce84ae9..849060d3c 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -138,7 +138,7 @@ class ABCKmsg(ABC): def get_string(self, addr: int, length: int) -> Union[str, None]: layer = self._context.layers[self.layer_name] if not layer.is_valid(addr, length): - vollog.error("Failed to read log record at address 0x%x", addr) + vollog.warning("Failed to read log record at address 0x%x", addr) return None txt = layer.read(addr, length) From c2f2fc6b42899c98b2e25700c77fe1152a1ee393 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 18:25:58 +1100 Subject: [PATCH 0501/1352] linux: vmcoreinfo API: fix single letter variable --- volatility3/framework/symbols/linux/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 0a6448528..846928c3a 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -903,7 +903,7 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface): """Converts the input VMCoreInfo data buffer into a dictionary""" # Ensure the whole buffer is printable - if not all(c in string.printable.encode() for c in vmcoreinfo_data): + if not all(char in string.printable.encode() for char in vmcoreinfo_data): # Abort, we are in the wrong place return None From f6a22eed05a7ba3784df47df77c0d8f8643e9f8c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 18:44:18 +1100 Subject: [PATCH 0502/1352] linux: vmcoreinfo API: significantly improve the performance when validating each character, from O(n) to O(1).. where n is 100 chars long --- volatility3/framework/symbols/linux/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 846928c3a..afdfee39c 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -903,7 +903,8 @@ class VMCoreInfo(interfaces.configuration.VersionableInterface): """Converts the input VMCoreInfo data buffer into a dictionary""" # Ensure the whole buffer is printable - if not all(char in string.printable.encode() for char in vmcoreinfo_data): + printable_bytes_set = set(string.printable.encode()) + if not all(byte in printable_bytes_set for byte in vmcoreinfo_data): # Abort, we are in the wrong place return None From 8b6c00e64f016ac5a08a51c4fefe19a78c8c270a Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 18:48:42 +1100 Subject: [PATCH 0503/1352] linux: vmcoreinfo plugin: simplify hex conversion --- volatility3/framework/plugins/linux/vmcoreinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/vmcoreinfo.py b/volatility3/framework/plugins/linux/vmcoreinfo.py index 0f07f8589..658626014 100644 --- a/volatility3/framework/plugins/linux/vmcoreinfo.py +++ b/volatility3/framework/plugins/linux/vmcoreinfo.py @@ -39,7 +39,7 @@ class VMCoreInfo(plugins.PluginInterface): ): for key, value in vmcoreinfo.items(): if key.startswith("SYMBOL(") or key == "KERNELOFFSET": - value = f"0x{value:x}" + value = hex(value) else: value = str(value) From 5d2819a98dccfe7e13dd3c05b93e34a630ff9a2a Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 20:25:22 +1100 Subject: [PATCH 0504/1352] linux: elf: fix imports --- .../framework/symbols/linux/extensions/elf.py | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index c333021d6..969a08a47 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -2,16 +2,11 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Dict, Tuple, Optional import logging +from typing import Dict, Optional, Tuple -from volatility3.framework import constants -from volatility3.framework.constants.linux import ( - ELF_IDENT, - ELF_CLASS, - KSYM_NAME_LEN, -) -from volatility3.framework import objects, interfaces, exceptions +from volatility3.framework import constants, exceptions, interfaces, objects +from volatility3.framework.constants import linux as linux_constants vollog = logging.getLogger(__name__) @@ -64,13 +59,13 @@ class elf(objects.StructType): ei_class = self._context.object( symbol_table_name + constants.BANG + "unsigned char", layer_name=layer_name, - offset=object_info.offset + ELF_IDENT.EI_CLASS, + offset=object_info.offset + linux_constants.ELF_IDENT.EI_CLASS, ) - if ei_class == ELF_CLASS.ELFCLASS32: + if ei_class == linux_constants.ELF_CLASS.ELFCLASS32: self._type_prefix = "Elf32_" self._ei_class_size = 32 - elif ei_class == ELF_CLASS.ELFCLASS64: + elif ei_class == linux_constants.ELF_CLASS.ELFCLASS64: self._type_prefix = "Elf64_" self._ei_class_size = 64 else: From f3095513a14683d4ae8184503621514941fe17ca Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 20:26:51 +1100 Subject: [PATCH 0505/1352] linux: elf_sym: use a class attribute for the symbol max length --- .../framework/symbols/linux/extensions/elf.py | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index 969a08a47..89a421402 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -312,6 +312,8 @@ class elf(objects.StructType): class elf_sym(objects.StructType): """An elf symbol entry""" + _MAX_NAME_LENGTH = linux_constants.KSYM_NAME_LEN + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._cached_strtab = None @@ -324,20 +326,13 @@ class elf_sym(objects.StructType): def cached_strtab(self, cached_strtab): self._cached_strtab = cached_strtab - def get_name(self, max_size=KSYM_NAME_LEN) -> Optional[str]: - """Returns the symbol name - - Args: - max_size: Maximum length for a symbol name string. Defaults to KSYM_NAME_LEN (512 bytes). - - Returns: - The symbol name - """ + def get_name(self) -> Optional[str]: + """Returns the symbol name""" addr = self._cached_strtab + self.st_name layer = self._context.layers[self.vol.layer_name] - name_bytes = layer.read(addr, max_size, pad=True) + name_bytes = layer.read(addr, self._MAX_NAME_LENGTH, pad=True) if not name_bytes: return None From 67a83871adac20171a862d55dcafe5ab383c024b Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 20:54:38 +1100 Subject: [PATCH 0506/1352] linux: module object extension: Add a function to return the extended ELF symbol information (symbol object and its index) so that doesn't change the get_symbols() interface --- .../symbols/linux/extensions/__init__.py | 26 +++++++++++-------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 5f4b7c170..2e06ee687 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -212,14 +212,10 @@ class module(generic.GenericIntelProcess): ) return elf_table_name - def get_symbols( + def get_symbols_ex( self, ) -> Iterable[Tuple[int, interfaces.objects.ObjectInterface]]: - """Get symbols of the module - - Yields: - A tuple containing the ELF symbol index and the corresponding ELF symbol object - """ + """Get ELF symbol objects and their index for this module""" if not self.section_strtab or self.num_symtab < 1: return None @@ -239,10 +235,18 @@ class module(generic.GenericIntelProcess): subtype=sym_type, count=self.num_symtab, ) - for elf_sym_num, elf_sym_obj in enumerate(elf_syms): + for elf_sym_index, elf_sym_obj in enumerate(elf_syms): # Prepare the symbol object for methods like get_name() elf_sym_obj.cached_strtab = self.section_strtab - yield elf_sym_num, elf_sym_obj + yield elf_sym_index, elf_sym_obj + + def get_symbols( + self, + ) -> Iterable[interfaces.objects.ObjectInterface]: + """Get ELF symbol objects for this module""" + + for _elf_sym_index, elf_sym_obj in self.get_symbols_ex(): + yield elf_sym_obj def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module @@ -251,13 +255,13 @@ class module(generic.GenericIntelProcess): A tuple for each symbol containing the symbol name and its corresponding value """ layer = self._context.layers[self.vol.layer_name] - for _sym_num, sym in self.get_symbols(): - sym_name = sym.get_name() + for elf_sym_obj in self.get_symbols(): + sym_name = elf_sym_obj.get_name() if not sym_name: continue # Normalize sym.st_value offset, which is an address pointing to the symbol value - sym_address = sym.st_value & layer.address_mask + sym_address = elf_sym_obj.st_value & layer.address_mask yield (sym_name, sym_address) def get_symbol(self, wanted_sym_name) -> Optional[int]: From 981e09756791f9fab0975f093da87be089a43fda Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Thu, 30 Jan 2025 21:03:33 +1100 Subject: [PATCH 0507/1352] linux: module object extension: Revert the changes to get the ELF symbol index --- .../symbols/linux/extensions/__init__.py | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 2e06ee687..8893e6e52 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -212,10 +212,8 @@ class module(generic.GenericIntelProcess): ) return elf_table_name - def get_symbols_ex( - self, - ) -> Iterable[Tuple[int, interfaces.objects.ObjectInterface]]: - """Get ELF symbol objects and their index for this module""" + def get_symbols(self) -> Iterable[interfaces.objects.ObjectInterface]: + """Get ELF symbol objects for this module""" if not self.section_strtab or self.num_symtab < 1: return None @@ -235,17 +233,9 @@ class module(generic.GenericIntelProcess): subtype=sym_type, count=self.num_symtab, ) - for elf_sym_index, elf_sym_obj in enumerate(elf_syms): + for elf_sym_obj in elf_syms: # Prepare the symbol object for methods like get_name() elf_sym_obj.cached_strtab = self.section_strtab - yield elf_sym_index, elf_sym_obj - - def get_symbols( - self, - ) -> Iterable[interfaces.objects.ObjectInterface]: - """Get ELF symbol objects for this module""" - - for _elf_sym_index, elf_sym_obj in self.get_symbols_ex(): yield elf_sym_obj def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: From d3e55db41d903a65bbe0ed921da3530c1da04b4a Mon Sep 17 00:00:00 2001 From: ikelos Date: Thu, 30 Jan 2025 11:04:58 +0000 Subject: [PATCH 0508/1352] Apply suggestions from code review Hopefully I can fix up my breakage... --- volatility3/framework/symbols/linux/extensions/__init__.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index e886fc88f..dac7f5a5e 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2173,8 +2173,7 @@ class sock(objects.StructType): return linux_constants.SOCK_FAMILY[family_idx] def get_type(self): - return linux_constants. - .get(self.sk_type, "") + return linux_constants.SOCK_TYPES.get(self.sk_type, "") def get_inode(self): if not self.sk_socket: From f6106c8f19dea8e9e3880828189b8e22b7d47b45 Mon Sep 17 00:00:00 2001 From: ikelos Date: Thu, 30 Jan 2025 11:10:36 +0000 Subject: [PATCH 0509/1352] Apply suggestions from code review Try to patch up ruff failures through suggestions. --- volatility3/framework/constants/linux/__init__.py | 6 +++--- volatility3/framework/symbols/linux/extensions/__init__.py | 5 ++--- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 0eef611d0..c357916cb 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -317,7 +317,7 @@ NET_DEVICE_FLAGS = { # Kernels >= 2.6.17. See IF_OPER_* in include/uapi/linux/if.h -class IF_OPER_STATES(Enum): +class IF_OPER_STATES(enum.Enum): """RFC 2863 - Network interface operational status""" UNKNOWN = 0 @@ -328,7 +328,7 @@ class IF_OPER_STATES(Enum): DORMANT = 5 UP = 6 -class ELF_IDENT(IntEnum): +class ELF_IDENT(enum.IntEnum): """ELF header e_ident indexes""" EI_MAG0 = 0 @@ -459,4 +459,4 @@ Documentation : - https://www.kernel.org/doc/Documentation/admin-guide/tainted-kernels.rst#:~:text=More%20detailed%20explanation%20for%20tainting - taint_flag kernel struct - taint_flags kernel constant -""" \ No newline at end of file +""" diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index dac7f5a5e..fd294d51b 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2053,8 +2053,7 @@ class inet6_dev(objects.StructType): return # 'if_list' member was added to 'inet6_ifaddr' type in kernels 3.0 - for inet6_ifaddr in self.addr_list.to_list(inet6_ifaddr_symname, "if_list"): - yield inet6_ifaddr + yield from self.addr_list.to_list(inet6_ifaddr_symname, "if_list"): class in_ifaddr(objects.StructType): @@ -2112,7 +2111,7 @@ class inet6_ifaddr(objects.StructType): return "host" elif (self.scope & linux_constants.IFA_LINK) != 0: return "link" - elif (self.scope & linuc_constants.IFA_SITE) != 0: + elif (self.scope & linux_constants.IFA_SITE) != 0: return "site" else: return "global" From f83386f19b8cc3b64923ddfd3f3ae0fb83287a61 Mon Sep 17 00:00:00 2001 From: ikelos Date: Thu, 30 Jan 2025 11:13:25 +0000 Subject: [PATCH 0510/1352] Update volatility3/framework/symbols/linux/extensions/__init__.py My bad, little typo when trying to fix it last time --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index fd294d51b..7f6273719 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2053,7 +2053,7 @@ class inet6_dev(objects.StructType): return # 'if_list' member was added to 'inet6_ifaddr' type in kernels 3.0 - yield from self.addr_list.to_list(inet6_ifaddr_symname, "if_list"): + yield from self.addr_list.to_list(inet6_ifaddr_symname, "if_list") class in_ifaddr(objects.StructType): From 9218e0e07f92ffb61b17f14336f36440092c1083 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 31 Jan 2025 18:47:11 +1100 Subject: [PATCH 0511/1352] fix double null-termination search --- volatility3/framework/objects/__init__.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index 869d4dae6..39ce6f59f 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -356,8 +356,9 @@ class String(PrimitiveObject, str): ), **params, ) - if value.find("\x00") >= 0: - value = value[: value.find("\x00")] + index = value.find("\x00") + if index >= 0: + value = value[:index] return value class VolTemplateProxy(interfaces.objects.ObjectInterface.VolTemplateProxy): From b91724c3ef7a5fa22f639a6c495afdce736ee5d9 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 31 Jan 2025 18:48:52 +1100 Subject: [PATCH 0512/1352] Replace *_to_string() for a block reader implementation for better performance. Add new address_to_string() helper --- volatility3/framework/objects/utility.py | 102 +++++++++++++++++++++-- 1 file changed, 94 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 0bc285517..dc450c0b3 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -29,9 +29,23 @@ def bswap_64(value: int) -> int: def array_to_string( - array: "objects.Array", count: Optional[int] = None, errors: str = "replace" -) -> interfaces.objects.ObjectInterface: - """Takes a volatility Array of characters and returns a string.""" + array: "objects.Array", + count: Optional[int] = None, + errors: str = "replace", + block_size=32, +) -> str: + """Takes a Volatility 'Array' of characters and returns a Python string. + + Args: + array: The Volatility `Array` object containing character elements. + count: Optional maximum number of characters to convert. If None, the function + processes the entire array. + errors: Specifies error handling behavior for decoding, defaulting to "replace". + block_size: Reading block size. Defaults to 32 + + Returns: + A decoded string representation of the character array. + """ # TODO: Consider checking the Array's target is a native char if not isinstance(array, objects.Array): raise TypeError("Array_to_string takes an Array of char") @@ -39,19 +53,91 @@ def array_to_string( if count is None: count = array.vol.count - return array.cast("string", max_length=count, errors=errors) + return address_to_string( + context=array._context, + layer_name=array.vol.layer_name, + address=array.vol.offset, + count=count, + errors=errors, + block_size=block_size, + ) -def pointer_to_string(pointer: "objects.Pointer", count: int, errors: str = "replace"): - """Takes a volatility Pointer to characters and returns a string.""" +def pointer_to_string( + pointer: "objects.Pointer", + count: int, + errors: str = "replace", + block_size=32, +) -> str: + """Takes a Volatility 'Pointer' to characters and returns a Python string. + + Args: + pointer: A `Pointer` object containing character elements. + count: Optional maximum number of characters to convert. If None, the function + processes the entire array. + errors: Specifies error handling behavior for decoding, defaulting to "replace". + block_size: Reading block size. Defaults to 32 + + Returns: + A decoded string representation of the data referenced by the pointer. + """ if not isinstance(pointer, objects.Pointer): raise TypeError("pointer_to_string takes a Pointer") if count < 1: raise ValueError("pointer_to_string requires a positive count") - char = pointer.dereference() - return char.cast("string", max_length=count, errors=errors) + return address_to_string( + context=pointer._context, + layer_name=pointer.vol.layer_name, + address=pointer, + count=count, + errors=errors, + block_size=block_size, + ) + + +def address_to_string( + context: interfaces.context.ContextInterface, + layer_name: str, + address: int, + count: int, + errors: str = "replace", + block_size=32, +) -> str: + """Reads a null-terminated string from a given specified memory address, processing + it in blocks for efficiency. + + Args: + context: The context used to retrieve memory layers and symbol tables + layer_name: The name of the memory layer to read from + address: The address where the string is located in memory + count: The number of bytes to read + errors: The error handling scheme to use for encoding errors. Defaults to "replace" + block_size: Reading block size. Defaults to 32 + + Returns: + The decoded string extracted from memory. + """ + if not isinstance(address, int): + raise TypeError("It takes an int") + + if count < 1: + raise ValueError("It requires a positive count") + + layer = context.layers[layer_name] + text = b"" + while len(text) <= count: + current_block_size = min(count - len(text), block_size) + temp_text = layer.read(address + len(text), current_block_size) + idx = temp_text.find(b"\x00") + if idx != -1: + temp_text = temp_text[:idx] + text += temp_text + break + text += temp_text + + return text.decode(errors=errors) def array_of_pointers( From c82ef0cfd2a34873b989cdc87afed5783c92d34b Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 31 Jan 2025 19:29:33 +1100 Subject: [PATCH 0513/1352] intel: address translation: performance improvements caching by page address --- volatility3/framework/layers/intel.py | 44 +++++++++++++++++++++------ 1 file changed, 34 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 7c2c72ac1..b6f59fee1 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -186,6 +186,31 @@ class Intel(linear.LinearlyMappedLayer): Returns the translated entry value """ + offset &= self.address_mask + + if not (self.minimum_address <= offset <= self.maximum_address): + raise exceptions.InvalidAddressException( + offset, f"Address {offset:#x} outside virtual address range" + ) + + page_address = offset & self.page_mask + return self._translate_page(page_address) + + @functools.lru_cache(maxsize=1024) + def _translate_page(self, page_address: int) -> int: + """Translates a page address based on paging tables. + + Args: + page_address: The page base address + + Returns: + the translated entry value + """ + if page_address & ~self.page_mask != 0: + raise exceptions.InvalidAddressException( + page_address, + f"Invalid page address {page_address:#x}. The address must be aligned to the page size", + ) # Setup the entry and how far we are through the offset # Position maintains the number of bits left to process # We or with 0x1 to ensure our page_map_offset is always valid @@ -193,11 +218,13 @@ class Intel(linear.LinearlyMappedLayer): entry = self._initial_entry if not ( - self.minimum_address <= (offset & self.address_mask) <= self.maximum_address + self.minimum_address + <= (page_address & self.address_mask) + <= self.maximum_address ): raise exceptions.PagedInvalidAddressException( self.name, - offset, + page_address, position + 1, entry, "Entry outside virtual address range: " + hex(entry), @@ -209,7 +236,7 @@ class Intel(linear.LinearlyMappedLayer): if not self._page_is_valid(entry): raise exceptions.PagedInvalidAddressException( self.name, - offset, + page_address, position + 1, entry, "Page Fault at entry " + hex(entry) + " in table " + name, @@ -225,7 +252,7 @@ class Intel(linear.LinearlyMappedLayer): # Figure out how much of the offset we should be using start = position position -= size - index = self._mask(offset, start, position + 1) >> (position + 1) + index = self._mask(page_address, start, position + 1) >> (position + 1) # Grab the base address of the table we'll be getting the next entry from base_address = self._mask( @@ -236,17 +263,15 @@ class Intel(linear.LinearlyMappedLayer): if table is None: raise exceptions.PagedInvalidAddressException( self.name, - offset, + page_address, position + 1, entry, "Page Fault at entry " + hex(entry) + " in table " + name, ) # Read the data for the next entry - entry_data = table[ - (index << self._index_shift) : (index << self._index_shift) - + self._entry_size - ] + entry_data_start = index << self._index_shift + entry_data = table[entry_data_start : entry_data_start + self._entry_size] if INTEL_TRANSLATION_DEBUGGING: vollog.log( @@ -259,7 +284,6 @@ class Intel(linear.LinearlyMappedLayer): return entry, position - @functools.lru_cache(maxsize=1025) def _get_valid_table(self, base_address: int) -> Optional[bytes]: """Extracts the table, validates it and returns it if it's valid.""" table = self._context.layers.read( From 815b2fe918241ab2847512cfc7e9980b0a9e50ed Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Fri, 31 Jan 2025 19:49:04 +1100 Subject: [PATCH 0514/1352] Fix bug in address_to_string() helper --- volatility3/framework/objects/utility.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index dc450c0b3..93216743c 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -127,7 +127,7 @@ def address_to_string( layer = context.layers[layer_name] text = b"" - while len(text) <= count: + while len(text) < count: current_block_size = min(count - len(text), block_size) temp_text = layer.read(address + len(text), current_block_size) idx = temp_text.find(b"\x00") From 68c8b2389a7373d321afabe24f035024add1d012 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 31 Jan 2025 10:00:16 +0000 Subject: [PATCH 0515/1352] Make error messages a little more descriptive --- volatility3/framework/objects/utility.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 93216743c..500c0e9a5 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -120,10 +120,10 @@ def address_to_string( The decoded string extracted from memory. """ if not isinstance(address, int): - raise TypeError("It takes an int") + raise TypeError("Address must be a valid integer") if count < 1: - raise ValueError("It requires a positive count") + raise ValueError("Count must be greater than 0") layer = context.layers[layer_name] text = b"" From e9d1831a7cbc7dd27e60d4d772a09a6df4e767c5 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 31 Jan 2025 14:45:28 +0000 Subject: [PATCH 0516/1352] Windows: update get_commit_charge with CommitCharge fix by BeanBagKing --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index ff6d14a8c..26007a37a 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -262,7 +262,10 @@ class MMVAD_SHORT(objects.StructType): def get_commit_charge(self): """Get the VAD's commit charge (number of committed pages)""" - if self.has_member("u1") and self.u1.has_member("VadFlags1"): + if self.has_member("CommitCharge"): + return self.CommitCharge + + elif self.has_member("u1") and self.u1.has_member("VadFlags1"): return self.u1.VadFlags1.CommitCharge elif self.has_member("u") and self.u.has_member("VadFlags"): From 55b27a68d5918abdba557db3aa0dcf02b4b2eae9 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 18:10:12 +0000 Subject: [PATCH 0517/1352] Add mnt_parent check to kernel version validation --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 8893e6e52..232e905b8 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1574,7 +1574,7 @@ class vfsmount(objects.StructType): 'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3. """ - return not self._context.symbol_space.has_type("mount") + return (not self._context.symbol_space.has_type("mount")) and self.has_member("mnt_parent") def is_equal(self, vfsmount_ptr) -> bool: """Helper to make sure it is comparing two pointers to 'vfsmount'. From 1132bd98304abf87b5ce1812309344047f5a907c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 18:11:22 +0000 Subject: [PATCH 0518/1352] Add mnt_parent check to kernel version validation --- volatility3/framework/symbols/linux/extensions/__init__.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 232e905b8..7103a2068 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1574,7 +1574,9 @@ class vfsmount(objects.StructType): 'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3. """ - return (not self._context.symbol_space.has_type("mount")) and self.has_member("mnt_parent") + return (not self._context.symbol_space.has_type("mount")) and self.has_member( + "mnt_parent" + ) def is_equal(self, vfsmount_ptr) -> bool: """Helper to make sure it is comparing two pointers to 'vfsmount'. From cb3542f76a64eee879ecaece45af310f15c531fb Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 20:40:51 +0000 Subject: [PATCH 0519/1352] Catch invalid address exception for invalid sock values --- volatility3/framework/plugins/linux/sockstat.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 764c04563..914c251d0 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -538,8 +538,11 @@ class Sockstat(plugins.PluginInterface): continue sock = socket.sk.dereference() - sock_type = sock.get_type() - family = sock.get_family() + try: + sock_type = sock.get_type() + family = sock.get_family() + except exceptions.InvalidAddressException: + continue sock_handler = SockHandlers(vmlinux, task) sock_fields = sock_handler.process_sock(sock) From 4d43ac9a6dc51c6b2855a907b452185d4eb0366a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 20:46:16 +0000 Subject: [PATCH 0520/1352] Catch invalid address exception for invalid sock values --- volatility3/framework/plugins/linux/sockstat.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 914c251d0..3d2df655b 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -541,11 +541,11 @@ class Sockstat(plugins.PluginInterface): try: sock_type = sock.get_type() family = sock.get_family() + sock_handler = SockHandlers(vmlinux, task) + sock_fields = sock_handler.process_sock(sock) except exceptions.InvalidAddressException: continue - sock_handler = SockHandlers(vmlinux, task) - sock_fields = sock_handler.process_sock(sock) if not sock_fields: continue From 644b967c624a6a3f1f57e735770e0f56604a1d11 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 21:31:07 +0000 Subject: [PATCH 0521/1352] Prevent backtraces when kthread full name is smeared --- .../framework/plugins/linux/kthreads.py | 25 ++++++++++++------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index bd0e895a4..674eae1e5 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -72,28 +72,35 @@ class Kthreads(plugins.PluginInterface): if task.has_member("worker_private"): # kernels >= 5.17 e32cf5dfbe227b355776948b2c9b5691b84d1cbd - ktread_base_pointer = task.worker_private + kthread_base_pointer = task.worker_private else: # 5.8 <= kernels < 5.17 in 52782c92ac85c4e393eb4a903a62e6c24afa633f threadfn # was added to struct kthread. task.set_child_tid is safe on those versions. - ktread_base_pointer = task.set_child_tid + kthread_base_pointer = task.set_child_tid - if not ktread_base_pointer.is_readable(): + if not kthread_base_pointer.is_readable(): continue - kthread = ktread_base_pointer.dereference().cast("kthread") + kthread = kthread_base_pointer.dereference().cast("kthread") threadfn = kthread.threadfn if not (threadfn and threadfn.is_readable()): continue task_name = utility.array_to_string(task.comm) + thread_name = task_name + # kernels >= 5.17 in d6986ce24fc00b0638bd29efe8fb7ba7619ed2aa full_name was added to kthread - thread_name = ( - utility.pointer_to_string(kthread.full_name, count=255) - if kthread.has_member("full_name") - else task_name - ) + if kthread.has_member("full_name"): + try: + thread_name = utility.pointer_to_string( + kthread.full_name, count=255 + ) + except exceptions.InvalidAddressException: + vollog.debug( + f"full_name pointer for thread at {kthread.vol.offset:#x} is paged out." + ) + module_name, symbol_name = ( linux_utilities_modules.Modules.lookup_module_address( self.context, vmlinux.name, handlers, threadfn From efbc410c4d3507f84f304e3385e3b9473b3fd1be Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 21:43:32 +0000 Subject: [PATCH 0522/1352] Add missing pointer validation check in mountinfo --- volatility3/framework/plugins/linux/mountinfo.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index 47d8705c8..c56ced489 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -93,11 +93,14 @@ class MountInfo(plugins.PluginInterface): return None mnt_root_path = mnt_root.path() - superblock = mnt.get_mnt_sb() mnt_id: int = mnt.mnt_id parent_id: int = mnt.mnt_parent.mnt_id + superblock = mnt.get_mnt_sb() + if not (superblock and superblock.is_readable()): + return None + st_dev = f"{superblock.major}:{superblock.minor}" mnt_opts: List[str] = [] From 3b3331a58d42e2fe71433892e7b632cdfd63db84 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 22:32:35 +0000 Subject: [PATCH 0523/1352] Add smear checks and missing absolute flag to walk_internal_list --- .../framework/symbols/linux/__init__.py | 25 ++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index afdfee39c..6f9ccdadc 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -430,13 +430,36 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod def walk_internal_list(cls, vmlinux, struct_name, list_member, list_start): + count = 0 + seen = set() + while list_start: + if list_start.vol.offset in seen: + vollog.debug( + "walk_internal_list: Repeat entry found. Stopping enumeration" + ) + break + seen.add(list_start.vol.offset) + + if not (list_start and list_start.is_readable()): + break + list_struct = vmlinux.object( - object_type=struct_name, offset=list_start.vol.offset + object_type=struct_name, offset=list_start.vol.offset, absolute=True ) + yield list_struct + list_start = getattr(list_struct, list_member) + if count == 4096: + vollog.debug( + f"walk_internal_list: Breaking list enumeration at {count}" + ) + break + + count += 1 + @classmethod def container_of( cls, From 941e40c368b79a36ee59a2cdf860aad83d489d15 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 22:59:32 +0000 Subject: [PATCH 0524/1352] Fix get_name API, fix malfind --- volatility3/framework/plugins/linux/elfs.py | 2 +- volatility3/framework/plugins/linux/malfind.py | 8 +++++--- volatility3/framework/plugins/linux/proc.py | 2 +- .../framework/symbols/linux/extensions/__init__.py | 8 +++++++- 4 files changed, 14 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index 0d1c9c2dd..b9dcc3cca 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -177,7 +177,7 @@ class Elfs(plugins.PluginInterface): name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), - path, + path or renderers.NotAvailableValue(), file_output, ), ) diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index e45688e97..a6e739bbf 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -56,10 +56,10 @@ class Malfind(interfaces.plugins.PluginInterface): ) if ( vma.is_suspicious(proc_layer) - and vma.get_name(self.context, task) != "[vdso]" + and vma_name != "[vdso]" ): data = proc_layer.read(vma.vm_start, 64, pad=True) - yield vma, data + yield vma, vma_name, data def _generator(self, tasks): # determine if we're on a 32 or 64 bit kernel @@ -71,7 +71,7 @@ class Malfind(interfaces.plugins.PluginInterface): for task in tasks: process_name = utility.array_to_string(task.comm) - for vma, data in self._list_injections(task): + for vma, vma_name, data in self._list_injections(task): if is_32bit_arch: architecture = "intel" else: @@ -88,6 +88,7 @@ class Malfind(interfaces.plugins.PluginInterface): process_name, format_hints.Hex(vma.vm_start), format_hints.Hex(vma.vm_end), + vma_name or renderers.NotAvailableValue(), vma.get_protection(), format_hints.HexBytes(data), disasm, @@ -103,6 +104,7 @@ class Malfind(interfaces.plugins.PluginInterface): ("Process", str), ("Start", format_hints.Hex), ("End", format_hints.Hex), + ("Path", str), ("Protection", str), ("Hexdump", format_hints.HexBytes), ("Disasm", interfaces.renderers.Disassembly), diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 23d6605b7..5acba6594 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -246,7 +246,7 @@ class Maps(plugins.PluginInterface): major, minor, inode_num, - path, + path or renderers.NotAvailableValue(), file_output, ), ) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 8893e6e52..5ac391da1 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1056,7 +1056,7 @@ class vm_area_struct(objects.StructType): parent_layer = self._context.layers[self.vol.layer_name] return self.vm_pgoff << parent_layer.page_shift - def get_name(self, context, task): + def _do_get_name(self, context, task) -> str: if self.vm_file != 0: fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file) elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk: @@ -1072,6 +1072,12 @@ class vm_area_struct(objects.StructType): fname = "Anonymous Mapping" return fname + def get_name(self, context, task) -> Optional[str]: + try: + return self._do_get_name(context, task) + except exceptions.InvalidAddressException: + return None + # used by malfind def is_suspicious(self, proclayer=None): ret = False From b81d2a27810681ebe810490afff9638d6b3c4d1d Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 23:03:43 +0000 Subject: [PATCH 0525/1352] Fix get_name API, fix malfind --- volatility3/framework/plugins/linux/malfind.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index a6e739bbf..7d8dd7f18 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -54,10 +54,7 @@ class Malfind(interfaces.plugins.PluginInterface): vollog.debug( f"Injections : processing PID {task.pid} : VMA {vma_name} : {hex(vma.vm_start)}-{hex(vma.vm_end)}" ) - if ( - vma.is_suspicious(proc_layer) - and vma_name != "[vdso]" - ): + if vma.is_suspicious(proc_layer) and vma_name != "[vdso]": data = proc_layer.read(vma.vm_start, 64, pad=True) yield vma, vma_name, data From 1d1af696ffdd7c0d1cfc033c8d19a1975ae4e2a0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 31 Jan 2025 17:26:36 -0600 Subject: [PATCH 0526/1352] Windows: Handles - catch exception in handle iteration An `InvalidAddressException` can occur inside of `__iter__` when iterating over the handle table (the exact exception occurs when creating the subtype in `objects.Array.__getitem__`. This changes the handle code to do a manual iteration over the sequence using the array length and indexes, catch the exception, log the index, and continue. In the test sample that prompted this change, the exception occurred on the access of the very last item in the array. closes #1573 --- volatility3/framework/plugins/windows/handles.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 6a391fe35..0c7958bac 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -243,7 +243,12 @@ class Handles(interfaces.plugins.PluginInterface): layer_object = self.context.layers[virtual] masked_offset = offset & layer_object.maximum_address - for entry in table: + for i in range(len(table)): + try: + entry = table[i] + except exceptions.InvalidAddressException: + vollog.debug(f"Failed to get handle table entry at index {i}") + continue # This triggered a backtrace in many testing samples # in the level == 0 path # The code above this calls `is_valid` on the `offset` From 60dc0c04f4dc6deea067a9fad0db9bbddacfbe48 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 22:37:21 -0600 Subject: [PATCH 0527/1352] Address feedback. Add doc strings --- .../framework/symbols/linux/__init__.py | 29 ++++++++++++++++--- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 6f9ccdadc..aa89e7a16 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -7,7 +7,7 @@ import contextlib import functools import logging from abc import ABC, abstractmethod -from typing import Iterator, List, Tuple, Optional, Union, Dict +from typing import List, Tuple, Optional, Union, Dict, Generator, Iterator import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3 import framework @@ -429,7 +429,28 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): ) @classmethod - def walk_internal_list(cls, vmlinux, struct_name, list_member, list_start): + def walk_internal_list( + cls, + vmlinux: interfaces.context.ModuleInterface, + struct_name: str, + list_member: str, + list_start: interfaces.objects.ObjectInterface, + max_count: int = 4096, + ) -> Generator[interfaces.objects.ObjectInterface, None, None]: + """ + An API that provides generic, smear-resistant enumeration of embedded lists + + Args: + vmlinux: + struct_name: name of the structure of the list elements + list_member: name of the list_member holding the internal list + list_start: Starting (head) member of the list + max_count: Optional maximum amount of list elements that will be yielded + + Returns: + Instances of `struct_name` + """ + count = 0 seen = set() @@ -452,9 +473,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): list_start = getattr(list_struct, list_member) - if count == 4096: + if count == max_count: vollog.debug( - f"walk_internal_list: Breaking list enumeration at {count}" + f"walk_internal_list: Breaking list enumeration at maximum allowed count of {count}" ) break From 18a69b941775ac97dae38b7352004fef32e77017 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:23:59 +1100 Subject: [PATCH 0528/1352] linux: add latched RB-trees implementation --- .../framework/symbols/linux/__init__.py | 2 + .../symbols/linux/extensions/__init__.py | 87 ++++++++++++++++++- 2 files changed, 88 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index afdfee39c..53c7c4c88 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -87,6 +87,8 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): # Only found in 6.1+ kernels self.optional_set_type_class("maple_tree", extensions.maple_tree) + self.optional_set_type_class("latch_tree_root", extensions.latch_tree_root) + class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 7103a2068..0f7ddfac3 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -10,7 +10,17 @@ import binascii import stat import datetime import socket as socket_module -from typing import Generator, Iterable, Iterator, Optional, Tuple, List, Union, Dict +from typing import ( + Generator, + Iterable, + Iterator, + Optional, + Tuple, + List, + Union, + Dict, + Callable, +) from volatility3.framework import constants, exceptions, objects, interfaces, symbols from volatility3.framework.renderers import conversion @@ -2979,3 +2989,78 @@ class scatterlist(objects.StructType): physical_layer = self._context.layers[physical_layer_name] for sg in self.for_each_sg(): yield from physical_layer.read(sg.dma_address, sg._sg_dma_len()) + + +class latch_tree_root(objects.StructType): + """Latched RB-trees implementation""" + + @functools.cached_property + def _vmlinux(self): + return linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + + @functools.lru_cache + def _get_type_cached(self, name): + return self._vmlinux.get_type(name) + + def _get_lt_node_from_rb_node( + self, rb_node, index + ) -> Optional[interfaces.objects.ObjectInterface]: + """Gets the latch tree node from the RBTree node. + Based on __lt_from_rb() + """ + # Unfortunately, we cannot use our LinuxUtilities.container_of() here, since the + # member is indexed by the 'index' variable: + # ltn = container_of(node, struct latch_tree_node, node[idx]) + pointer_size = self._get_type_cached("pointer").size + type_dec = self._get_type_cached("latch_tree_node") + member_offset = type_dec.relative_child_offset("node") + index * pointer_size + container_addr = rb_node.vol.offset - member_offset + + return self._vmlinux.object( + object_type="latch_tree_node", offset=container_addr, absolute=True + ) + + def find( + self, key: int, comp_function: Callable + ) -> Optional[interfaces.objects.ObjectInterface]: + """Returns a pointer to the node matching key or None. + + Based on latch_tree_find() and __lt_find() + + Args: + key (int): Typically an address + comp_function: Callback comparison function to provide the order between the + search key and an element. It's works like the kernel's latch_tree_ops::comp + i.e.: comp_function(key, latch_tree_node) + + Returns: + latch_tree_node: A pointer to the node matching key or None. + """ + # latch_tree_root >= 4.2 ade3f510f93a5613b672febe88eff8ea7f1c63b7 + + # Use the lowest sequence bit as an index for picking which data copy to read + if self.seq.has_member("seqcount"): + # kernels >= 5.10 0c9794c8b6781eb7dad8e19b78c5d4557790597a + sequence = self.seq.seqcount.sequence + elif self.seq.has_member("sequence"): + # 4.2 <= kernel < 5.10 + sequence = self.seq.sequence + else: + raise AttributeError("Unsupported sequence type implementation") + + idx = sequence & 1 + + rb_node_ptr = self.tree[idx].rb_node + while rb_node_ptr and rb_node_ptr.is_readable(): + rb_node = rb_node_ptr.dereference() + lt_node = self._get_lt_node_from_rb_node(rb_node, idx) + c = comp_function(key, lt_node) + if c < 0: + rb_node_ptr = rb_node.rb_left + elif c > 0: + rb_node_ptr = rb_node.rb_right + else: + return lt_node + + return None + From dba90ac2174017f24f136fec74b96797da1766e7 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:30:51 +1100 Subject: [PATCH 0529/1352] linux: Add support for module symbol types --- .../symbols/linux/extensions/__init__.py | 51 ++++++++++++++----- 1 file changed, 39 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 0f7ddfac3..5364fcbda 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -176,37 +176,43 @@ class module(generic.GenericIntelProcess): """Get the name of the module as a string""" return utility.array_to_string(self.name) - def _get_sect_count(self, grp): + def _get_sect_count(self, grp) -> int: """Try to determine the number of valid sections""" + symbol_table_name = self.get_symbol_table_name() arr = self._context.object( - self.get_symbol_table_name() + constants.BANG + "array", + symbol_table_name + constants.BANG + "array", layer_name=self.vol.layer_name, offset=grp.attrs, subtype=self._context.symbol_space.get_type( - self.get_symbol_table_name() + constants.BANG + "pointer" + symbol_table_name + constants.BANG + "pointer" ), count=25, ) idx = 0 - while arr[idx]: + while arr[idx] and arr[idx].is_readable(): idx = idx + 1 return idx - def get_sections(self): - """Get sections of the module""" + @functools.cached_property + def number_of_sections(self) -> int: if self.sect_attrs.has_member("nsections"): - num_sects = self.sect_attrs.nsections - else: - num_sects = self._get_sect_count(self.sect_attrs.grp) + return self.sect_attrs.nsections + + return self._get_sect_count(self.sect_attrs.grp) + + def get_sections(self) -> Iterable[interfaces.objects.ObjectInterface]: + """Get a list of section attributes for the given module.""" + + symbol_table_name = self.get_symbol_table_name() arr = self._context.object( - self.get_symbol_table_name() + constants.BANG + "array", + symbol_table_name + constants.BANG + "array", layer_name=self.vol.layer_name, offset=self.sect_attrs.attrs.vol.offset, subtype=self._context.symbol_space.get_type( - self.get_symbol_table_name() + constants.BANG + "module_sect_attr" + symbol_table_name + constants.BANG + "module_sect_attr" ), - count=num_sects, + count=self.number_of_sections, ) yield from arr @@ -309,6 +315,27 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to get strtab") + @property + def section_typetab(self): + if self.has_member("kallsyms") and self.kallsyms.has_member("typetab"): + # kernels >= 4.5 8244062ef1e54502ef55f54cced659913f244c3e: kallsyms was added + # kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b: types have its own array + return self.kallsyms.typetab + + raise AttributeError("Unable to get typetab section, it needs a kernel >= 5.2") + + def get_symbol_type(self, symbol, symbol_index): + if self.has_member("kallsyms") and self.kallsyms.has_member("typetab"): + # kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b types have its own array + layer = self._context.layers[self.vol.layer_name] + sym_type = layer.read(self.section_typetab + symbol_index, 1) + sym_type = sym_type.decode("utf-8", errors="ignore") + else: + # kernels < 5.2 the type was stored in the st_info + sym_type = chr(symbol.st_info) + + return sym_type + class task_struct(generic.GenericIntelProcess): def is_valid(self) -> bool: From 88b32b080340ef9e94c7cab19334e536aadfb6c1 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:32:14 +1100 Subject: [PATCH 0530/1352] linux: task_struct object extension: Add helper to obtain the task state --- .../framework/symbols/linux/extensions/__init__.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 5364fcbda..24260a798 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -517,6 +517,15 @@ class task_struct(generic.GenericIntelProcess): else None ) + @property + def state(self): + if self.has_member("__state"): + return self.member("__state") + elif self.has_member("state"): + return self.member("state") + else: + raise AttributeError("Unsupported task_struct: Cannot find state") + def _get_task_start_time(self) -> datetime.timedelta: """Returns the task's monotonic start_time as a timedelta. From 0e0daffc45827f82fdd992f1573e9448987cdd5f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:33:57 +1100 Subject: [PATCH 0531/1352] linux: Add kernel_symbol object extension --- .../framework/symbols/linux/__init__.py | 1 + .../symbols/linux/extensions/__init__.py | 61 +++++++++++++++++++ 2 files changed, 62 insertions(+) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 53c7c4c88..f3880e4db 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -88,6 +88,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.optional_set_type_class("maple_tree", extensions.maple_tree) self.optional_set_type_class("latch_tree_root", extensions.latch_tree_root) + self.optional_set_type_class("kernel_symbol", extensions.kernel_symbol) class LinuxUtilities(interfaces.configuration.VersionableInterface): diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 24260a798..41a7d9288 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3100,3 +3100,64 @@ class latch_tree_root(objects.StructType): return None + +class kernel_symbol(objects.StructType): + + def _offset_to_ptr(self, off) -> int: + layer = self._context.layers[self.vol.layer_name] + long_mask = (1 << layer.bits_per_register) - 1 + return (self.vol.offset + off) & long_mask + + @property + def name(self) -> str: + if self.has_member("name_offset"): + # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y + # See 7290d58095712a89f845e1bca05334796dd49ed2 + name_offset = self._offset_to_ptr(self.name_offset) + elif self.has_member("name"): + # kernel < 4.19 or CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=n + name_offset = self.member("name") + else: + raise AttributeError("Unsupported kernel_symbol type implementation") + + layer = self._context.layers[self.vol.layer_name] + name_bytes = layer.read(name_offset, linux_constants.KSYM_NAME_LEN) + + idx = name_bytes.find(b"\x00") + if idx != -1: + name_bytes = name_bytes[:idx] + + return name_bytes.decode("utf-8", errors="ignore") + + @property + def value(self) -> int: + if self.has_member("value_offset"): + # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y + # See 7290d58095712a89f845e1bca05334796dd49ed2 + return self._offset_to_ptr(self.value_offset) + elif self.has_member("value"): + # kernel < 4.19 or CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=n + return self.member("value") + + raise AttributeError("Unsupported kernel_symbol type implementation") + + @property + def namespace(self) -> str: + if self.has_member("namespace_offset"): + # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y + # See 7290d58095712a89f845e1bca05334796dd49ed2 + namespace_offset = self._offset_to_ptr(self.namespace_offset) + elif self.has_member("namespace"): + # kernel < 4.19 or CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=n + namespace_offset = self.member("namespace") + else: + raise AttributeError("Unsupported kernel_symbol type implementation") + + layer = self._context.layers[self.vol.layer_name] + namespace_bytes = layer.read(namespace_offset, linux_constants.KSYM_NAME_LEN) + + idx = namespace_bytes.find(b"\x00") + if idx != -1: + namespace_bytes = namespace_bytes[:idx] + + return namespace_bytes.decode("utf-8", errors="ignore") From e2431eebdf99b806019203981f9c2cd76b919e39 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:35:40 +1100 Subject: [PATCH 0532/1352] linux: bpf_prog: Add methods to get the program address and its memory regions --- .../symbols/linux/extensions/__init__.py | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 41a7d9288..4aff317a5 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2103,6 +2103,10 @@ class xdp_sock(objects.StructType): class bpf_prog(objects.StructType): + _BPF_PROG_CHUNK_SHIFT = 6 + _BPF_PROG_CHUNK_SIZE = 1 << _BPF_PROG_CHUNK_SHIFT + _BPF_PROG_CHUNK_MASK = ~(_BPF_PROG_CHUNK_SIZE - 1) + def get_type(self) -> Union[str, None]: """Returns a string with the eBPF program type""" @@ -2147,6 +2151,58 @@ class bpf_prog(objects.StructType): return self.aux.get_name() + def bpf_jit_binary_hdr_address(self) -> int: + """Return the jitted BPF program start address + Based on bpf_jit_binary_hdr() + + Returns: + The BPF program address + """ + vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name] + + # In 5.18 (33c9805860e584b194199cab1a1e81f4e6395408) <= kernels < 6.0 (1d5f82d9dd477d5c66e0214a68c3e4f308eadd6d) + # 'bpf_prog_aux' has a 'use_bpf_prog_pack' member + bpf_prog_aux_has_use_bpf_prog_pack = vmlinux.get_type( + "bpf_prog_aux" + ).has_member("use_bpf_prog_pack") + if bpf_prog_aux_has_use_bpf_prog_pack and self.aux.use_bpf_prog_pack: + long_mask = (1 << vmlinux_layer.bits_per_register) - 1 + addr_mask = self._BPF_PROG_CHUNK_MASK & long_mask + else: + addr_mask = vmlinux_layer.page_mask + + real_start = self.bpf_func + return real_start & addr_mask + + def get_address_region(self) -> Tuple[int, int]: + """Returns the start and end memory addresses of the BPF program. + Based on bpf_get_prog_addr_region() + + Returns: + A tuple with the addresses representing the memory range (start, end) of the BPF program. + """ + vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + vmlinux_layer = vmlinux.context.layers[vmlinux.layer_name] + # Based on bpf_get_prog_addr_region() + bpf_start_address = self.bpf_jit_binary_hdr_address() + + if vmlinux.has_type("bpf_binary_header"): + # kernels >= 3.11 314beb9bcabfd6b4542ccbced2402af2c6f6142a + bpf_binary_header = vmlinux.object( + object_type="bpf_binary_header", offset=bpf_start_address, absolute=True + ) + pages = bpf_binary_header.pages + else: + # kernels < 3.11 The first member is always the size + pages = vmlinux.object( + object_type="unsigned int", offset=bpf_start_address, absolute=True + ) + + bpf_end_address = bpf_start_address + pages * vmlinux_layer.page_size + + return bpf_start_address, bpf_end_address + class bpf_prog_aux(objects.StructType): def get_name(self) -> Union[str, None]: From 7e4b548e1735a4ea1e6c41b244f71e075a6790df Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:36:56 +1100 Subject: [PATCH 0533/1352] linux: task_struct object extension: Add method to get the task address space layer, even if its a kernel thread --- .../framework/symbols/linux/extensions/__init__.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 4aff317a5..fd5e85057 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -407,6 +407,19 @@ class task_struct(generic.GenericIntelProcess): self._context, dtb, config_prefix, preferred_name ) + def get_address_space_layer( + self, + ) -> Optional[interfaces.layers.TranslationLayerInterface]: + """Returns the task layer for this task's address space.""" + + task_layer_name = ( + self.vol.layer_name if self.is_kernel_thread else self.add_process_layer() + ) + if not task_layer_name: + return None + + return self._context.layers[task_layer_name] + def get_process_memory_sections( self, heap_only: bool = False ) -> Generator[Tuple[int, int], None, None]: From 6174687204840618da1784400913a5a7fa4b9ff4 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:39:45 +1100 Subject: [PATCH 0534/1352] linux: Introduce Kallsyms API --- .../framework/constants/linux/__init__.py | 21 + .../framework/symbols/linux/kallsyms.py | 1636 +++++++++++++++++ 2 files changed, 1657 insertions(+) create mode 100644 volatility3/framework/symbols/linux/kallsyms.py diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index f7f3faf87..99867b1fd 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -356,6 +356,27 @@ MODULE_MINIMUM_SIZE = 4096 # Kallsyms KSYM_NAME_LEN = 512 +NM_TYPES_DESC = { + "a": "Symbol is absolute and doesn't change during linking", + "b": "Symbol in the BSS section, typically holding zero-initialized or uninitialized data", + "c": "Symbol is common, typically holding uninitialized data", + "d": "Symbol is in the initialized data section", + "g": "Symbol is in an initialized data section for small objects", + "i": "Symbol is an indirect reference to another symbol", + "N": "Symbol is a debugging symbol", + "n": "Symbol is in a non-data, non-code, non-debug read-only section", + "p": "Symbol is in a stack unwind section", + "r": "Symbol is in a read only data section", + "s": "Symbol is in an uninitialized or zero-initialized data section for small objects", + "t": "Symbol is in the text (code) section", + "U": "Symbol is undefined", + "u": "Symbol is a unique global symbol", + "V": "Symbol is a weak object, with a default value", + "v": "Symbol is a weak object", + "W": "Symbol is a weak symbol but not marked as a weak object symbol, with a default value", + "w": "Symbol is a weak symbol but not marked as a weak object symbol", + "?": "Symbol type is unknown", +} # VMCOREINFO VMCOREINFO_MAGIC = b"VMCOREINFO\x00" diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py new file mode 100644 index 000000000..5310c8393 --- /dev/null +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -0,0 +1,1636 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import dataclasses +import functools +import logging +from typing import Iterator, List, Optional, Tuple + +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.constants import linux as linux_constants +from volatility3.framework.objects import utility +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import lsmod + +vollog = logging.getLogger(__name__) + + +@dataclasses.dataclass +class KASConfig: + """Kallsyms configuration class""" + + num_syms_address: int + names_address: int + token_table_address: int + token_index_address: int + offsets_address: int + relative_base_address: int + _stext: int + + # Usually not in VMCOREINFO, these are found during the bootstrap stage. + # If an ISF is available, they are fetched from there instead. + markers_address: int = None + addresses_address: int = None + _sinittext: int = None + _einittext: int = None + _etext: int = None + _end: int = None + mod_tree: int = None + module_addr_min: int = None + module_addr_max: int = None + start_ksymtab: int = None + stop_ksymtab: int = None + bpf_tree_address: int = None + seqs_of_names_address: int = None + + num_syms_type_size: int = None + markers_type_size: int = None + kernel_symbol_size: int = None + + @classmethod + def _get_symbol_address(cls, context, layer_name, module_name, symbol_name): + vmlinux = context.modules[module_name] + if not vmlinux.has_symbol(symbol_name): + return None + + layer = context.layers[layer_name] + address = vmlinux.get_symbol(symbol_name).address + address += layer.config["kernel_virtual_offset"] + return address + + @classmethod + def new_from_isf(cls, context, layer_name, module_name): + vmlinux = context.modules[module_name] + + # kallsyms_num_syms and kallsyms_markers types were updated from a unsigned long + # to unsigned int in 4.20 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a + num_syms_type_size = vmlinux.get_symbol("kallsyms_num_syms").type.size + kernel_symbol_size = vmlinux.get_type("kernel_symbol").size + + def get_symbol_address(symbol_name): + return cls._get_symbol_address( + context, layer_name, module_name, symbol_name + ) + + kas_config = KASConfig( + num_syms_address=get_symbol_address("kallsyms_num_syms"), + names_address=get_symbol_address("kallsyms_names"), + token_table_address=get_symbol_address("kallsyms_token_table"), + token_index_address=get_symbol_address("kallsyms_token_index"), + offsets_address=get_symbol_address("kallsyms_offsets"), + relative_base_address=get_symbol_address("kallsyms_relative_base"), + markers_address=get_symbol_address("kallsyms_markers"), + addresses_address=get_symbol_address("kallsyms_addresses"), + _sinittext=get_symbol_address("_sinittext"), + _einittext=get_symbol_address("_einittext"), + _stext=get_symbol_address("_stext"), + _etext=get_symbol_address("_etext"), + _end=get_symbol_address("_end"), + mod_tree=get_symbol_address("mod_tree"), + module_addr_min=get_symbol_address("module_addr_min"), + module_addr_max=get_symbol_address("module_addr_max"), + start_ksymtab=get_symbol_address("__start___ksymtab"), + stop_ksymtab=get_symbol_address("__stop___ksymtab"), + bpf_tree_address=get_symbol_address("bpf_tree"), + seqs_of_names_address=get_symbol_address("kallsyms_seqs_of_names"), + num_syms_type_size=num_syms_type_size, + markers_type_size=num_syms_type_size, + kernel_symbol_size=kernel_symbol_size, + ) + return kas_config + + +class _KallsymsIO: + """Helper to interpret a memory address as a file pointer. + + For internal use within the Kallsyms API; external use is discouraged. + """ + + def __init__( + self, + context: interfaces.context.ContextInterface, + layer_name: str, + base=0, + endian="little", + ): + self._context = context + self._layer_name = layer_name + self._base = base + self._position = base + self._endian = endian + + def read(self, size: int) -> bytes: + """Return 'size' bytes from the current postion""" + layer = self._context.layers[self._layer_name] + buf = layer.read(offset=self._position, length=size) + self._position += size + return buf + + def read_str(self, size: int) -> str: + """Returns 'size' bytes as a string from the current position.""" + return self.read(size).decode() + + def read_int(self, size: int, signed: bool = False) -> int: + """Returns the integer stored in the current position using 'size' bytes. + Args: + size: Number of bytes to use for the int. + signed: Integer sign. + + Returns: + The integer stored in the current position. + """ + return int.from_bytes( + self.read(size), + byteorder=self._endian, + signed=signed, + ) + + def seek(self, offset: int) -> None: + """Seek the pointer to the given offset, based on the base address. + + Args: + offset: offset from the base address + """ + self._position = self._base + offset + + +@dataclasses.dataclass +class KASSymbolBasic: + name: str + type: str + + +@dataclasses.dataclass +class KASSymbol(KASSymbolBasic): + address: int + size: int + module_name: str + exported: bool = False + subsystem: str = None + + def __str__(self): + return ( + f"name:{self.name}, type:{self.type}, address:{self.address:#x}, " + f"size:{self.size}, exported:{self.exported}, subsystem:{self.subsystem}" + ) + + def set_exported_from_type(self) -> None: + """Updates the 'export' member based on the symbol's type. + + This method evaluates the symbol's type and sets the 'export' member + to indicate whether the object is exported. This code and Linux kernel follows + the nm symbol type logic. + """ + # As per the "nm" man page: + # If lowercase, the symbol is usually local; if uppercase, the symbol is + # global (external). There are however a few lowercase symbols that are shown + # for special global symbols ("u", "v" and "w"). + self.exported = bool(self.type.isupper() or self.type in ("u", "v", "w")) + + @functools.cached_property + def type_description(self) -> Optional[str]: + """Returns the interpreted meaning of the symbol type based on the nm tool. + + Returns: + A string with the type description. + """ + # If a symbol type exists with the original case, get it + symbol_type_description = linux_constants.NM_TYPES_DESC.get(self.type, None) + if symbol_type_description: + return symbol_type_description + + # Otherwise, use the lowercase version + symbol_type_description = linux_constants.NM_TYPES_DESC.get( + self.type.lower(), None + ) + return symbol_type_description + + +@dataclasses.dataclass +class KASFilter: + name: str + type: str + + +class Kallsyms(interfaces.configuration.VersionableInterface): + """Kallsyms API class""" + + _required_framework_version = (2, 19, 0) + _version = (1, 0, 0) + + # Internal kernel core constants + _CORE_SUBSYSTEM_NAME = "core" + _CORE_MODULE_NAME = "kernel" + + # Internal module constants + _MODULE_SUBSYSTEM_NAME = "module" + + # Internal FTrace constants + _FTRACE_SUBSYSTEM_NAME = "ftrace" + _FTRACE_MODULE_SYM_TYPE = "T" + _FTRACE_TRAMPOLINE_MODULE_NAME = "__builtin__ftrace" + _FTRACE_TRAMPOLINE_SYM = "ftrace_trampoline" + _FTRACE_TRAMPOLINE_SYM_TYPE = "t" + + # Internal BPF constants + _BPF_SUBSYSTEM_NAME = "bpf" + _BPF_MODULE_NAME = "bpf" + _BPF_SYM_TYPE = "t" + + def __init__( + self, + context: interfaces.context.ContextInterface, + layer_name: str, + module_name: str, + kas_config: KASConfig = None, + progress_callback: constants.ProgressCallback = None, + ) -> None: + """Initialize the Kallsyms API + + Args: + context: The context used to access memory layers and symbols + layer_name: The name of layer within the context in which the module exists + module_name: The name of the kernel module on which to operate + kas_config: The KAllSyms configuration + progress_callback: Method that is called periodically during scanning to + update progress + """ + super().__init__() + + self._assert_versions() + + self._context = context + self._layer_name = layer_name + self._module_name = module_name + self._kas_config = kas_config + self._progress_callback = progress_callback + if progress_callback and not callable(progress_callback): + raise TypeError("Progress_callback is not callable") + + if not kas_config: + self._kas_config = KASConfig.new_from_isf( + context=context, + layer_name=layer_name, + module_name=module_name, + ) + + layer = self._context.layers[self._layer_name] + # FIXME: The layer lacks this information. Could there be a better alternative? + self._endian = "little" if layer._entry_format[0] == "<" else "big" + self._long_size = layer.bits_per_register // 8 + + self._kallsyms_num_syms = None + self._kallsyms_relative_base = None + + self._kallsyms_token_index_address = None + self._kallsyms_offsets_address = None + self._kallsyms_names_io = _KallsymsIO( + context=self._context, + layer_name=self._layer_name, + base=self._kas_config.names_address, + endian=self._endian, + ) + + self._kallsyms_token_table_io = _KallsymsIO( + context=self._context, + layer_name=self._layer_name, + base=self._kas_config.token_table_address, + endian=self._endian, + ) + + self._bootstrap() + + @classmethod + def _assert_versions(cls) -> None: + """Verify versions of shared dependencies""" + lsmod_version_required = (2, 0, 0) + if not requirements.VersionRequirement.matches_required( + lsmod_version_required, lsmod.Lsmod.version + ): + raise exceptions.VolatilityException( + "Lsmod version not suitable: " + f"required {lsmod_version_required} found {lsmod.Lsmod.version}", + ) + + return None + + def _read_bytes(self, address: int, size: int) -> bytes: + layer = self._context.layers[self._layer_name] + return layer.read(address, size).decode() + + def _read_int(self, address: int, size: int, signed: bool = False) -> int: + layer = self._context.layers[self._layer_name] + return int.from_bytes( + layer.read(address, size), + byteorder=self._endian, + signed=signed, + ) + + def _bootstrap(self) -> None: + layer = self._context.layers[self._layer_name] + # kallsyms_num_syms and kallsyms_markers[] types were updated from a unsigned long + # to unsigned int in 4.20 80ffbaa5b1bd98e80e3239a3b8cfda2da433009a + self._kallsyms_num_syms = self._read_int( + self._kas_config.num_syms_address, + self._kas_config.num_syms_type_size, + signed=False, + ) + + if self._kas_config.relative_base_address: + # kernels >= 4.6 + self._kallsyms_relative_base = ( + self._read_int( + self._kas_config.relative_base_address, + self._long_size, + signed=False, + ) + & layer.address_mask + ) + + self._kallsyms_offsets_address = self._kas_config.offsets_address + self._kallsyms_token_index_address = self._kas_config.token_index_address + + # Preload the kallsyms_token_index array + short_size = 2 + self._kallsyms_token_index = [ + self._read_int( + self._kallsyms_token_index_address + index * short_size, + short_size, + signed=False, + ) + for index in range(256) + ] + + def _get_symbol( + self, + offset, + index, + filters: List[KASFilter] = None, + ) -> Optional[Tuple[KASSymbol, int]]: + kassymbolbasic, compressed_length = self._expand_symbol(offset, filters) + kassymbol = None + if kassymbolbasic: + sym_addr = self._get_symbol_address_by_index(index=index) + _, sym_size = self._get_symbol_pos(sym_addr) + + kassymbol = KASSymbol( + name=kassymbolbasic.name, + type=kassymbolbasic.type, + address=sym_addr, + size=sym_size, + module_name=self._CORE_MODULE_NAME, + subsystem=self._CORE_SUBSYSTEM_NAME, + ) + kassymbol.set_exported_from_type() + return kassymbol, compressed_length + + def get_core_symbols( + self, + progress_callback: constants.ProgressCallback = None, + ) -> Iterator[KASSymbol]: + """Yield each kernel core symbol + + Args: + progress_callback: Method that is called periodically during scanning to + update progress + + Based on kallsyms_on_each_symbol() + + Yields: + KASSymbol objects + """ + current_offset = 0 + for sym_idx in range(self._kallsyms_num_syms): + kassymbol, compressed_length = self._get_symbol(current_offset, sym_idx) + if kassymbol: + yield kassymbol + + if progress_callback: + progress_callback( + (sym_idx / self._kallsyms_num_syms) * 100, + "Populating Kallsyms core symbols", + ) + + current_offset += compressed_length + 1 + + def _expand_symbol( + self, + offset: int, + filters: List[KASFilter] = None, + ) -> Tuple[KASSymbolBasic, int]: + """Expand a compressed symbol using its offset in the stream + Based on kallsyms_expand_symbol() + + Args: + offset: Symbol offset in the kallsyms arrays. + filters: List of KASFilter filters + + Returns: + A tuple with a KASSymbolBasic object and the symbol name's compressed length. + """ + filters = filters if filters is not None else [] + type_filters = tuple(kassymbolfilter.type for kassymbolfilter in filters) + + self._kallsyms_names_io.seek(offset) + # The compressed symbol length is in the first byte + compressed_length = self._kallsyms_names_io.read_int(size=1) + if compressed_length & 0x80 != 0: + # kernels >= 6.1 73bbb94466fd3f8b313eeb0b0467314a262dddb3 + # MSB 1 means a 'big' symbol, we need an extra byte + lower_byte = compressed_length + upper_byte = self._kallsyms_names_io.read_int(size=1) + compressed_length = (upper_byte << 7) | (lower_byte & 0x7F) + + abort_decompression = False + sym_type = None + sym_name = "" + for _ in range(compressed_length): + token_index_index = self._kallsyms_names_io.read_int(size=1) + token_index = self._kallsyms_token_index[token_index_index] + self._kallsyms_token_table_io.seek(token_index) + token = self._kallsyms_token_table_io.read_str(1) + while token != "\x00": + if not sym_type: + sym_type = token + # We got the symbol type, we can abort this immediatelly + if type_filters and sym_type not in type_filters: + abort_decompression = True + break + else: + sym_name += token + for kassymbolfilter in filters: + if kassymbolfilter.type is not None: + if ( + sym_type == kassymbolfilter.type + and kassymbolfilter.name.startswith(sym_name) + ): + break + elif kassymbolfilter.name.startswith(sym_name): + break + + else: + if filters: + abort_decompression = True + + token = self._kallsyms_token_table_io.read_str(1) + + if abort_decompression: + break + + kassymbolbasic = ( + KASSymbolBasic(name=sym_name, type=sym_type) + if not abort_decompression + else None + ) + return kassymbolbasic, compressed_length + + def _get_symbol_address_by_index(self, index: int) -> int: + """Return symbol address based on the symbol index in the kallsyms arrays. + Based on kallsyms_sym_address() + + Args: + index: Symbol index + + Returns: + Symbol address + """ + if self._kallsyms_offsets_address: + # kernels >= 4.6 - Addresses are relative to kallsyms_relative_base + # It assumes: CONFIG_KALLSYMS_BASE_RELATIVE=y and CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y + signed_int_size = 4 + sym_offset_ptr = self._kallsyms_offsets_address + (index * signed_int_size) + sym_addr = self._read_int(sym_offset_ptr, signed_int_size, signed=True) + + if sym_addr < 0: + # Negative offsets are relative to kallsyms_relative_base - 1 + return self._kallsyms_relative_base - 1 - sym_addr + + # Positive offsets are absolute values + return sym_addr + elif self._kas_config.addresses_address: + # kernels < 4.6 - Addresses are absolute + # unsigned long kallsyms_addresses[] + kallsyms_address = self._read_int( + self._kas_config.addresses_address + (index * self._long_size), + self._long_size, + signed=False, + ) + return kallsyms_address + else: + raise exceptions.VolatilityException("Unsupported kernel") + + @functools.lru_cache + def _get_symbol_pos(self, address: int) -> Tuple[int, int]: + """Returns the symbol position in the kallsyms arrays and its size.""" + low = 0 + high = self._kallsyms_num_syms + + while high - low > 1: + mid = low + (high - low) // 2 + if self._get_symbol_address_by_index(mid) <= address: + low = mid + else: + high = mid + + # Search for the first aliased symbol. *Aliased symbols* are symbols with the same address. + while low and self._get_symbol_address_by_index( + low - 1 + ) == self._get_symbol_address_by_index(low): + low -= 1 + + symbol_start = self._get_symbol_address_by_index(low) + symbol_end = 0 + + # Search for next non-aliased symbol. + for idx in range(low + 1, self._kallsyms_num_syms): + if self._get_symbol_address_by_index(idx) > symbol_start: + symbol_end = self._get_symbol_address_by_index(idx) + break + + # pylint: disable=protected-access + # If no next symbol is found, we default to using the end of the section + if not symbol_end: + if self._is_kernel_inittext(address): + symbol_end = self._kas_config._einittext + elif self._kas_config._end is not None: + # Assume CONFIG_KALLSYMS_ALL=y. Otherwise, symbol_end will be _etext + symbol_end = self._kas_config._end + else: + symbol_end = self._kas_config._etext + + symbol_size = symbol_end - symbol_start + + return low, symbol_size + + @functools.lru_cache + def _get_symbol_offset(self, index: int) -> int: + """Find the offset on the compressed stream given the index in the kallsyms array. + + Based on get_symbol_offset + + Returns: + Offset on the compressed stream + """ + + # Use the nearest marker, placed every 256 positions + kallsyms_markers_pos_ptr = ( + self._kas_config.markers_address + + (index >> 8) * self._kas_config.markers_type_size + ) + kallsyms_markers_pos = self._read_int( + kallsyms_markers_pos_ptr, self._kas_config.markers_type_size, signed=False + ) + name_addr = self._kas_config.names_address + kallsyms_markers_pos + + # Scan symbols sequentially until the target. Each symbol uses a + # [][ bytes of data] format, so we skip symbols by adding their length + # to the pointer value. + for _ in range(index & 0xFF): + compressed_length = self._read_int(name_addr, 1) + if compressed_length & 0x80 != 0: + # kernels >= 6.1 73bbb94466fd3f8b313eeb0b0467314a262dddb3 + # MSB 1 means a 'big' symbol, we need an extra byte + lower_byte = compressed_length + upper_byte = self._kallsyms_names_io.read_int(size=1) + compressed_length = (upper_byte << 7) | (lower_byte & 0x7F) + + name_addr += compressed_length + 1 + + return name_addr - self._kas_config.names_address + + def _is_kernel_inittext(self, addr: int) -> bool: + # pylint: disable=protected-access + if not (self._kas_config._sinittext and self._kas_config._einittext): + # We don't know + return False + + return self._kas_config._sinittext <= addr < self._kas_config._einittext + + def _is_kernel_text(self, addr: int) -> bool: + # pylint: disable=protected-access + return self._kas_config._stext <= addr < self._kas_config._etext + + def _is_core_ksym_addr(self, addr: int) -> bool: + return self._is_kernel_text(addr) or self._is_kernel_inittext(addr) + + def lookup_address(self, address: int) -> Optional[KASSymbol]: + """Search for a symbol by its memory address. + + This function scans kernel core, module symbols, BPF symbols, and Ftrace symbols + to locate the first symbol matching the specified address. Note that multiple + symbols (aliased symbols) can share the same memory address, so this method + returns the first match found. + + Based on kallsyms_lookup. + + Args: + address: The memory address to search for. + + Returns: + The matching symbol if found, or None if no match is found. + """ + layer = self._context.layers[self._layer_name] + address &= layer.address_mask + + kassymbol = self.core_lookup_address(address) + if not kassymbol: + kassymbol = self.module_lookup_address(address) + + if not kassymbol: + kassymbol = self.bpf_lookup_address(address) + + if not kassymbol: + kassymbol = self.ftrace_lookup_address(address) + + return kassymbol + + def core_lookup_address(self, address: int) -> Optional[KASSymbol]: + """Search for a symbol by its memory address within the kernel core. + + Based on kallsyms_lookup_buildid. + + Args: + address: The memory address to search for. + + Returns: + The matching symbol if found, or None if no match is found. + """ + layer = self._context.layers[self._layer_name] + address &= layer.address_mask + + if not self._is_core_ksym_addr(address): + return None + + pos, sym_size = self._get_symbol_pos(address) + offset = self._get_symbol_offset(pos) + sym_address = self._get_symbol_address_by_index(pos) + kassymbolbasic, _compressed_length = self._expand_symbol(offset) + + if not kassymbolbasic: + return None + + kas_symbol = KASSymbol( + name=kassymbolbasic.name, + type=kassymbolbasic.type, + address=sym_address, + size=sym_size, + module_name=self._CORE_MODULE_NAME, + subsystem=self._CORE_SUBSYSTEM_NAME, + ) + kas_symbol.set_exported_from_type() + return kas_symbol + + def _is_symbol_exported( + self, + name: int, + address: int, + module: Optional[interfaces.objects.ObjectInterface] = None, + ) -> bool: + """Check if the address belongs to an exported symbol. + If a module object is provided, it searches in that module symbols. + Otherwise, it searches in the global symbols. + + Bases on is_exported + + Args: + name: Symbol name + address: Symbol address + module: Module object. Defaults to None. + + Returns: + True if the symbol is exported; otherwise, returns False + """ + if module: + if module.num_syms <= 0: + return False + + start_mod_ksymtab = module.syms + stop_mod_ksymtab = ( + start_mod_ksymtab + + module.num_syms * self._kas_config.kernel_symbol_size + ) + kernel_symbol = self._find_exported_symbol_in_range( + name, start_mod_ksymtab, stop_mod_ksymtab + ) + else: + # Search the not GPL modules + kernel_symbol = self._find_exported_symbol_in_range( + name, + self._kas_config.start_ksymtab, + self._kas_config.stop_ksymtab, + ) + + return kernel_symbol is not None and kernel_symbol.value == address + + def _elfsym_to_kassymbol( + self, + module: interfaces.objects.ObjectInterface, + elf_sym_obj: interfaces.objects.ObjectInterface, + elf_sym_index: int, + subsystem: str = None, + ) -> Optional[KASSymbol]: + """Returns a KASSymbol from a ElfSym + + Args: + module: Module object + elf_sym_obj: ElfSym object + elf_sym_index: ElfSym index + subsystem: Name of the sub-subtem: core, module, bpf, ftrace, etc + + Returns: + A KASSymbol object + """ + layer = self._context.layers[self._layer_name] + sym_name = elf_sym_obj.get_name() + if not sym_name: + return None + + # Normalize sym.st_value offset, which is an address pointing to the symbol value + sym_address = elf_sym_obj.st_value & layer.address_mask + sym_type = module.get_symbol_type(elf_sym_obj, elf_sym_index) + + kas_symbol = KASSymbol( + name=sym_name, + type=sym_type, + address=sym_address, + size=elf_sym_obj.st_size, + module_name=module.get_name(), + exported=False, + subsystem=subsystem, + ) + kas_symbol.set_exported_from_type() + return kas_symbol + + def _is_module_ksym_address(self, address: int) -> bool: + return self._modules_address_min <= address <= self._modules_address_max + + def module_lookup_address( + self, + address: int, + module: Optional[interfaces.objects.ObjectInterface] = None, + ) -> Optional[KASSymbol]: + """Search for a symbol within kernel modules based on its memory address. + If a module object is provided, it will only search in that module. Otherwise, + it will try to first find the module to where the provided address belong to. + + Based on module_address_lookup. + + Args: + address: The memory address of the symbol to search for + module [optional]: The module to search within. If not provided, the module + containing the address will be automatically determined + + Returns: + The matching KASSymbol if found; otherwise, returns None + """ + if not self._is_module_ksym_address(address): + return None + + module = module or self.get_module_by_address(address) + if not module: + return None + + kassymbol = self._find_address_in_module_symbols(module, address) + if not kassymbol: + return None + + return kassymbol + + def _find_address_in_module_symbols( + self, + module: interfaces.objects.ObjectInterface, + address: int, + ) -> Optional[KASSymbol]: + """Find the symbol corresponding to a given address within a module. + + Based on find_kallsyms_symbol + + Args: + module: The module where the address belongs to + address: The memory address to search for + + Returns: + The matching KASSymbol if found; otherwise, returns None + """ + layer = self._context.layers[self._layer_name] + for elf_sym_idx, elf_sym in enumerate(module.get_symbols()): + if not elf_sym.get_name(): + continue + + sym_address_start = elf_sym.st_value & layer.address_mask + sym_address_end = sym_address_start + elf_sym.st_size + + if sym_address_start <= address < sym_address_end: + return self._elfsym_to_kassymbol( + module, elf_sym, elf_sym_idx, subsystem=self._MODULE_SUBSYSTEM_NAME + ) + + return None + + @functools.lru_cache + def _get_modules_memory_boundaries(self) -> Tuple[int, int]: + """Determine the boundaries of the module allocation area + + Returns: + A tuple containing the minimum and maximum addresses for the kernel module + allocation area. + """ + + if self._kas_config.mod_tree: + # Kernel >= 5.19 58d208de3e8d87dbe196caf0b57cc58c7a3836ca + mod_tree_address = self._kas_config.mod_tree + vmlinux = self._context.modules[self._module_name] + mod_tree = vmlinux.object( + object_type="mod_tree_root", + offset=mod_tree_address, + absolute=True, + ) + addr_min, addr_max = mod_tree.addr_min, mod_tree.addr_max + elif self._kas_config.module_addr_min and self._kas_config.module_addr_max: + # 2.6.27 <= kernel < 5.19 3a642e99babe0617febb6f402e1e063479f489db + kas_config = self._kas_config + addr_min, addr_max = kas_config.module_addr_min, kas_config.module_addr_max + else: + raise exceptions.VolatilityException( + "Cannot find the module memory allocation area. Unsupported kernel" + ) + + layer = self._context.layers[self._layer_name] + return addr_min & layer.address_mask, addr_max & layer.address_mask + + @functools.cached_property + def _modules_address_min(self): + address_min, _address_max = self._get_modules_memory_boundaries() + return address_min + + @functools.cached_property + def _modules_address_max(self): + _address_min, address_max = self._get_modules_memory_boundaries() + return address_max + + def get_module_by_address( + self, address: int + ) -> Optional[interfaces.objects.ObjectInterface]: + """Searches for the module that contains the given memory address within its range. + It uses a latch tree for optimized address range searching. + + Based on __module_address() + + Args: + address: The module memory address to search for. + + Returns: + The matching module if found; otherwise, returns None + """ + if not self._is_module_ksym_address(address): + return None + + return self._search_module_by_address(address) + + @functools.lru_cache + def _get_type_cache(self, name: str): + vmlinux = self._context.modules[self._module_name] + return vmlinux.get_type(name) + + def _mod_tree_comp( + self, address: int, latch_tree_node: interfaces.objects.ObjectInterface + ) -> int: + vmlinux = self._context.modules[self._module_name] + + module_memory_mtn_offset = self._get_type_cache( + "module_memory" + ).relative_child_offset("mtn") + mod_tree_node_mod_offset = self._get_type_cache( + "mod_tree_node" + ).relative_child_offset("mod") + + module_memory_offset = ( + latch_tree_node.vol.offset + + module_memory_mtn_offset + + mod_tree_node_mod_offset + ) + + module_memory = vmlinux.object( + object_type="module_memory", + offset=module_memory_offset, + absolute=True, + ) + start = module_memory.base + end = start + module_memory.size + + if address < start: + return -1 + elif address >= end: + return 1 + else: + return 0 + + def _search_module_by_address( + self, address: int + ) -> Optional[interfaces.objects.ObjectInterface]: + """Searches for the module that contains the given memory address within its range. + It uses a latch tree for optimized address range searching. + + Based on mod_find + + Args: + address: The module memory address to search for + + Returns: + The matching module if found; otherwise, returns None + """ + vmlinux = self._context.modules[self._module_name] + if self._kas_config.mod_tree: + mod_tree_address = self._kas_config.mod_tree + mod_tree = vmlinux.object( + object_type="mod_tree_root", + offset=mod_tree_address, + absolute=True, + ) + latch_tree_root = mod_tree.root + latch_tree_node = latch_tree_root.find(address, self._mod_tree_comp) + if latch_tree_node: + mod_tree_node = linux.LinuxUtilities.container_of( + latch_tree_node.vol.offset, "mod_tree_node", "node", vmlinux + ) + module_ptr = mod_tree_node.mod + if not module_ptr.is_readable(): + vollog.error("Something went wrong") + return None + + return module_ptr.dereference() + else: + raise NotImplementedError("FIXME") + + return None + + def _find_exported_symbol_in_range( + self, name: str, start: int, stop: int + ) -> Optional[interfaces.objects.ObjectInterface]: + """Find an exported symbol within a specified range of kernel symbols. + + Based on lookup_exported_symbol + + Args: + name: Symbol name + start: Start address + stop: Stop address + + Returns: + The matching kernel_symbol object if found, or None if no match is found. + """ + + num_elems = (stop - start) // self._kas_config.kernel_symbol_size + + return self._search_kernel_symbol_object_by_name( + name, + base=start, + num_elems=num_elems, + ) + + def _cmp_kernel_symbol_name( + self, + name: str, + kernel_symbol: interfaces.objects.ObjectInterface, + ) -> int: + return self._cmp_symbol_name(name, kernel_symbol.name) + + def _cmp_symbol_name( + self, + name: str, + other: str, + ) -> int: + if name == other: + return 0 + elif name < other: + return -1 + else: + return 1 + + def _search_kernel_symbol_object_by_name( + self, name: str, base: int, num_elems: int + ) -> Optional[interfaces.objects.ObjectInterface]: + """Search a kernel_symbol by name using binary search. + + Based on bsearch / __inline_bsearch() + + Args: + name: Symbol name + base: Base address + num_elems: Number of elements + + Returns: + A kernel_symbol object + """ + vmlinux = self._context.modules[self._module_name] + while num_elems > 0: + pivot = base + (num_elems // 2) * self._kas_config.kernel_symbol_size + + kernel_symbol_pivot = vmlinux.object( + object_type="kernel_symbol", + offset=pivot, + absolute=True, + ) + + result = self._cmp_kernel_symbol_name(name, kernel_symbol_pivot) + if result == 0: + return kernel_symbol_pivot + elif result > 0: + base = pivot + self._kas_config.kernel_symbol_size + num_elems -= 1 + + num_elems = num_elems // 2 + + return None + + def get_modules_symbols(self, name: str = None) -> Iterator[KASSymbol]: + """Yield each symbol from the kernel modules. + This function iterates over the symbols of the kernel modules and yields them as + KASSymbol objects. + + name (optional): If specified, the symbol name used to filter the symbols. + + Yields: + KASSymbol objects + """ + layer = self._context.layers[self._layer_name] + for module in lsmod.Lsmod.list_modules(self._context, self._module_name): + module_name = utility.array_to_string(module.name) + for elf_sym_idx, elf_sym_obj in enumerate(module.get_symbols()): + sym_name = elf_sym_obj.get_name() + if not sym_name: + continue + + if name and name != sym_name: + continue + + # Normalize sym.st_value offset, which is an address pointing to the symbol value + sym_address = elf_sym_obj.st_value & layer.address_mask + sym_size = elf_sym_obj.st_size + sym_type = module.get_symbol_type(elf_sym_obj, elf_sym_idx) + is_exported = self._is_symbol_exported(sym_name, sym_address, module) + sym_type = sym_type.upper() if is_exported else sym_type.lower() + + yield KASSymbol( + name=sym_name, + type=sym_type, + address=sym_address, + size=sym_size, + exported=is_exported, + module_name=module_name, + subsystem=self._MODULE_SUBSYSTEM_NAME, + ) + + def _ftrace_mod_get_symbols(self, address: int = None) -> Iterator[KASSymbol]: + """Yield each symbol from the ftrace modules. + This function iterates over the symbols of the ftrace modules and yields them as + KASSymbol objects. + + Based on ftrace_mod_get_kallsym + + Args: + address (optional): Address to filter symbols by + + Yields: + KASSymbol objects + """ + vmlinux = self._context.modules[self._module_name] + layer = self._context.layers[self._layer_name] + if not ( + vmlinux.has_type("ftrace_mod_map") and vmlinux.has_type("ftrace_mod_func") + ): + # kernel < 4.15 aba4b5c22cbac296f4081a0476d0c55828f135b4 + vollog.warning( + "Unsupported Ftrace kallsyms implementation. Ignore this if it's a kernel < 4.15" + ) + return None + + symbol_table_name = vmlinux.symbol_table_name + ftrace_mod_map_symname = f"{symbol_table_name}{constants.BANG}ftrace_mod_map" + ftrace_mod_func_symname = f"{symbol_table_name}{constants.BANG}ftrace_mod_func" + ftrace_mod_maps = vmlinux.object_from_symbol("ftrace_mod_maps") + for mod_map in ftrace_mod_maps.to_list(ftrace_mod_map_symname, "list"): + for mod_func in mod_map.funcs.to_list(ftrace_mod_func_symname, "list"): + sym_name = utility.pointer_to_string( + mod_func.name, count=linux_constants.KSYM_NAME_LEN + ) + sym_addr = mod_func.ip & layer.address_mask + sym_size = mod_func.size + if address is not None and not ( + sym_addr <= address < sym_addr + sym_size + ): + continue + + module_name = utility.array_to_string(mod_map.mod.name) + kas_symbol = KASSymbol( + name=sym_name, + type=self._FTRACE_MODULE_SYM_TYPE, + address=sym_addr, + size=sym_size, + module_name=module_name, + subsystem=self._FTRACE_SUBSYSTEM_NAME, + ) + kas_symbol.set_exported_from_type() + yield kas_symbol + + def _ftrace_get_trampoline_symbols( + self, address: int = None + ) -> Iterator[KASSymbol]: + """Yield each symbol from the ftrace trampoline. + + Based on ftrace_get_trampoline_kallsym + + Args: + address (optional): Address to filter symbols by + + Yields: + KASSymbol objects + """ + # See kernel's ftrace_get_trampoline_kallsym() + vmlinux = self._context.modules[self._module_name] + if not vmlinux.has_type("ftrace_ops"): + # kernels < 2.6.27 16444a8a40d4c7b4f6de34af0cae1f76a4f6c901 + return None + + if not vmlinux.has_symbol("ftrace_ops_trampoline_list"): + # kernels < 5.9 fc0ea795f53c8d7040fa42471f74fe51d78d0834 + return None + + symbol_table_name = vmlinux.symbol_table_name + ftrace_ops_symname = f"{symbol_table_name}{constants.BANG}ftrace_ops" + ftrace_ops_trampoline_list = vmlinux.object_from_symbol( + "ftrace_ops_trampoline_list" + ) + + for ftrace_op in ftrace_ops_trampoline_list.to_list(ftrace_ops_symname, "list"): + sym_name = self._FTRACE_TRAMPOLINE_SYM + sym_addr = ftrace_op.trampoline + sym_size = ftrace_op.trampoline_size + + if address is not None and not (sym_addr <= address < sym_addr + sym_size): + continue + + kas_symbol = KASSymbol( + name=sym_name, + type=self._FTRACE_TRAMPOLINE_SYM_TYPE, + address=sym_addr, + size=sym_size, + module_name=self._FTRACE_TRAMPOLINE_MODULE_NAME, + subsystem=self._FTRACE_SUBSYSTEM_NAME, + ) + kas_symbol.set_exported_from_type() + yield kas_symbol + + def get_ftrace_symbols(self) -> Iterator[KASSymbol]: + """Yield each kernel ftrace symbol + + Yields: + KASSymbol objects + """ + yield from self._ftrace_mod_get_symbols() + yield from self._ftrace_get_trampoline_symbols() + + def get_bpf_symbols(self) -> Iterator[KASSymbol]: + """Yield each kernel BPF symbol + + Based on bpf_get_kallsym() + + Yields: + KASSymbol objects + """ + vmlinux = self._context.modules[self._module_name] + if vmlinux.has_type("bpf_ksym"): + # kernels >= 5.8 + list_type, list_head_member = "bpf_ksym", "lnode" + elif vmlinux.has_type("bpf_prog_aux"): + # 3.18 <= kernels < 5.8 + list_type, list_head_member = "bpf_prog_aux", "ksym_lnode" + else: + # kernels < 3.18 + vollog.warning( + "Unsupported BPF kallsysms implementation. Don't worry if kernel < 3.18" + ) + return None + + symbol_table_name = vmlinux.symbol_table_name + list_type_symname = f"{symbol_table_name}{constants.BANG}{list_type}" + + layer = self._context.layers[self._layer_name] + + # Even when bpf_jit_kallsyms is disabled (/proc/sys/net/core/bpf_jit_kallsyms = 0), + # this function will still be able to gather the symbols. + bpf_kallsyms_list = vmlinux.object_from_symbol("bpf_kallsyms") + for elem in bpf_kallsyms_list.to_list(list_type_symname, list_head_member): + # See kernel's bpf_get_kallsym() + if list_type == "bpf_ksym": + # kernels >= 5.8 + bpf_ksym = elem + sym_name = utility.array_to_string(bpf_ksym.name) + sym_addr = bpf_ksym.start + sym_size = bpf_ksym.end - bpf_ksym.start + else: + # list_type == "bpf_prog_aux" 3.18 <= kernels < 5.8 + bpf_prog_aux = elem + bpf_prog = bpf_prog_aux.prog + sym_name = bpf_prog.get_name() + sym_addr = bpf_prog.bpf_func + sym_start, sym_end = bpf_prog.get_address_region() + sym_size = sym_end - sym_start + + # The following are also hardcoded in the Linux kernel + # see kernel's get_ksymbol_bpf(), bpf_get_kallsym() and BPF_SYM_ELF_TYPE + module_name = self._BPF_MODULE_NAME + sym_type = self._BPF_SYM_TYPE + sym_addr &= layer.address_mask + + kas_symbol = KASSymbol( + name=sym_name, + type=sym_type, + address=sym_addr, + size=sym_size, + module_name=module_name, + subsystem=self._BPF_SUBSYSTEM_NAME, + ) + kas_symbol.set_exported_from_type() + yield kas_symbol + + def get_all_symbols(self) -> Iterator[KASSymbol]: + """Enumerates each kallsym symbol + + Yields: + KASSymbol objects + """ + yield from self.get_core_symbols() + yield from self.get_modules_symbols() + yield from self.get_ftrace_symbols() + yield from self.get_bpf_symbols() + + def bpf_lookup_address(self, address: int) -> Optional[KASSymbol]: + """Search for a BPF symbol based on its memory address. + + Based on bpf_address_lookup() and __bpf_address_lookup() + + Args: + address: The memory address to search for + + Returns: + The matching KASSymbol if found; otherwise, returns None + """ + vmlinux = self._context.modules[self._module_name] + + if vmlinux.has_type("bpf_ksym"): + # kernels >= 5.7 535911c80ad4f5801700e9d827a1985bbff41519 + bpf_ksym = self._find_bpf_ksym(address) + if not bpf_ksym: + return None + symbol_start = bpf_ksym.start + symbol_end = bpf_ksym.end + sym_name = utility.array_to_string(bpf_ksym.name) + sym_size = symbol_end - symbol_start + elif vmlinux.has_type("latch_tree_root") and vmlinux.get_type( + "bpf_prog_aux" + ).child_template("ksym_tnode"): + # For 4.11 <= kernels < 5.7 + # latch_tree_root was added in kernels 4.2 ade3f510f93a5613b672febe88eff8ea7f1c63b7 + # BPF kallsyms support was added in kernels 4.11 74451e66d516c55e309e8d89a4a1e7596e46aacd + bpf_prog = self._find_bpf_prog(address) + if not bpf_prog: + return None + + symbol_start, symbol_end = bpf_prog.get_addr_region() + sym_name = bpf_prog.get_name() + sym_size = symbol_end - symbol_start + else: + # kernel < 4.11 + vollog.warning( + "Unsupported BPF kallsyms implementation. Ignore this if it's a kernel < 4.11" + ) + return None + + layer = self._context.layers[self._layer_name] + symbol_start &= layer.address_mask + + kas_symbol = KASSymbol( + name=sym_name, + type=self._BPF_SYM_TYPE, + address=symbol_start, + size=sym_size, + module_name=self._BPF_MODULE_NAME, + subsystem=self._BPF_SUBSYSTEM_NAME, + ) + kas_symbol.set_exported_from_type() + return kas_symbol + + def _find_bpf_prog( + self, address: int + ) -> Optional[interfaces.objects.ObjectInterface]: + """Search for a BPF program based on its address. + Based on __bpf_address_lookup & bpf_prog_kallsyms_find() for kernels < 5.7 + + Args: + address: The BPF symbol address to search for + + Returns: + A bpf_prog object if found; otherwise, returns None. + """ + vmlinux = self._context.modules[self._module_name] + if not self._kas_config.bpf_tree_address: + return None + + bpf_latch_tree_root = vmlinux.object( + object_type="latch_tree_root", + offset=self._kas_config.bpf_tree_address, + absolute=True, + ) + latch_tree_node = bpf_latch_tree_root.find( + address, self._bpf_tree_comp_bpf_prog_aux + ) + + if not latch_tree_node: + return None + + bpf_prog_aux = linux.LinuxUtilities.container_of( + latch_tree_node.vol.offset, "bpf_prog_aux", "ksym_tnode", vmlinux + ) + bpf_prog = bpf_prog_aux.prog + return bpf_prog + + def _bpf_tree_comp_bpf_prog_aux( + self, address: int, latch_tree_node: interfaces.objects.ObjectInterface + ) -> int: + """Comparison function used by _find_bpf_prog() + Based on bpf_tree_comp for kernels < 5.7 + + Args: + address: The memory address to search for + latch_tree_node: A latch tree node + + Returns: + 0: equal, >0: key is greater, <0: key is less than this bpf_prog + """ + vmlinux = self._context.modules[self._module_name] + layer = self._context.layers[self._layer_name] + bpf_prog_aux = linux.LinuxUtilities.container_of( + latch_tree_node.vol.offset, "bpf_prog_aux", "ksym_tnode", vmlinux + ) + bpf_prog = bpf_prog_aux.prog + bpf_start, bpf_end = bpf_prog.get_address_region() + bpf_start &= layer.address_mask + bpf_end &= layer.address_mask + + if address < bpf_start: + return -1 + elif address > bpf_end: + # Keep 'key > end' instead of 'key >= end'. This detects return addresses + # within the program when the final instruction in a stack trace is a call. + return 1 + else: + return 0 + + def _find_bpf_ksym( + self, address: int + ) -> Optional[interfaces.objects.ObjectInterface]: + """Search for the respective bpf_ksym based on a symbol address. + Based on __bpf_address_lookup & bpf_ksym_find() for kernels >= 5.7 + + Args: + address: The memory address to search for + + Returns: + A bpf_ksym object if found; otherwise, returns None. + """ + vmlinux = self._context.modules[self._module_name] + if not self._kas_config.bpf_tree_address: + return None + + bpf_latch_tree_root = vmlinux.object( + object_type="latch_tree_root", + offset=self._kas_config.bpf_tree_address, + absolute=True, + ) + latch_tree_node = bpf_latch_tree_root.find( + address, self._bpf_tree_comp_bpf_ksym + ) + if not latch_tree_node: + return None + + bpf_ksym = linux.LinuxUtilities.container_of( + latch_tree_node.vol.offset, "bpf_ksym", "tnode", vmlinux + ) + return bpf_ksym + + def _bpf_tree_comp_bpf_ksym( + self, address: int, latch_tree_node: interfaces.objects.ObjectInterface + ) -> int: + """Comparison function used by _find_bpf_ksym. + + Based on bpf_tree_comp in kernels >= 5.7 + + Args: + address: The memory address to search for + latch_tree_node: A latch tree node + + Returns: + 0: equal, >0: key is greater, <0: key is less than this bpf_prog + """ + # + vmlinux = self._context.modules[self._module_name] + layer = self._context.layers[self._layer_name] + bpf_ksym = linux.LinuxUtilities.container_of( + latch_tree_node.vol.offset, "bpf_ksym", "tnode", vmlinux + ) + bpf_start = bpf_ksym.start & layer.address_mask + bpf_end = bpf_ksym.end & layer.address_mask + + if address < bpf_start: + return -1 + elif address > bpf_end: + # Keep 'address > bpf_end' instead of 'address >= bpf_end'. This detects return + # addresses within the program when the final instruction in a stack trace is a call. + return 1 + else: + return 0 + + def ftrace_lookup_address(self, address: int) -> Optional[KASSymbol]: + """Search for a ftrace symbol based on its address. + + Based on ftrace_mod_address_lookup() + + Args: + address: The memory address to search for + + Returns: + The matching KASSymbol if found, or None if no match is found. + """ + + # Filter by address and return only the first matching result. + for kassymbol in self._ftrace_mod_get_symbols(address): + return kassymbol + + for kassymbol in self._ftrace_get_trampoline_symbols(address): + return kassymbol + + return None + + def _core_lookup_name_slow(self, name) -> Optional[KASSymbol]: + """Search a core symbol by name + + Based on kallsyms_lookup_name in kernels < 6.2 + + Args: + name: The symbol name to search for. + + Returns: + A KASSymbol object + """ + # kernels < 6.2 60443c88f3a89fd303a9e8c0e84895910675c316 + current_offset = 0 + for sym_idx in range(self._kallsyms_num_syms): + kassymbol, compressed_length = self._get_symbol(current_offset, sym_idx) + if kassymbol and name == kassymbol.name: + return kassymbol + + current_offset += compressed_length + 1 + + return None + + @functools.cached_property + def _kallsyms_seqs_of_names(self): + vmlinux = self._context.modules[self._module_name] + symbol_table_name = vmlinux.symbol_table_name + unsigned_char_symname = symbol_table_name + constants.BANG + "unsigned char" + # See 19bd8981dc2ee35fdc81ab1b0104b607c917d470: 3 bytes per index + array_size = 3 * self._kallsyms_num_syms + kallsyms_seqs_of_names = vmlinux.object( + object_type="array", + offset=self._kas_config.seqs_of_names_address, + subtype=vmlinux.get_type(unsigned_char_symname), + count=array_size, + absolute=True, + ) + return kallsyms_seqs_of_names + + def _get_symbol_seq(self, index: int) -> int: + # See 19bd8981dc2ee35fdc81ab1b0104b607c917d470 + bits = 3 + seq = 0 + for i in range(bits): + seq = (seq << 8) | self._kallsyms_seqs_of_names[bits * index + i] + return seq + + def _get_symbol_by_index(self, index) -> Tuple[KASSymbolBasic, int]: + seq = self._get_symbol_seq(index) + offset = self._get_symbol_offset(seq) + kassymbolbasic, _compressed_length = self._expand_symbol(offset) + return kassymbolbasic + + def _lookup_name_index(self, name: str) -> Optional[int]: + # based on kallsyms_lookup_names + high = self._kallsyms_num_syms - 1 + low = 0 + + while low <= high: + mid = (low + high) // 2 + kassymbolbasic = self._get_symbol_by_index(mid) + if not kassymbolbasic: + return None + + ret = self._cmp_symbol_name(name, kassymbolbasic.name) + if ret > 0: + low = mid + 1 + elif ret < 0: + high = mid - 1 + else: + break + + if low > high: + # Not found + return None + + low = mid + while low: + kassymbolbasic = self._get_symbol_by_index(low - 1) + if not kassymbolbasic: + return None + if self._cmp_symbol_name(name, kassymbolbasic.name) != 0: + return low + low -= 1 + + return None + + def _core_lookup_name_fast(self, name: str) -> Optional[KASSymbol]: + """Search a core symbol by name + + Based on kallsyms_lookup_name in kernels >= 6.2 + + Args: + name: The symbol name to search for + + Returns: + A KASSymbol object + """ + # kernels >= 6.2 60443c88f3a89fd303a9e8c0e84895910675c316 + index = self._lookup_name_index(name) + if not index: + return None + + seq = self._get_symbol_seq(index) + offset = self._get_symbol_offset(seq) + kassymbolbasic, _compressed_length = self._expand_symbol(offset) + sym_address = self._get_symbol_address_by_index(seq) + _seq, sym_size = self._get_symbol_pos(sym_address) + + kas_symbol = KASSymbol( + name=kassymbolbasic.name, + type=kassymbolbasic.type, + address=sym_address, + size=sym_size, + module_name=self._CORE_MODULE_NAME, + subsystem=self._CORE_SUBSYSTEM_NAME, + ) + kas_symbol.set_exported_from_type() + return kas_symbol + + def _kallsyms_lookup_name_modules(self, name: str) -> Optional[KASSymbol]: + """_summary_ + + Based on module_kallsyms_lookup_name + + Args: + name: The symbol name to search for. + + Returns: + A KASSymbol object + """ + for kassymbol in self.get_modules_symbols(name): + if name == kassymbol.name: + # First match only + return kassymbol + return None + + def lookup_name(self, name: str) -> Optional[KASSymbol]: + """Search symbols by name. + WARNING: This function is super slow. The kernel does not index the symbols by + name, so the it is a linear search. + + Based on kallsyms_lookup_name + + Args: + name: The symbol name to search for. + + Returns: + A KASSymbol object + """ + if self._kas_config.seqs_of_names_address: + # kernels >= 6.2: + # 60443c88f3a89fd303a9e8c0e84895910675c316 and 19bd8981dc2ee35fdc81ab1b0104b607c917d470 + kassymbol = self._core_lookup_name_fast(name) + else: + # kernels < 6.2 + kassymbol = self._core_lookup_name_slow(name) + + if kassymbol: + return kassymbol + + return self._kallsyms_lookup_name_modules(name) From 97135a992a4eb01c07f3bd0eae50a172ef96389b Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 16:42:18 +1100 Subject: [PATCH 0535/1352] linux: add Kallsyms plugin --- .../framework/plugins/linux/kallsyms.py | 89 +++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 volatility3/framework/plugins/linux/kallsyms.py diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py new file mode 100644 index 000000000..9c48ed8b8 --- /dev/null +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -0,0 +1,89 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List, Union + +from volatility3.framework import interfaces, renderers +from volatility3.framework.interfaces import plugins +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.constants import architectures +from volatility3.framework.symbols.linux import kallsyms + + +vollog = logging.getLogger(__name__) + + +class Kallsyms(plugins.PluginInterface): + """Kallsyms symbols enumeration plugin""" + + _required_framework_version = (2, 19, 0) + + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.VersionRequirement( + name="Kallsyms", component=kallsyms.Kallsyms, version=(1, 0, 0) + ), + ] + + def _get_symbol_size( + self, kassymbol: kallsyms.KASSymbol + ) -> Union[int, interfaces.renderers.BaseAbsentValue]: + # Symbol sizes are calculated using the address of the next non-aliased + # symbol or the end of the kernel text area _end/_etext. However, some kernel + # symbols live beyond that area. For these symbols, the size will be negative, + # resulting in incorrect values. Unfortunately, there isn't much that can be done + # in such cases. + # See comments on .init.scratch in arch/x86/kernel/vmlinux.lds.S for details + return kassymbol.size if kassymbol.size >= 0 else renderers.NotAvailableValue() + + def _generator(self): + module_name = self.config["kernel"] + vmlinux = self.context.modules[module_name] + + kas = kallsyms.Kallsyms( + context=self.context, + layer_name=vmlinux.layer_name, + module_name=self.config["kernel"], + ) + + for kassymbol in kas.get_all_symbols(): + # Symbol sizes are calculated using the address of the next non-aliased + # symbol or the end of the kernel text area _end/_etext. However, some kernel + # symbols are located beyond that area, which causes this method to fail for + # the last symbol, resulting in a negative size. + # See comments on .init.scratch in arch/x86/kernel/vmlinux.lds.S for details + symbol_size = self._get_symbol_size(kassymbol) + fields = ( + format_hints.Hex(kassymbol.address), + kassymbol.type, + symbol_size, + kassymbol.exported, + kassymbol.subsystem, + kassymbol.module_name, + kassymbol.name, + kassymbol.type_description or renderers.NotAvailableValue(), + ) + yield 0, fields + + def run(self): + headers = [ + ("Addr", format_hints.Hex), + ("Type", str), + ("Size", int), + ("Exported", bool), + ("SubSystem", str), + ("ModuleName", str), + ("SymbolName", str), + ("Description", str), + ] + return renderers.TreeGrid(headers, self._generator()) From d665fcc2b5596c5571d302f44f529515b0465822 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 17:37:24 +1100 Subject: [PATCH 0536/1352] linux: kallsyms plugin: Enable filtering of symbols by subsystem --- .../framework/plugins/linux/kallsyms.py | 87 +++++++++++++++---- 1 file changed, 68 insertions(+), 19 deletions(-) diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py index 9c48ed8b8..c97fafbcf 100644 --- a/volatility3/framework/plugins/linux/kallsyms.py +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -16,7 +16,12 @@ vollog = logging.getLogger(__name__) class Kallsyms(plugins.PluginInterface): - """Kallsyms symbols enumeration plugin""" + """Kallsyms symbols enumeration plugin. + + If no arguments are provided, all symbols are included: core, modules, ftrace, and BPF. + Alternatively, you can use any combination of --only-core, --only-modules, --only-ftrace, + and --only-bpf to customize the output. + """ _required_framework_version = (2, 19, 0) @@ -33,6 +38,30 @@ class Kallsyms(plugins.PluginInterface): requirements.VersionRequirement( name="Kallsyms", component=kallsyms.Kallsyms, version=(1, 0, 0) ), + requirements.BooleanRequirement( + name="only_core", + description="Include core symbols", + default=False, + optional=True, + ), + requirements.BooleanRequirement( + name="only_modules", + description="Include module symbols", + default=False, + optional=True, + ), + requirements.BooleanRequirement( + name="only_ftrace", + description="Include ftrace symbols", + default=False, + optional=True, + ), + requirements.BooleanRequirement( + name="only_bpf", + description="Include bpf symbols", + default=False, + optional=True, + ), ] def _get_symbol_size( @@ -56,24 +85,44 @@ class Kallsyms(plugins.PluginInterface): module_name=self.config["kernel"], ) - for kassymbol in kas.get_all_symbols(): - # Symbol sizes are calculated using the address of the next non-aliased - # symbol or the end of the kernel text area _end/_etext. However, some kernel - # symbols are located beyond that area, which causes this method to fail for - # the last symbol, resulting in a negative size. - # See comments on .init.scratch in arch/x86/kernel/vmlinux.lds.S for details - symbol_size = self._get_symbol_size(kassymbol) - fields = ( - format_hints.Hex(kassymbol.address), - kassymbol.type, - symbol_size, - kassymbol.exported, - kassymbol.subsystem, - kassymbol.module_name, - kassymbol.name, - kassymbol.type_description or renderers.NotAvailableValue(), - ) - yield 0, fields + only_core = self.config.get("only_core", False) + only_modules = self.config.get("only_modules", False) + only_ftrace = self.config.get("only_ftrace", False) + only_bpf = self.config.get("only_bpf", False) + + symbols_flags = (only_core, only_modules, only_ftrace, only_bpf) + if not any(symbols_flags): + only_core = only_modules = only_ftrace = only_bpf = True + + symbol_geneators = [] + if only_core: + symbol_geneators.append(kas.get_core_symbols()) + if only_modules: + symbol_geneators.append(kas.get_modules_symbols()) + if only_ftrace: + symbol_geneators.append(kas.get_ftrace_symbols()) + if only_bpf: + symbol_geneators.append(kas.get_bpf_symbols()) + + for symbols_generator in symbol_geneators: + for kassymbol in symbols_generator: + # Symbol sizes are calculated using the address of the next non-aliased + # symbol or the end of the kernel text area _end/_etext. However, some kernel + # symbols are located beyond that area, which causes this method to fail for + # the last symbol, resulting in a negative size. + # See comments on .init.scratch in arch/x86/kernel/vmlinux.lds.S for details + symbol_size = self._get_symbol_size(kassymbol) + fields = ( + format_hints.Hex(kassymbol.address), + kassymbol.type, + symbol_size, + kassymbol.exported, + kassymbol.subsystem, + kassymbol.module_name, + kassymbol.name, + kassymbol.type_description or renderers.NotAvailableValue(), + ) + yield 0, fields def run(self): headers = [ From fbba4c76751f07ff5a9127ebb8128a89c5c5b58e Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 17:53:39 +1100 Subject: [PATCH 0537/1352] linux: new pscallstack plugin: add a poor man's process stack call enumeration plugin to showcase the power of the kallsyms API --- .../framework/plugins/linux/pscallstack.py | 196 ++++++++++++++++++ 1 file changed, 196 insertions(+) create mode 100644 volatility3/framework/plugins/linux/pscallstack.py diff --git a/volatility3/framework/plugins/linux/pscallstack.py b/volatility3/framework/plugins/linux/pscallstack.py new file mode 100644 index 000000000..468a7e1ba --- /dev/null +++ b/volatility3/framework/plugins/linux/pscallstack.py @@ -0,0 +1,196 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import dataclasses +from typing import List, Iterator + +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.constants import architectures +from volatility3.framework.objects import utility +from volatility3.framework.symbols.linux import kallsyms +from volatility3.plugins.linux import pslist + +vollog = logging.getLogger(__name__) + + +@dataclasses.dataclass +class StackEntry: + position: int + address: int + value: int + name: str = renderers.NotAvailableValue() + type: str = renderers.NotAvailableValue() + module: str = renderers.NotAvailableValue() + + +class PsCallStack(plugins.PluginInterface): + """Enumerates the call stack of each task""" + + _required_framework_version = (2, 19, 0) + + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.VersionRequirement( + name="Kallsyms", component=kallsyms.Kallsyms, version=(1, 0, 0) + ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + ), + requirements.ListRequirement( + name="pid", + description="Filter on specific process IDs", + element_type=int, + optional=True, + ), + requirements.BooleanRequirement( + name="unresolved", + description="Include unresolved stack values", + default=False, + optional=True, + ), + ] + + @classmethod + def get_task_callstack( + cls, + context: interfaces.context.ContextInterface, + module_name: str, + task: interfaces.objects.ObjectInterface, + kas: kallsyms.Kallsyms = None, + include_unresolved=False, + ) -> Iterator[StackEntry]: + """Retrieves the call stack for a given task + + Args: + context: The context used to access memory layers and symbols + module_name: The name of the kernel module on which to operate + task: The task object whose stack is being retrieved + kas: Kallsyms instance for symbol resolution. If not provided or None, a new + instance will be created each time + include_unresolved: If True, includes stack values that could not be resolved + to known symbols. Defaults to False. + + Yields: + StackEntry objects + """ + task_layer = task.get_address_space_layer() + if not task_layer: + return None + + vmlinux = context.modules[module_name] + vmlinux_layer = context.layers[vmlinux.layer_name] + + if not kas: + kas = kallsyms.Kallsyms( + context=context, + layer_name=vmlinux.layer_name, + module_name=module_name, + ) + + pointer_size = vmlinux.get_type("pointer").size + + thread_size_order = 2 # Safe since kernel 3.15 + # thread_size_order +=1 # If CONFIG_KASAN is enabled in kernels >= 4.0, default: DISABLED + # thread_size_order +=1 # If CONFIG_KASAN_EXTRA is enabled in kernels >= 4.19, default: DISABLED + thread_size = vmlinux_layer.page_size << thread_size_order + task_base_of_stack = vmlinux_layer.canonicalize(task.stack) + task_top_of_stack = task_base_of_stack + thread_size + + byte_order = task.files.vol.data_format.byteorder + rsp_start = task.thread.sp + if not (task_base_of_stack <= rsp_start < task_top_of_stack): + raise exceptions.VolatilityException( + f"Invalid stack pointer {rsp_start:#x} for task {task.pid}" + ) + + current_sp = rsp_start + idx = 0 + while current_sp < task_top_of_stack: + stack_value_bytes = task_layer.read(current_sp, pointer_size) + stack_value = int.from_bytes(stack_value_bytes, byteorder=byte_order) + + kassymbol = kas.lookup_address(stack_value) + if kassymbol: + module_name = kassymbol.module_name or renderers.NotAvailableValue() + yield StackEntry( + position=idx, + address=current_sp, + value=stack_value, + name=kassymbol.name, + type=kassymbol.type, + module=module_name, + ) + elif include_unresolved: + yield StackEntry( + position=idx, + address=current_sp, + value=stack_value, + ) + + idx += 1 + current_sp += pointer_size + + def _generator(self): + module_name = self.config["kernel"] + vmlinux = self.context.modules[module_name] + + kas = kallsyms.Kallsyms( + context=self.context, + layer_name=vmlinux.layer_name, + module_name=self.config["kernel"], + ) + + include_unresolved = self.config.get("unresolved", False) + + pids = self.config.get("pid", None) + filter_func = pslist.PsList.create_pid_filter(pids) + for task in pslist.PsList.list_tasks( + self.context, vmlinux.name, filter_func=filter_func, include_threads=True + ): + task_name = utility.array_to_string(task.comm) + + for stack_entry in self.get_task_callstack( + context=self.context, + module_name=vmlinux.name, + task=task, + kas=kas, + include_unresolved=include_unresolved, + ): + fields = ( + task.pid, + task_name, + stack_entry.position, + format_hints.Hex(stack_entry.address), + format_hints.Hex(stack_entry.value), + stack_entry.name, + stack_entry.type, + stack_entry.module, + ) + yield 0, fields + + def run(self): + return renderers.TreeGrid( + [ + ("TID", int), + ("Comm", str), + ("Position", int), + ("Address", format_hints.Hex), + ("Value", format_hints.Hex), + ("Name", str), + ("Type", str), + ("Module", str), + ], + self._generator(), + ) From 4469ab49c80f5756fe150246c5645a569476294f Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 18:12:51 +1100 Subject: [PATCH 0538/1352] linux: kallsyms api: move the unsupport implementation message to the info log level --- volatility3/framework/symbols/linux/kallsyms.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index 5310c8393..a113dd6b1 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -1101,7 +1101,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): vmlinux.has_type("ftrace_mod_map") and vmlinux.has_type("ftrace_mod_func") ): # kernel < 4.15 aba4b5c22cbac296f4081a0476d0c55828f135b4 - vollog.warning( + vollog.info( "Unsupported Ftrace kallsyms implementation. Ignore this if it's a kernel < 4.15" ) return None @@ -1208,7 +1208,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): list_type, list_head_member = "bpf_prog_aux", "ksym_lnode" else: # kernels < 3.18 - vollog.warning( + vollog.info( "Unsupported BPF kallsysms implementation. Don't worry if kernel < 3.18" ) return None @@ -1303,7 +1303,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): sym_size = symbol_end - symbol_start else: # kernel < 4.11 - vollog.warning( + vollog.info( "Unsupported BPF kallsyms implementation. Ignore this if it's a kernel < 4.11" ) return None From 9175c1b1e96240ebb2947309043ec0416e44da2d Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 20:43:01 +1100 Subject: [PATCH 0539/1352] linux: kallsyms api: ensure all the addresses are in the same range --- volatility3/framework/symbols/linux/kallsyms.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index a113dd6b1..493a82538 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -495,6 +495,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): Returns: Symbol address """ + layer = self._context.layers[self._layer_name] if self._kallsyms_offsets_address: # kernels >= 4.6 - Addresses are relative to kallsyms_relative_base # It assumes: CONFIG_KALLSYMS_BASE_RELATIVE=y and CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y @@ -507,7 +508,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): return self._kallsyms_relative_base - 1 - sym_addr # Positive offsets are absolute values - return sym_addr + return sym_addr & layer.address_mask elif self._kas_config.addresses_address: # kernels < 4.6 - Addresses are absolute # unsigned long kallsyms_addresses[] @@ -516,7 +517,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): self._long_size, signed=False, ) - return kallsyms_address + return kallsyms_address & layer.address_mask else: raise exceptions.VolatilityException("Unsupported kernel") From 2af8b95ea43a701289e1738e3833f36df9b9e960 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 20:49:42 +1100 Subject: [PATCH 0540/1352] linux: module object extension: add method to know the module memory boundaries based on its symbols addresses and sizes --- .../symbols/linux/extensions/__init__.py | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index fd5e85057..cd7dc5e9d 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -270,6 +270,43 @@ class module(generic.GenericIntelProcess): sym_address = elf_sym_obj.st_value & layer.address_mask yield (sym_name, sym_address) + @functools.lru_cache + def get_module_address_boundaries(self) -> Tuple[int, int]: + """Return the module address boundaries based on its symbol addresses""" + + if not self.section_strtab or self.num_symtab < 1: + return None + + elf_table_name = self.get_elf_table_name() + symbol_table_name = self.get_symbol_table_name() + + is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) + sym_name = "Elf64_Sym" if is_64bit else "Elf32_Sym" + sym_type = self._context.symbol_space.get_type( + elf_table_name + constants.BANG + sym_name + ) + elf_syms = self._context.object( + symbol_table_name + constants.BANG + "array", + layer_name=self.vol.layer_name, + offset=self.section_symtab, + subtype=sym_type, + count=self.num_symtab, + ) + # They should be sorted, but just in case + elf_syms_sorted = sorted(elf_syms, key=lambda x: x.st_value) + + layer = self._context.layers[self.vol.layer_name] + + # The first elf_sym is null + first_symbol = elf_syms_sorted[1] + last_symbol = elf_syms_sorted[-1] + minimum_address = first_symbol.st_value & layer.address_mask + maximum_address = ( + last_symbol.st_value & layer.address_mask + last_symbol.st_size + ) + + return minimum_address, maximum_address + def get_symbol(self, wanted_sym_name) -> Optional[int]: """Get symbol address for a given symbol name""" for sym_name, sym_address in self.get_symbols_names_and_addresses(): From 0ba331f34c4dbfe67997b3155402745081c5baeb Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 20:53:57 +1100 Subject: [PATCH 0541/1352] linux: kallsyms api: Added support for older kernels lacking mod_tree. Enhanced module address search performance by using the new module memory boundaries function --- .../framework/symbols/linux/kallsyms.py | 47 +++++++++++++++---- 1 file changed, 39 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index 493a82538..264c13d3e 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -788,15 +788,27 @@ class Kallsyms(interfaces.configuration.VersionableInterface): if not self._is_module_ksym_address(address): return None - module = module or self.get_module_by_address(address) + module = module or self._get_module_by_address(address) if not module: + # This may occur if the kernel lacks the mod_tree implementation. + for ( + cur_module, + minimum_address, + maximum_address, + ) in self._module_memory_region: + if minimum_address <= address < maximum_address: + module = cur_module + break + + if not module: + # We couldn't find the module return None kassymbol = self._find_address_in_module_symbols(module, address) - if not kassymbol: - return None + if kassymbol: + return kassymbol - return kassymbol + return None def _find_address_in_module_symbols( self, @@ -814,6 +826,15 @@ class Kallsyms(interfaces.configuration.VersionableInterface): Returns: The matching KASSymbol if found; otherwise, returns None """ + # Before walking all the symbols, ensure the address belongs to this module + module_boundaries = module.get_module_address_boundaries() + if not module_boundaries: + return None + + minimum_address, maximum_address = module_boundaries + if not (minimum_address <= address < maximum_address): + return None + layer = self._context.layers[self._layer_name] for elf_sym_idx, elf_sym in enumerate(module.get_symbols()): if not elf_sym.get_name(): @@ -829,6 +850,18 @@ class Kallsyms(interfaces.configuration.VersionableInterface): return None + @functools.cached_property + def _module_memory_region( + self, + ) -> List[Tuple[interfaces.objects.ObjectInterface, int, int]]: + modules_region = [] + for module in lsmod.Lsmod.list_modules(self._context, self._module_name): + minimum_address, maximum_address = module.get_module_address_boundaries() + module_region = module, minimum_address, maximum_address + modules_region.append(module_region) + + return modules_region + @functools.lru_cache def _get_modules_memory_boundaries(self) -> Tuple[int, int]: """Determine the boundaries of the module allocation area @@ -870,7 +903,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): _address_min, address_max = self._get_modules_memory_boundaries() return address_max - def get_module_by_address( + def _get_module_by_address( self, address: int ) -> Optional[interfaces.objects.ObjectInterface]: """Searches for the module that contains the given memory address within its range. @@ -957,12 +990,10 @@ class Kallsyms(interfaces.configuration.VersionableInterface): ) module_ptr = mod_tree_node.mod if not module_ptr.is_readable(): - vollog.error("Something went wrong") + vollog.warning("Modules latch tree seems corrupt") return None return module_ptr.dereference() - else: - raise NotImplementedError("FIXME") return None From 1da15d13529f372a7afdef396aaeae0b7d57fac5 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sat, 1 Feb 2025 20:54:51 +1100 Subject: [PATCH 0542/1352] linux: pscallstack plugin: Fix canonical addresses --- volatility3/framework/plugins/linux/pscallstack.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pscallstack.py b/volatility3/framework/plugins/linux/pscallstack.py index 468a7e1ba..8931ca581 100644 --- a/volatility3/framework/plugins/linux/pscallstack.py +++ b/volatility3/framework/plugins/linux/pscallstack.py @@ -122,11 +122,13 @@ class PsCallStack(plugins.PluginInterface): stack_value = int.from_bytes(stack_value_bytes, byteorder=byte_order) kassymbol = kas.lookup_address(stack_value) + sp_address = current_sp & vmlinux_layer.address_mask + stack_value &= vmlinux_layer.address_mask if kassymbol: module_name = kassymbol.module_name or renderers.NotAvailableValue() yield StackEntry( position=idx, - address=current_sp, + address=sp_address, value=stack_value, name=kassymbol.name, type=kassymbol.type, @@ -135,7 +137,7 @@ class PsCallStack(plugins.PluginInterface): elif include_unresolved: yield StackEntry( position=idx, - address=current_sp, + address=sp_address, value=stack_value, ) From df310c0d92cc274ef6bc49d97decaacca31f0553 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 1 Feb 2025 12:27:49 +0000 Subject: [PATCH 0543/1352] Manually revert 74a834b This should resolve the issue experienced #1590 was trying to resolve. --- volatility3/framework/symbols/linux/extensions/__init__.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 7103a2068..c24b495d8 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1574,9 +1574,7 @@ class vfsmount(objects.StructType): 'True' if the kernel lacks the 'mount' struct, typically indicating kernel < 3.3. """ - return (not self._context.symbol_space.has_type("mount")) and self.has_member( - "mnt_parent" - ) + return self.has_member("mnt_parent") def is_equal(self, vfsmount_ptr) -> bool: """Helper to make sure it is comparing two pointers to 'vfsmount'. From 80f6d0dad685bbcf2b7195c5d077d5ce83840a59 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sun, 2 Feb 2025 11:33:34 +1100 Subject: [PATCH 0544/1352] linux: Add kallsyms plugin testcase --- test/test_volatility.py | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index 8676d1f3e..5b57dd59d 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -842,6 +842,27 @@ def test_linux_hidden_modules(image, volatility, python): assert out.count(b"\n") >= 4 +def test_linux_kallsyms(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.kallsyms.Kallsyms", + image, + volatility, + python, + pluginargs=["--only-modules"], + ) + # linux-sample-1.bin has no hidden modules. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") > 1000 + + # Addr Type Size Exported SubSystem ModuleName SymbolName Description + # 0xffffa009eba9 t 28 False module usbcore usb_mon_register Symbol is in the text (code) section + assert re.search( + rb"0xffffa009eba9\s+t\s+28\s+False\s+module\s+usbcore\s+usb_mon_register\s+Symbol is in the text \(code\) section", + out, + ) + + # MAC From 5347926ab6b0800fa90673bed09a830fb4d1a73c Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sun, 2 Feb 2025 11:34:31 +1100 Subject: [PATCH 0545/1352] linux: Add pscallstack plugin testcase --- test/test_volatility.py | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/test/test_volatility.py b/test/test_volatility.py index 5b57dd59d..bc63ab356 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -863,6 +863,26 @@ def test_linux_kallsyms(image, volatility, python): ) +def test_linux_pscallstack(image, volatility, python): + rc, out, _err = runvol_plugin( + "linux.pscallstack.PsCallStack", + image, + volatility, + python, + pluginargs=["--pid", "1"], + ) + + assert rc == 0 + assert out.count(b"\n") > 30 + + # TID Comm Position Address Value Name Type Module + # 1 init 39 0x88001f999a40 0xffff81109039 do_select T kernel + assert re.search( + rb"1\s+init\s+39\s+0x88001f999a40.*?0xffff81109039\s+do_select\s+T\s+kernel", + out, + ) + + # MAC From bf0271cd5765d656cc9a3844bb8b5c7e69e650ec Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Sun, 2 Feb 2025 12:29:01 +1100 Subject: [PATCH 0546/1352] linux: kallsyms plugin: simplify argument by removing the "only-" prefix, which was also causing confusion. --- test/test_volatility.py | 2 +- .../framework/plugins/linux/kallsyms.py | 34 +++++++++---------- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index bc63ab356..d5b59b15c 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -848,7 +848,7 @@ def test_linux_kallsyms(image, volatility, python): image, volatility, python, - pluginargs=["--only-modules"], + pluginargs=["--modules"], ) # linux-sample-1.bin has no hidden modules. # This validates that plugin requirements are met and exceptions are not raised. diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py index c97fafbcf..c575c54e7 100644 --- a/volatility3/framework/plugins/linux/kallsyms.py +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -19,8 +19,8 @@ class Kallsyms(plugins.PluginInterface): """Kallsyms symbols enumeration plugin. If no arguments are provided, all symbols are included: core, modules, ftrace, and BPF. - Alternatively, you can use any combination of --only-core, --only-modules, --only-ftrace, - and --only-bpf to customize the output. + Alternatively, you can use any combination of --core, --modules, --ftrace, and --bpf + to customize the output. """ _required_framework_version = (2, 19, 0) @@ -39,26 +39,26 @@ class Kallsyms(plugins.PluginInterface): name="Kallsyms", component=kallsyms.Kallsyms, version=(1, 0, 0) ), requirements.BooleanRequirement( - name="only_core", + name="core", description="Include core symbols", default=False, optional=True, ), requirements.BooleanRequirement( - name="only_modules", + name="modules", description="Include module symbols", default=False, optional=True, ), requirements.BooleanRequirement( - name="only_ftrace", + name="ftrace", description="Include ftrace symbols", default=False, optional=True, ), requirements.BooleanRequirement( - name="only_bpf", - description="Include bpf symbols", + name="bpf", + description="Include BPF symbols", default=False, optional=True, ), @@ -85,23 +85,23 @@ class Kallsyms(plugins.PluginInterface): module_name=self.config["kernel"], ) - only_core = self.config.get("only_core", False) - only_modules = self.config.get("only_modules", False) - only_ftrace = self.config.get("only_ftrace", False) - only_bpf = self.config.get("only_bpf", False) + include_core = self.config.get("core", False) + include_modules = self.config.get("modules", False) + include_ftrace = self.config.get("ftrace", False) + include_bpf = self.config.get("bpf", False) - symbols_flags = (only_core, only_modules, only_ftrace, only_bpf) + symbols_flags = (include_core, include_modules, include_ftrace, include_bpf) if not any(symbols_flags): - only_core = only_modules = only_ftrace = only_bpf = True + include_core = include_modules = include_ftrace = include_bpf = True symbol_geneators = [] - if only_core: + if include_core: symbol_geneators.append(kas.get_core_symbols()) - if only_modules: + if include_modules: symbol_geneators.append(kas.get_modules_symbols()) - if only_ftrace: + if include_ftrace: symbol_geneators.append(kas.get_ftrace_symbols()) - if only_bpf: + if include_bpf: symbol_geneators.append(kas.get_bpf_symbols()) for symbols_generator in symbol_geneators: From 144a7cc3f58ede3828f4f50d6e05abe6082fc91c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 2 Feb 2025 16:07:27 +0000 Subject: [PATCH 0547/1352] Add error checking when accessing the KVO Also bumps hivescan to take a module name rather than a layer_name/symbol_table combo. --- .../framework/configuration/requirements.py | 5 +-- volatility3/framework/interfaces/context.py | 8 ++++ .../framework/plugins/windows/bigpools.py | 8 +++- .../framework/plugins/windows/callbacks.py | 38 +++++++++++++++---- .../framework/plugins/windows/handles.py | 16 ++++++-- volatility3/framework/plugins/windows/info.py | 10 +++-- .../framework/plugins/windows/modules.py | 8 +++- .../framework/plugins/windows/pslist.py | 8 +++- .../framework/plugins/windows/psscan.py | 9 +++-- .../plugins/windows/registry/hivelist.py | 14 ++++--- .../plugins/windows/registry/hivescan.py | 31 +++++++-------- volatility3/framework/plugins/windows/ssdt.py | 5 +-- .../plugins/windows/unloadedmodules.py | 8 +++- .../framework/plugins/windows/vadinfo.py | 8 +++- .../framework/plugins/windows/virtmap.py | 3 +- .../symbols/windows/extensions/__init__.py | 29 ++++++++++---- 16 files changed, 143 insertions(+), 65 deletions(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 3e3608000..5dd8cc9b5 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -638,13 +638,10 @@ class ModuleRequirement( self.add_requirement( TranslationLayerRequirement(name="layer_name", architectures=architectures) ) - self.add_requirement(SymbolTableRequirement(name="symbol_table_name")) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - IntRequirement(name="offset"), - ] + return interfaces.context.ModuleInterface.get_requirements() def unsatisfied( self, context: "interfaces.context.ContextInterface", config_path: str diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index 723f2fd46..e7c3e579f 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -158,6 +158,14 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): super().__init__(context, config_path) self._module_name = name + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # Can't include the translation layer without knowing the architectures + return [ + SymbolTableRequirement(name="symbol_table_name"), + IntRequirement(name="offset"), + ] + @property def _layer_name(self) -> str: return self.config["layer_name"] diff --git a/volatility3/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py index 393c2a417..f6217ac50 100644 --- a/volatility3/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -21,7 +21,7 @@ class BigPools(interfaces.plugins.PluginInterface): """List big page pools.""" _required_framework_version = (2, 0, 0) - _version = (1, 1, 0) + _version = (1, 1, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -66,7 +66,11 @@ class BigPools(interfaces.plugins.PluginInterface): Yields: A big page pool object """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) big_page_table_offset = ntkrnlmp.get_symbol("PoolBigPageTable").address diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 414a8814a..9d54f4331 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -28,7 +28,7 @@ class Callbacks(interfaces.plugins.PluginInterface): """Lists kernel callbacks and notification routines.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -361,7 +361,11 @@ class Callbacks(interfaces.plugins.PluginInterface): A name, location and optional detail string """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) is_vista_or_later = versions.is_vista_or_later( @@ -418,7 +422,11 @@ class Callbacks(interfaces.plugins.PluginInterface): Lists all registry callbacks from the old format via the CmpCallBackVector. """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) full_type_name = ( callback_table_name + constants.BANG + "_EX_CALLBACK_ROUTINE_BLOCK" @@ -465,7 +473,11 @@ class Callbacks(interfaces.plugins.PluginInterface): Lists all registry callbacks via the CallbackListHead. """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) full_type_name = callback_table_name + constants.BANG + "_CM_CALLBACK_ENTRY" @@ -506,7 +518,11 @@ class Callbacks(interfaces.plugins.PluginInterface): A name, location and optional detail string """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) if ntkrnlmp.has_symbol("CmpCallBackVector") and ntkrnlmp.has_symbol( @@ -562,7 +578,11 @@ class Callbacks(interfaces.plugins.PluginInterface): A name, location and optional detail string """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) try: @@ -626,7 +646,11 @@ class Callbacks(interfaces.plugins.PluginInterface): A name, location and optional detail string """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) try: diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 6a391fe35..384528f0a 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -18,7 +18,7 @@ class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -144,7 +144,11 @@ class Handles(interfaces.plugins.PluginInterface): type_map: Dict[int, str] = {} - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) try: @@ -202,7 +206,11 @@ class Handles(interfaces.plugins.PluginInterface): except exceptions.SymbolError: return None - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) return context.object( symbol_table + constants.BANG + "unsigned int", layer_name, @@ -216,7 +224,7 @@ class Handles(interfaces.plugins.PluginInterface): kernel = self.context.modules[self.config["kernel"]] virtual = kernel.layer_name - kvo = self.context.layers[virtual].config["kernel_virtual_offset"] + kvo = kernel.offset ntkrnlmp = self.context.module( kernel.symbol_table_name, layer_name=virtual, offset=kvo diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index 137d29c22..efaf1f737 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -17,7 +17,7 @@ class Info(plugins.PluginInterface): """Show OS & kernel details of the memory sample being analyzed.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -68,7 +68,9 @@ class Info(plugins.PluginInterface): if not isinstance(virtual_layer, layers.intel.Intel): raise TypeError("Virtual Layer is not an intel layer") - kvo = virtual_layer.config["kernel_virtual_offset"] + kvo = virtual_layer.config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError("Intel layer has no kernel virtual offset defined") ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) return ntkrnlmp @@ -166,7 +168,9 @@ class Info(plugins.PluginInterface): if not isinstance(virtual_layer, layers.intel.Intel): raise TypeError("Virtual Layer is not an intel layer") - kvo = virtual_layer.config["kernel_virtual_offset"] + kvo = virtual_layer.config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError("Intel layer has no kernel virtual offset defined") pe_table_name = intermed.IntermediateSymbolTable.create( context, diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 85eb474a8..0dfa5a7e8 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -18,7 +18,7 @@ class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -247,7 +247,11 @@ class Modules(interfaces.plugins.PluginInterface): A list of Modules as retrieved from PsLoadedModuleList """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) try: diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 579a235d8..3e8be08a4 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -22,7 +22,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) PHYSICAL_DEFAULT = False @classmethod @@ -226,7 +226,11 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """ # We only use the object factory to demonstrate how to use one - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index cdf344ee6..21671eb9b 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -23,7 +23,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" _required_framework_version = (2, 3, 1) - _version = (1, 1, 0) + _version = (1, 1, 1) @classmethod def get_requirements(cls): @@ -194,9 +194,12 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # If it's WinXP->8.1 we have now a physical process address. # We'll use the first thread to bounce back to the virtual process - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) - tleoffset = ntkrnlmp.get_type("_ETHREAD").relative_child_offset( "ThreadListEntry" ) diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index 91a99a9fb..2963a7b8b 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -41,7 +41,7 @@ class HiveGenerator: class HiveList(interfaces.plugins.PluginInterface): """Lists the registry hives present in a particular memory image.""" - _version = (1, 0, 0) + _version = (1, 0, 1) _required_framework_version = (2, 0, 0) @classmethod @@ -59,7 +59,7 @@ class HiveList(interfaces.plugins.PluginInterface): default=None, ), requirements.PluginRequirement( - name="hivescan", plugin=hivescan.HiveScan, version=(1, 0, 0) + name="hivescan", plugin=hivescan.HiveScan, version=(2, 0, 0) ), requirements.BooleanRequirement( name="dump", @@ -215,7 +215,11 @@ class HiveList(interfaces.plugins.PluginInterface): """ # We only use the object factory to demonstrate how to use one - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) list_head = ntkrnlmp.get_symbol("CmpHiveListHead").address @@ -278,9 +282,7 @@ class HiveList(interfaces.plugins.PluginInterface): f"Hivelist failed traversing backwards at {hex(backward_invalid)}, a different " "location from forwards, revert to scanning" ) - for hive in hivescan.HiveScan.scan_hives( - context, layer_name, symbol_table - ): + for hive in hivescan.HiveScan.scan_hives(context, ntkrnlmp.name): try: if hive.HiveList.Flink: start_hive_offset = hive.HiveList.Flink - reloff diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index 6e0171a78..58ed63b4e 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -15,7 +15,7 @@ class HiveScan(interfaces.plugins.PluginInterface): """Scans for registry hives present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -35,10 +35,7 @@ class HiveScan(interfaces.plugins.PluginInterface): @classmethod def scan_hives( - cls, - context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + cls, context: interfaces.context.ContextInterface, kernel_name: str ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for hives using the poolscanner module and constraints or bigpools module with tag. @@ -51,17 +48,21 @@ class HiveScan(interfaces.plugins.PluginInterface): A list of Hive objects as found from the `layer_name` layer based on Hive pool signatures """ - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) + kernel = context.modules[kernel_name] + + is_64bit = symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) is_windows_8_1_or_later = versions.is_windows_8_1_or_later( - context=context, symbol_table=symbol_table + context=context, symbol_table=kernel.symbol_table_name ) if is_windows_8_1_or_later and is_64bit: - kvo = context.layers[layer_name].config["kernel_virtual_offset"] - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = kernel for pool in bigpools.BigPools.list_big_pools( - context, layer_name=layer_name, symbol_table=symbol_table, tags=["CM10"] + context, + layer_name=kernel.layer_name, + symbol_table=kernel.symbol_table_name, + tags=["CM10"], ): cmhive = ntkrnlmp.object( object_type="_CMHIVE", offset=pool.Va, absolute=True @@ -70,21 +71,17 @@ class HiveScan(interfaces.plugins.PluginInterface): else: constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"CM10"] + kernel.symbol_table_name, [b"CM10"] ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, kernel.layer_name, kernel.symbol_table_name, constraints ): _constraint, mem_object, _header = result yield mem_object def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - - for hive in self.scan_hives( - self.context, kernel.layer_name, kernel.symbol_table_name - ): + for hive in self.scan_hives(self.context, self.config["kernel"]): yield (0, (format_hints.Hex(hive.vol.offset),)) def run(self): diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index 1fcb6cc91..483a1b2ff 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -19,7 +19,7 @@ class SSDT(plugins.PluginInterface): """Lists the system call table.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -89,9 +89,8 @@ class SSDT(plugins.PluginInterface): self.context, layer_name, kernel.symbol_table_name ) - kvo = self.context.layers[layer_name].config["kernel_virtual_offset"] ntkrnlmp = self.context.module( - kernel.symbol_table_name, layer_name=layer_name, offset=kvo + kernel.symbol_table_name, layer_name=kernel.offset, offset=kvo ) # this is just one way to enumerate the native (NT) service table. diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index d9f104ae8..855f0730b 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -22,7 +22,7 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt """Lists the unloaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -88,7 +88,11 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt A list of Unloaded Modules as retrieved from MmUnloadedDrivers """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) unloadedmodules_offset = ntkrnlmp.get_symbol("MmUnloadedDrivers").address unloadedmodules = ntkrnlmp.object( diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 0c4a8aaca..f309aa3fd 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -34,7 +34,7 @@ class VadInfo(interfaces.plugins.PluginInterface): """Lists process memory ranges.""" _required_framework_version = (2, 4, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) MAXSIZE_DEFAULT = 1024 * 1024 * 1024 # 1 Gb def __init__(self, *args, **kwargs): @@ -99,7 +99,11 @@ class VadInfo(interfaces.plugins.PluginInterface): symbol_table: The name of the table containing the kernel symbols """ - kvo = context.layers[layer_name].config["kernel_virtual_offset"] + kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) addr = ntkrnlmp.get_symbol("MmProtectToValue").address values = ntkrnlmp.object( diff --git a/volatility3/framework/plugins/windows/virtmap.py b/volatility3/framework/plugins/windows/virtmap.py index e02cca89e..f37d5790a 100644 --- a/volatility3/framework/plugins/windows/virtmap.py +++ b/volatility3/framework/plugins/windows/virtmap.py @@ -17,6 +17,7 @@ class VirtMap(interfaces.plugins.PluginInterface): """Lists virtual mapped sections.""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -147,7 +148,7 @@ class VirtMap(interfaces.plugins.PluginInterface): module = self.context.module( kernel.symbol_table_name, layer_name=layer.name, - offset=layer.config["kernel_virtual_offset"], + offset=kernel.offset, ) return renderers.TreeGrid( diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 593097d25..595b63256 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -838,9 +838,14 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): return renderers.NotApplicableValue() symbol_table_name = self.get_symbol_table_name() - kvo = self._context.layers[self.vol.native_layer_name].config[ - "kernel_virtual_offset" - ] + kvo = self._context.layers[self.vol.native_layer_name].config.get( + "kernel_virtual_offset", None + ) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) + ntkrnlmp = self._context.module( symbol_table_name, layer_name=self.vol.native_layer_name, @@ -1030,7 +1035,13 @@ class TOKEN(objects.StructType): if self.UserAndGroupCount < 0xFFFF: layer_name = self.vol.layer_name - kvo = self._context.layers[layer_name].config["kernel_virtual_offset"] + kvo = self._context.layers[layer_name].config.get( + "kernel_virtual_offset", None + ) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) symbol_table = self.get_symbol_table_name() ntkrnlmp = self._context.module( symbol_table, layer_name=layer_name, offset=kvo @@ -1132,9 +1143,13 @@ class KTIMER(objects.StructType): def get_dpc(self): """Return Dpc, and if Windows 7 or later, decode it""" symbol_table_name = self.get_symbol_table_name() - kvo = self._context.layers[self.vol.native_layer_name].config[ - "kernel_virtual_offset" - ] + kvo = self._context.layers[self.vol.native_layer_name].config.get( + "kernel_virtual_offset", None + ) + if not kvo: + raise ValueError( + "Intel layer does not have an associatd kernel virtual offset, failing" + ) ntkrnlmp = self._context.module( symbol_table_name, layer_name=self.vol.native_layer_name, From fbb9627d36e03a7e222593c1f5bd3dede196e2b1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 2 Feb 2025 16:18:42 +0000 Subject: [PATCH 0548/1352] Keep the advanced configuration requirements out of the interfaces --- volatility3/framework/configuration/requirements.py | 5 ++++- volatility3/framework/interfaces/context.py | 8 -------- volatility3/framework/plugins/windows/ssdt.py | 5 ++--- 3 files changed, 6 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 5dd8cc9b5..aa16c6090 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -641,7 +641,10 @@ class ModuleRequirement( @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return interfaces.context.ModuleInterface.get_requirements() + return [ + IntRequirement(name="offset"), + SymbolTableRequirement(name="symbol_table_name"), + ] def unsatisfied( self, context: "interfaces.context.ContextInterface", config_path: str diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index e7c3e579f..723f2fd46 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -158,14 +158,6 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): super().__init__(context, config_path) self._module_name = name - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - # Can't include the translation layer without knowing the architectures - return [ - SymbolTableRequirement(name="symbol_table_name"), - IntRequirement(name="offset"), - ] - @property def _layer_name(self) -> str: return self.config["layer_name"] diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index 483a1b2ff..d6ec11286 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -89,9 +89,8 @@ class SSDT(plugins.PluginInterface): self.context, layer_name, kernel.symbol_table_name ) - ntkrnlmp = self.context.module( - kernel.symbol_table_name, layer_name=kernel.offset, offset=kvo - ) + ntkrnlmp = kernel + kvo = kernel.offset # this is just one way to enumerate the native (NT) service table. # to do the same thing for the Win32K service table, we would need Win32K.sys symbol support From 54ce358e8ec4ea79aa360cd9c4dd7140fc5e18b3 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 3 Feb 2025 07:37:38 +1100 Subject: [PATCH 0549/1352] framework: minor version bump --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index f2403cf4a..cf7c7b51a 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 19 # Number of changes that only add to the interface +VERSION_MINOR = 20 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From 19fed1964790592691d2c6f482b871998ffef402 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 3 Feb 2025 07:38:43 +1100 Subject: [PATCH 0550/1352] linux: kallsyms plugin: fix variable name typo --- volatility3/framework/plugins/linux/kallsyms.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py index c575c54e7..1665fffb2 100644 --- a/volatility3/framework/plugins/linux/kallsyms.py +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -94,17 +94,17 @@ class Kallsyms(plugins.PluginInterface): if not any(symbols_flags): include_core = include_modules = include_ftrace = include_bpf = True - symbol_geneators = [] + symbol_generators = [] if include_core: - symbol_geneators.append(kas.get_core_symbols()) + symbol_generators.append(kas.get_core_symbols()) if include_modules: - symbol_geneators.append(kas.get_modules_symbols()) + symbol_generators.append(kas.get_modules_symbols()) if include_ftrace: - symbol_geneators.append(kas.get_ftrace_symbols()) + symbol_generators.append(kas.get_ftrace_symbols()) if include_bpf: - symbol_geneators.append(kas.get_bpf_symbols()) + symbol_generators.append(kas.get_bpf_symbols()) - for symbols_generator in symbol_geneators: + for symbols_generator in symbol_generators: for kassymbol in symbols_generator: # Symbol sizes are calculated using the address of the next non-aliased # symbol or the end of the kernel text area _end/_etext. However, some kernel From 13b8526206a355a51509419c8ecab441b817e8ed Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 3 Feb 2025 07:40:17 +1100 Subject: [PATCH 0551/1352] linux: kallsyms API: reuse module_name variable --- volatility3/framework/plugins/linux/kallsyms.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py index 1665fffb2..7dd4f06e6 100644 --- a/volatility3/framework/plugins/linux/kallsyms.py +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -82,7 +82,7 @@ class Kallsyms(plugins.PluginInterface): kas = kallsyms.Kallsyms( context=self.context, layer_name=vmlinux.layer_name, - module_name=self.config["kernel"], + module_name=module_name, ) include_core = self.config.get("core", False) From e222b069ef3afc8c8d52da18c67e0d4d9cdfacdb Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 3 Feb 2025 07:50:21 +1100 Subject: [PATCH 0552/1352] linux: module extension object: add typing info to _get_sect_count() --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index cd7dc5e9d..de08ecf50 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -176,7 +176,7 @@ class module(generic.GenericIntelProcess): """Get the name of the module as a string""" return utility.array_to_string(self.name) - def _get_sect_count(self, grp) -> int: + def _get_sect_count(self, grp: interfaces.objects.ObjectInterface) -> int: """Try to determine the number of valid sections""" symbol_table_name = self.get_symbol_table_name() arr = self._context.object( From 348720c89a0ea9477555f799fc6885e1246ff1e1 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 3 Feb 2025 07:55:11 +1100 Subject: [PATCH 0553/1352] linux: module extension object: add docstring to get_symbol_type() --- .../framework/symbols/linux/extensions/__init__.py | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index de08ecf50..a075524b4 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -361,7 +361,18 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to get typetab section, it needs a kernel >= 5.2") - def get_symbol_type(self, symbol, symbol_index): + def get_symbol_type( + self, symbol: interfaces.objects.ObjectInterface, symbol_index: int + ) -> str: + """Determines the type of a given ELF symbol. + + Args: + symbol: The ELF symbol object (elf_sym) + symbol_index: The index of the symbol within the type table + + Returns: + A single-character string representing the symbol type + """ if self.has_member("kallsyms") and self.kallsyms.has_member("typetab"): # kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b types have its own array layer = self._context.layers[self.vol.layer_name] From cef87e014cf6db0933a05e9c7839b41b8f6ec3f7 Mon Sep 17 00:00:00 2001 From: Gustavo Moreira Date: Mon, 3 Feb 2025 07:59:57 +1100 Subject: [PATCH 0554/1352] linux: kernel_symbol object extension: move properties to getters --- .../framework/symbols/linux/extensions/__init__.py | 9 +++------ volatility3/framework/symbols/linux/kallsyms.py | 4 ++-- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index a075524b4..d65358f06 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3225,8 +3225,7 @@ class kernel_symbol(objects.StructType): long_mask = (1 << layer.bits_per_register) - 1 return (self.vol.offset + off) & long_mask - @property - def name(self) -> str: + def get_name(self) -> str: if self.has_member("name_offset"): # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y # See 7290d58095712a89f845e1bca05334796dd49ed2 @@ -3246,8 +3245,7 @@ class kernel_symbol(objects.StructType): return name_bytes.decode("utf-8", errors="ignore") - @property - def value(self) -> int: + def get_value(self) -> int: if self.has_member("value_offset"): # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y # See 7290d58095712a89f845e1bca05334796dd49ed2 @@ -3258,8 +3256,7 @@ class kernel_symbol(objects.StructType): raise AttributeError("Unsupported kernel_symbol type implementation") - @property - def namespace(self) -> str: + def get_namespace(self) -> str: if self.has_member("namespace_offset"): # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y # See 7290d58095712a89f845e1bca05334796dd49ed2 diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index 264c13d3e..298725a7a 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -722,7 +722,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): self._kas_config.stop_ksymtab, ) - return kernel_symbol is not None and kernel_symbol.value == address + return kernel_symbol is not None and kernel_symbol.get_value() == address def _elfsym_to_kassymbol( self, @@ -1026,7 +1026,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): name: str, kernel_symbol: interfaces.objects.ObjectInterface, ) -> int: - return self._cmp_symbol_name(name, kernel_symbol.name) + return self._cmp_symbol_name(name, kernel_symbol.get_name()) def _cmp_symbol_name( self, From c01f3c5556141102eac1a4ca65c8f63fabacb253 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 5 Feb 2025 19:17:25 +0100 Subject: [PATCH 0555/1352] non inclusive upper bound address check --- volatility3/framework/symbols/linux/utilities/modules.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index baaeff683..d03e76c88 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -35,13 +35,16 @@ class Modules(interfaces.configuration.VersionableInterface): Returns: The first memory module in which the address fits + + Kernel documentation: + "within_module" and "within_module_mem_type" functions """ matches = [] seen_addresses = set() for module in modules: _, start, end = cls.mask_mods_list(context, layer_name, [module])[0] if ( - start <= target_address <= end + start <= target_address < end and module.vol.offset not in seen_addresses ): matches.append(module) From 637ff680353564f04cacdf17d3853992cea4abdc Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 5 Feb 2025 19:19:26 +0100 Subject: [PATCH 0556/1352] make ftrace flags parsing more readable --- .../framework/plugins/linux/tracing/ftrace.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index da88d1de1..75b4d3cca 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -221,6 +221,12 @@ if the "hidden_modules" key is present in known_modules. for hooked_symbol in hooked_symbols ] ) + # Manipulate FtraceOpsFlags(ftrace_ops.flags) like so: + # "FtraceOpsFlags.FTRACE_OPS_FL_IPMODIFY|FTRACE_OPS_FL_ALLOC_TRAMP" + # -> "FTRACE_OPS_FL_IPMODIFY,FTRACE_OPS_FL_ALLOC_TRAMP" + formatted_ftrace_flags = ( + str(FtraceOpsFlags(ftrace_ops.flags)).split(".")[-1].replace("|", ",") + ) yield ParsedFtraceOps( ftrace_ops.vol.offset, callback_symbol, @@ -228,11 +234,7 @@ if the "hidden_modules" key is present in known_modules. hooked_symbols, module_name, module_address, - # FtraceOpsFlags(ftrace_ops.flags).name is valid in > Python3.10, but - # returns None <= Python 3.10. We need to manipulate it like so to ensure compatibility: - # FtraceOpsFlags.FTRACE_OPS_FL_IPMODIFY|FTRACE_OPS_FL_ALLOC_TRAMP - # -> FTRACE_OPS_FL_IPMODIFY,FTRACE_OPS_FL_ALLOC_TRAMP - str(FtraceOpsFlags(ftrace_ops.flags)).split(".")[-1].replace("|", ","), + formatted_ftrace_flags, ) return None From 29567a777b8fce7e12e403f5823a618ddd96d404 Mon Sep 17 00:00:00 2001 From: hsarkey Date: Wed, 5 Feb 2025 15:10:36 -0500 Subject: [PATCH 0557/1352] Updates to address the dlllist wow64 upgrades --- .../symbols/windows/extensions/__init__.py | 40 ++++++++++--------- 1 file changed, 21 insertions(+), 19 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index cda2dd615..9adde07b7 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -776,7 +776,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) return peb - def get_peb32(self) -> interfaces.objects.ObjectInterface: + def get_peb32(self) -> Optional[interfaces.objects.ObjectInterface]: """Constructs a PEB32 object""" if constants.BANG not in self.vol.type_name: raise ValueError( @@ -834,6 +834,14 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) return peb32 + def set_types(self, peb) -> str: + ldr_data = self._context.symbol_space.get_type( + self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" + ) + peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) + sym_table = self._32bit_table_name + return sym_table + def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were loaded.""" try: @@ -844,12 +852,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): for peb in pebs: if peb: sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.endswith("unsigned long"): - ldr_data = self._context.symbol_space.get_type( - self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" - ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) - sym_table = self._32bit_table_name + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( + "unsigned long" + ): + sym_table = self.set_types(peb) yield from peb.Ldr.InLoadOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InLoadOrderLinks", @@ -868,12 +874,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): for peb in pebs: if peb: sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.endswith("unsigned long"): - ldr_data = self._context.symbol_space.get_type( - self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" - ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) - sym_table = self._32bit_table_name + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( + "unsigned long" + ): + sym_table = self.set_types(peb) yield from peb.Ldr.InInitializationOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InInitializationOrderLinks", @@ -891,12 +895,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): for peb in pebs: if peb: sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.endswith("unsigned long"): - ldr_data = self._context.symbol_space.get_type( - self._32bit_table_name + constants.BANG + "_PEB_LDR_DATA" - ) - peb.Ldr = peb.Ldr.cast("pointer", subtype=ldr_data) - sym_table = self._32bit_table_name + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( + "unsigned long" + ): + sym_table = self.set_types(peb) yield from peb.Ldr.InMemoryOrderModuleList.to_list( f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", "InMemoryOrderLinks", From f5e8ed2457f7d276359028cb6a10b8547f5c4f94 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 5 Feb 2025 21:42:13 +0100 Subject: [PATCH 0558/1352] use a list comprehension for flags parsing --- volatility3/framework/plugins/linux/tracing/ftrace.py | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 75b4d3cca..6690769b7 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -6,7 +6,7 @@ import logging from typing import Dict, List, Iterable, Optional -from enum import IntFlag +from enum import Enum from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) # https://docs.python.org/3.13/library/enum.html#enum.IntFlag -class FtraceOpsFlags(IntFlag): +class FtraceOpsFlags(Enum): """Denote the state of an ftrace_ops struct. Based on https://elixir.bootlin.com/linux/v6.13-rc3/source/include/linux/ftrace.h#L255. """ @@ -221,11 +221,8 @@ if the "hidden_modules" key is present in known_modules. for hooked_symbol in hooked_symbols ] ) - # Manipulate FtraceOpsFlags(ftrace_ops.flags) like so: - # "FtraceOpsFlags.FTRACE_OPS_FL_IPMODIFY|FTRACE_OPS_FL_ALLOC_TRAMP" - # -> "FTRACE_OPS_FL_IPMODIFY,FTRACE_OPS_FL_ALLOC_TRAMP" - formatted_ftrace_flags = ( - str(FtraceOpsFlags(ftrace_ops.flags)).split(".")[-1].replace("|", ",") + formatted_ftrace_flags = ",".join( + [flag.name for flag in FtraceOpsFlags if flag.value & ftrace_ops.flags] ) yield ParsedFtraceOps( ftrace_ops.vol.offset, From 6100d7756f4919ffb6679564bfeee784b7eeadf2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 13:05:41 -0600 Subject: [PATCH 0559/1352] Add function typing --- volatility3/framework/plugins/linux/malfind.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 7d8dd7f18..85cfaed31 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import List +from typing import List, Tuple, Optional import logging from volatility3.framework import interfaces from volatility3.framework import renderers, symbols @@ -39,7 +39,7 @@ class Malfind(interfaces.plugins.PluginInterface): ), ] - def _list_injections(self, task): + def _list_injections(self, task) -> Tuple[interfaces.objects.ObjectInterface, Optional[str], bytes]: """Generate memory regions for a process that may contain injected code.""" From d372f04effff791321f34917dde960805cf698c1 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 3 Jan 2025 19:03:32 +0000 Subject: [PATCH 0560/1352] Add proper exception handling in file descriptor enumeration --- volatility3/framework/symbols/linux/__init__.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index c8a22c7f5..f1a618804 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -339,15 +339,23 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): symbol_table: str, task: interfaces.objects.ObjectInterface, ): - # task.files can be null - if not (task.files and task.files.is_readable()): + try: + files = task.files + except exceptions.InvalidAddressException: + return None + + if not files.is_readable(): + return None + + try: + fd_table = files.get_fds() + except exceptions.InvalidAddressException: return None - fd_table = task.files.get_fds() if fd_table == 0: return None - max_fds = task.files.get_max_fds() + max_fds = files.get_max_fds() # corruption check if max_fds > 500000: From 968241aeddcca340c47a1ca6ffa0061fbf7f70d1 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 31 Jan 2025 18:03:02 +0000 Subject: [PATCH 0561/1352] Address feedback --- volatility3/framework/symbols/linux/__init__.py | 7 ------- 1 file changed, 7 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index f1a618804..314522eee 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -341,13 +341,6 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): ): try: files = task.files - except exceptions.InvalidAddressException: - return None - - if not files.is_readable(): - return None - - try: fd_table = files.get_fds() except exceptions.InvalidAddressException: return None From 9c5b01693256d802384f99c8677f0a3c2264f6fd Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 13:11:41 -0600 Subject: [PATCH 0562/1352] Move all initial access into try/except block --- volatility3/framework/symbols/linux/__init__.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 314522eee..f6687a5e4 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -342,14 +342,13 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): try: files = task.files fd_table = files.get_fds() + if fd_table == 0: + return None + + max_fds = files.get_max_fds() except exceptions.InvalidAddressException: return None - if fd_table == 0: - return None - - max_fds = files.get_max_fds() - # corruption check if max_fds > 500000: return None From 4c2d21d0867b8beaa25d9b9c09361a639fdaf6b2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 13:15:31 -0600 Subject: [PATCH 0563/1352] bump patch number --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index cf7c7b51a..3aca23898 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 20 # Number of changes that only add to the interface -VERSION_PATCH = 0 # Number of changes that do not change the interface +VERSION_PATCH = 1 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From ac8eeec52e0eb0118091e8db04b233b387e8c29b Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 13:17:10 -0600 Subject: [PATCH 0564/1352] Fixes for black --- volatility3/framework/plugins/linux/malfind.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 85cfaed31..297116890 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -39,7 +39,9 @@ class Malfind(interfaces.plugins.PluginInterface): ), ] - def _list_injections(self, task) -> Tuple[interfaces.objects.ObjectInterface, Optional[str], bytes]: + def _list_injections( + self, task + ) -> Tuple[interfaces.objects.ObjectInterface, Optional[str], bytes]: """Generate memory regions for a process that may contain injected code.""" From 13278121e3199f6b4746cf214765ed7e261fbdfd Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 13:33:33 -0600 Subject: [PATCH 0565/1352] Catch symbolerror for when a kernel does not have ns_common #1594 --- volatility3/framework/symbols/linux/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index c8a22c7f5..f59587ca7 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -276,7 +276,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): ns_ops = ns_common.ops pre_name = utility.pointer_to_string(ns_ops.name, 255) - except IndexError: + except (exceptions.SymbolError, IndexError): pre_name = "" else: pre_name = f" {sym}" From 8c617d6b3fcc8a029696a0065d00d9c63738072c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 15:06:32 -0600 Subject: [PATCH 0566/1352] Make a generic DLL enumeration function that ensures the base address is set and we return as many entries as possible #1475 --- .../symbols/windows/extensions/__init__.py | 109 +++++++++--------- 1 file changed, 52 insertions(+), 57 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 230d59f95..fb03d304a 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -491,9 +491,9 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): ].is_valid(self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: - name: Union[str, interfaces.renderers.BaseAbsentValue] = ( - renderers.UnreadableValue() - ) + name: Union[ + str, interfaces.renderers.BaseAbsentValue + ] = renderers.UnreadableValue() # this pointer needs to be checked against native_layer_name because the object may # be instantiated from a primary (virtual) layer or a memory (physical) layer. @@ -848,69 +848,64 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): sym_table = self._32bit_table_name return sym_table + def _walk_ldr_list( + self, list_member: str, link_member: str + ) -> Iterable[interfaces.objects.ObjectInterface]: + """ + Walks LDR_DATA_TABLEs and enforces the entries at least have a valid base address + This function also breaks up exception handling as much as possible to ensure the + most data is returned as possible + """ + pebs = [] + + try: + peb = self.get_peb() + if peb: + pebs.append(peb) + except exceptions.InvalidAddressException: + vollog.debug(f"Process at {self.vol.offset:#x} has invalid PEB") + + try: + peb32 = self.get_peb32() + if peb32: + pebs.append(peb32) + except exceptions.InvalidAddressException: + vollog.debug(f"Process at {self.vol.offset:#x} has invalid 32 bit PEB") + + for peb in pebs: + sym_table = self.get_symbol_table_name() + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ("unsigned long"): + sym_table = self.set_types(peb) + + for ldr in peb.Ldr.member(list_member).to_list( + f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", link_member + ): + try: + # Several samples in testing crashed from DLLs being returned + # where DllBase was on the next page and that page was not in memory + # Not being able to retrieve the base makes the entry pretty useless + # So we enforce here its presence + ldr.DllBase + yield ldr + except exceptions.InvalidAddressException: + continue + def load_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were loaded.""" - try: - pebs = [ - self.get_peb(), - self.get_peb32(), - ] - for peb in pebs: - if peb: - sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( - "unsigned long" - ): - sym_table = self.set_types(peb) - yield from peb.Ldr.InLoadOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", - "InLoadOrderLinks", - ) - except exceptions.InvalidAddressException: - return None + + yield from self._walk_ldr_list("InLoadOrderModuleList", "InLoadOrderLinks") def init_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they were initialized""" - try: - pebs = [ - self.get_peb(), - self.get_peb32(), - ] - for peb in pebs: - if peb: - sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( - "unsigned long" - ): - sym_table = self.set_types(peb) - yield from peb.Ldr.InInitializationOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", - "InInitializationOrderLinks", - ) - except exceptions.InvalidAddressException: - return None + yield from self._walk_ldr_list( + "InInitializationOrderModuleList", "InInitializationOrderLinks" + ) def mem_order_modules(self) -> Iterable[interfaces.objects.ObjectInterface]: """Generator for DLLs in the order that they appear in memory""" - try: - pebs = [ - self.get_peb(), - self.get_peb32(), - ] - for peb in pebs: - if peb: - sym_table = self.get_symbol_table_name() - if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ( - "unsigned long" - ): - sym_table = self.set_types(peb) - yield from peb.Ldr.InMemoryOrderModuleList.to_list( - f"{sym_table}{constants.BANG}" + "_LDR_DATA_TABLE_ENTRY", - "InMemoryOrderLinks", - ) - except exceptions.InvalidAddressException: - return None + + yield from self._walk_ldr_list("InMemoryOrderModuleList", "InMemoryOrderLinks") def get_handle_count(self): try: From 67c001ab50564204ff7be56f43c57212c2420a3a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 15:12:06 -0600 Subject: [PATCH 0567/1352] Update for black --- .../framework/symbols/windows/extensions/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index fb03d304a..1d6040265 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -491,9 +491,9 @@ class FILE_OBJECT(objects.StructType, pool.ExecutiveObject): ].is_valid(self.FileName.Buffer) def file_name_with_device(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: - name: Union[ - str, interfaces.renderers.BaseAbsentValue - ] = renderers.UnreadableValue() + name: Union[str, interfaces.renderers.BaseAbsentValue] = ( + renderers.UnreadableValue() + ) # this pointer needs to be checked against native_layer_name because the object may # be instantiated from a primary (virtual) layer or a memory (physical) layer. From b78b7a5d9babca813dea3673840260f2cb7f3407 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 16:33:16 -0600 Subject: [PATCH 0568/1352] Switch virtual and physical addresses to lists to support dumping multiple files at once #1319 --- .../framework/plugins/windows/dumpfiles.py | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index 64d9be4db..b10c519e7 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -44,13 +44,15 @@ class DumpFiles(interfaces.plugins.PluginInterface): description="Process ID to include (all other processes are excluded)", optional=True, ), - requirements.IntRequirement( + requirements.ListRequirement( name="virtaddr", + element_type=int, description="Dump a single _FILE_OBJECT at this virtual address", optional=True, ), - requirements.IntRequirement( + requirements.ListRequirement( name="physaddr", + element_type=int, description="Dump a single _FILE_OBJECT at this physical address", optional=True, ), @@ -318,6 +320,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): ) elif offsets: + # Now process any offsets explicitly requested by the user. for offset, is_virtual in offsets: try: @@ -355,10 +358,14 @@ class DumpFiles(interfaces.plugins.PluginInterface): ): raise ValueError("Cannot use filter flag with an address flag") - if self.config.get("virtaddr", None) is not None: - offsets.append((self.config["virtaddr"], True)) - elif self.config.get("physaddr", None) is not None: - offsets.append((self.config["physaddr"], False)) + if self.config.get("virtaddr"): + for virtaddr in self.config["virtaddr"]: + offsets.append((virtaddr, True)) + + elif self.config.get("physaddr"): + for physaddr in self.config["physaddr"]: + offsets.append((physaddr, False)) + else: filter_func = pslist.PsList.create_pid_filter( [self.config.get("pid", None)] From df55b7890dca4a73f6c8e6dd10b6994fc3264276 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Feb 2025 18:05:16 -0600 Subject: [PATCH 0569/1352] Prevent yielding smeared/broken modules from the unloaded module list --- .../framework/plugins/windows/unloadedmodules.py | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index d9f104ae8..a579ac7e8 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -117,7 +117,18 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt ) unloadedmodules_array.UnloadedDrivers.count = unloaded_count - yield from unloadedmodules_array.UnloadedDrivers + for driver in unloadedmodules_array.UnloadedDrivers: + # Mass testing led to dozens of samples backtracing on this plugin when + # accessing members of modules coming out this list + # Given how often temporary drivers load and unload on Win10+, I + # assume the chance for smear is very high + try: + driver.StartAddress + driver.EndAddress + driver.CurrentTime + yield driver + except exceptions.InvalidAddressException: + continue def _generator(self): kernel = self.context.modules[self.config["kernel"]] From 0abe258765a0f84d2df015a446cf20fd7c5bc7ce Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 8 Feb 2025 15:41:02 +0100 Subject: [PATCH 0570/1352] initial linux.tracing.tracepoints.CheckTracepoints --- .../plugins/linux/tracing/tracepoints.py | 305 ++++++++++++++++++ 1 file changed, 305 insertions(+) create mode 100644 volatility3/framework/plugins/linux/tracing/tracepoints.py diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py new file mode 100644 index 000000000..2a79b90d6 --- /dev/null +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -0,0 +1,305 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +# Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf + +import logging +from typing import Dict, Iterable, List, Optional +from dataclasses import dataclass + +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.plugins.linux import hidden_modules, modxview +from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints, NotAvailableValue, TreeGrid +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.objects import utility +from volatility3.framework.constants import architectures + +vollog = logging.getLogger(__name__) + + +@dataclass +class ParsedTracepointFunc: + """Parsed tracepoint_func struct, containing a selection of forensics valuable + informations.""" + + tracepoint_name: str + tracepoint_address: int + probe_name: str + probe_address: int + probe_priority: int + module_name: str + module_address: int + + +class CheckTracepoints(interfaces.plugins.PluginInterface): + """Detect tracepoints hooking + + Investigate the tracepoints subsystem to uncover kernel attached probes, which can be leveraged + to hook kernel functions and modify their behaviour.""" + + _version = (1, 0, 0) + _required_framework_version = (2, 19, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(1, 1, 0), + ), + requirements.PluginRequirement( + name="modxview", plugin=modxview.Modxview, version=(1, 0, 0) + ), + requirements.PluginRequirement( + name="hidden_modules", + plugin=hidden_modules.Hidden_modules, + version=(1, 0, 0), + ), + ] + + @classmethod + def iterate_tracepoint_funcs( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + tracepoint: interfaces.objects.ObjectInterface, + ) -> Optional[Iterable[interfaces.objects.ObjectInterface]]: + """Extract probes represented by tracepoint_func structs from a + tracepoint funcs member. + + Args: + tracepoint: The tracepoint struct to parse + + Yields: + An iterable of tracepoint_func structs + """ + + layer = context.layers[layer_name] + # Ignore tracepoints without attached probes + if not tracepoint.funcs.is_readable(): + return None + + current_tracepoint_func = tracepoint.funcs.dereference() + # Inspired by kernel's debug_print_probes() + while ( + layer.is_valid(current_tracepoint_func.vol.offset) + and current_tracepoint_func.func.is_readable() + ): + yield current_tracepoint_func + current_tracepoint_func = context.object( + tracepoint.get_symbol_table_name() + constants.BANG + "tracepoint_func", + layer_name, + current_tracepoint_func.vol.offset + current_tracepoint_func.vol.size, + ) + + @classmethod + def parse_tracepoint( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + known_modules: Dict[str, List[extensions.module]], + tracepoint: interfaces.objects.ObjectInterface, + run_hidden_modules: bool = True, + ) -> Optional[Iterable[ParsedTracepointFunc]]: + """Parse a tracepoint struct to highlight tracepoints kernel hooking. + + Args: + known_modules: A dict of known modules, used to locate callbacks origin. Typically obtained through modxview.run_modules_scanners(). + tracepoint: The tracepoint struct to parse + run_hidden_modules: Whether to run the hidden_modules plugin or not. Note: it won't be run, even if specified, \ +if the "hidden_modules" key is present in known_modules. + + Yields: + An iterable of ParsedTracepointFunc dataclasses, containing a selection of useful fields related to a tracepoint struct + """ + + kernel = context.modules[kernel_name] + kernel_layer = context.layers[kernel.layer_name] + + for tracepoint_func in cls.iterate_tracepoint_funcs( + context, kernel_layer.name, tracepoint + ): + probe_handler_address = tracepoint_func.func + probe_handler_symbol = module_address = module_name = None + + # Try to lookup within the known modules if the probe_handler address fits + module = linux_utilities_modules.Modules.module_lookup_by_address( + context, + kernel.layer_name, + modxview.Modxview.flatten_run_modules_results(known_modules), + probe_handler_address, + ) + # Run hidden_modules plugin if a probe handler origin couldn't be determined (only done once, results are re-used afterwards) + if ( + module is None + and run_hidden_modules + and "hidden_modules" not in known_modules + ): + vollog.info( + "A probe handler module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", + ) + known_modules_addresses = set( + kernel_layer.canonicalize(module.vol.offset) + for module in modxview.Modxview.flatten_run_modules_results( + known_modules + ) + ) + modules_memory_boundaries = ( + hidden_modules.Hidden_modules.get_modules_memory_boundaries( + context, kernel_name + ) + ) + known_modules["hidden_modules"] = list( + hidden_modules.Hidden_modules.get_hidden_modules( + context, + kernel_name, + known_modules_addresses, + modules_memory_boundaries, + ) + ) + # Lookup the updated list to see if hidden_modules was able + # to find the missing module + module = linux_utilities_modules.Modules.module_lookup_by_address( + context, + kernel.layer_name, + modxview.Modxview.flatten_run_modules_results(known_modules), + probe_handler_address, + ) + + # Fetch more information about the module + if module is not None: + module_address = module.vol.offset + module_name = module.get_name() + probe_handler_symbol = module.get_symbol_by_address( + probe_handler_address + ) + else: + vollog.warning( + f"Could not determine tracepoint@{tracepoint.vol.offset:#x} probe handler {probe_handler_address:#x} module origin.", + ) + + yield ParsedTracepointFunc( + utility.pointer_to_string(tracepoint.name, count=512), + tracepoint.vol.offset, + probe_handler_symbol, + probe_handler_address, + tracepoint_func.prio, + module_name, + module_address, + ) + + @classmethod + def iterate_tracepoints_array( + cls, context: interfaces.context.ContextInterface, kernel_name: str + ) -> List[interfaces.objects.ObjectInterface]: + """Iterate over (tracepoint_ptr_t *)__start___tracepoints_ptrs. + Handles CONFIG_HAVE_ARCH_PREL32_RELOCATIONS. + + Returns: + A list of tracepoint structs + """ + + kernel = context.modules[kernel_name] + + tracepoints = [] + tracepoints_start = kernel.object_from_symbol("__start___tracepoints_ptrs") + tracepoints_end = kernel.object_from_symbol("__stop___tracepoints_ptrs") + tracepoints_array_size = ( + tracepoints_end.vol.offset - tracepoints_start.vol.offset + ) + # kernel's tracepoint_ptr_deref() and tracepoint_ptr_t + # adjust depending on the use of relocated pointers + # or not + config_have_arch_prel32_relocations = ( + tracepoints_start.vol.subtype.type_name + == kernel.symbol_table_name + constants.BANG + "int" + ) + if config_have_arch_prel32_relocations: + tracepoints_relative_offsets = tracepoints_start.cast( + "array", + count=tracepoints_array_size // kernel.get_type("int").size, + subtype=kernel.get_type("int"), + ) + for relative_offset in tracepoints_relative_offsets: + tracepoint = kernel.object( + "tracepoint", + relative_offset + relative_offset.vol.offset, + absolute=True, + ) + tracepoints.append(tracepoint) + else: + tracepoints = utility.array_of_pointers( + tracepoints_start, + tracepoints_array_size // kernel.get_type("pointer").size, + kernel.symbol_table_name + constants.BANG + "tracepoint", + context, + ) + + return tracepoints + + def _generator(self): + kernel_name = self.config["kernel"] + kernel = self.context.modules[kernel_name] + kernel_layer = self.context.layers[kernel.layer_name] + + if not kernel.has_symbol("__start___tracepoints_ptrs"): + raise exceptions.SymbolError( + "__start___tracepoints_ptrs", + self.vmlinux.symbol_table_name, + 'The provided symbol table does not include the "__start___tracepoints_ptrs" symbol. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupted.', + ) + + known_modules = modxview.Modxview.run_modules_scanners( + self.context, kernel_name, run_hidden_modules=False + ) + tracepoints = self.iterate_tracepoints_array(self.context, kernel_name) + + for tracepoint in tracepoints: + if not kernel_layer.is_valid(tracepoint.vol.offset): + continue + + for tracepoint_parsed in self.parse_tracepoint( + self.context, kernel_name, known_modules, tracepoint + ): + formatted_results = ( + tracepoint_parsed.tracepoint_name, + format_hints.Hex(tracepoint_parsed.tracepoint_address), + tracepoint_parsed.probe_name or NotAvailableValue(), + format_hints.Hex(tracepoint_parsed.probe_address), + tracepoint_parsed.probe_priority, + tracepoint_parsed.module_name or NotAvailableValue(), + ( + format_hints.Hex(tracepoint_parsed.module_address) + if tracepoint_parsed.module_address is not None + else NotAvailableValue() + ), + ) + yield ( + 0, + formatted_results, + ) + + def run(self): + columns = [ + ("tracepoint", str), + ("tracepoint address", format_hints.Hex), + ("Probe", str), + ("Probe address", format_hints.Hex), + ("Probe priority", int), + ("Module", str), + ("Module address", format_hints.Hex), + ] + + return TreeGrid( + columns, + self._generator(), + ) From 83dde6aec31fd79d349644a3b0ac317b73d1cb7f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 12:26:42 +0100 Subject: [PATCH 0571/1352] improve prel32 comments --- .../framework/plugins/linux/tracing/tracepoints.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 2a79b90d6..89bec4598 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -217,8 +217,10 @@ if the "hidden_modules" key is present in known_modules. tracepoints_end.vol.offset - tracepoints_start.vol.offset ) # kernel's tracepoint_ptr_deref() and tracepoint_ptr_t - # adjust depending on the use of relocated pointers - # or not + # adjust depending on the use of PC-relative addressing + # or not. + # Relocation is commonly used to store pointers as offsets + # relative to their own address rather than absolute addresses/pointers. config_have_arch_prel32_relocations = ( tracepoints_start.vol.subtype.type_name == kernel.symbol_table_name + constants.BANG + "int" @@ -230,9 +232,13 @@ if the "hidden_modules" key is present in known_modules. subtype=kernel.get_type("int"), ) for relative_offset in tracepoints_relative_offsets: + # relative_offset is the value stored at relative_offset.vol.offset + # See kernel's offset_to_ptr(). Example: + # 0xffff9da125e0 = 0x7af138 + 0xffff9d2634a8 + absolute_address = relative_offset + relative_offset.vol.offset tracepoint = kernel.object( "tracepoint", - relative_offset + relative_offset.vol.offset, + absolute_address, absolute=True, ) tracepoints.append(tracepoint) From a9691fbe77b72bed2cd5b12471d8f5deaae88813 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 12:41:23 +0100 Subject: [PATCH 0572/1352] remove unnecessary object creation --- volatility3/framework/plugins/linux/tracing/tracepoints.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 89bec4598..247e139d5 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -212,10 +212,10 @@ if the "hidden_modules" key is present in known_modules. tracepoints = [] tracepoints_start = kernel.object_from_symbol("__start___tracepoints_ptrs") - tracepoints_end = kernel.object_from_symbol("__stop___tracepoints_ptrs") - tracepoints_array_size = ( - tracepoints_end.vol.offset - tracepoints_start.vol.offset + tracepoints_end = kernel.get_absolute_symbol_address( + "__stop___tracepoints_ptrs" ) + tracepoints_array_size = tracepoints_end - tracepoints_start.vol.offset # kernel's tracepoint_ptr_deref() and tracepoint_ptr_t # adjust depending on the use of PC-relative addressing # or not. From 8d23d5b80810655475233030ff441ee63a2f2865 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 13:41:46 +0100 Subject: [PATCH 0573/1352] use architectures.LINUX_ARCHS --- volatility3/framework/plugins/linux/pagecache.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 4d1250255..48e3da9c1 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -6,8 +6,9 @@ import math import logging import datetime from dataclasses import dataclass, astuple -from typing import List, Set, Type, Iterable, Tuple +from typing import IO, List, Set, Type, Iterable, Tuple +from volatility3.framework.constants import architectures from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.renderers import format_hints from volatility3.framework.interfaces import plugins @@ -112,7 +113,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.ModuleRequirement( name="kernel", description="Linux kernel", - architectures=["Intel32", "Intel64"], + architectures=architectures.LINUX_ARCHS, ), requirements.PluginRequirement( name="mountinfo", plugin=mountinfo.MountInfo, version=(1, 2, 0) @@ -413,7 +414,7 @@ class InodePages(plugins.PluginInterface): requirements.ModuleRequirement( name="kernel", description="Linux kernel", - architectures=["Intel32", "Intel64"], + architectures=architectures.LINUX_ARCHS, ), requirements.PluginRequirement( name="files", plugin=Files, version=(1, 0, 0) From cd9ba823a1719c734f0ebf8f983182389eba87b3 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 13:42:47 +0100 Subject: [PATCH 0574/1352] add inode_size and format_symlink to InodeUser --- volatility3/framework/plugins/linux/pagecache.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 48e3da9c1..3fa8cf181 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -38,6 +38,11 @@ class InodeUser: modification_time: str change_time: str path: str + inode_size: int + + @classmethod + def format_symlink(cls, symlink_source: str, symlink_dest: str) -> str: + return f"{symlink_source} -> {symlink_dest}" @dataclass @@ -81,6 +86,7 @@ class InodeInternal: access_time_dt = self.inode.get_access_time() modification_time_dt = self.inode.get_modification_time() change_time_dt = self.inode.get_change_time() + inode_size = int(self.inode.i_size) inode_user = InodeUser( superblock_addr=superblock_addr, @@ -96,6 +102,7 @@ class InodeInternal: modification_time=modification_time_dt, change_time=change_time_dt, path=self.path, + inode_size=inode_size, ) return inode_user @@ -394,6 +401,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): ("ModificationTime", datetime.datetime), ("ChangeTime", datetime.datetime), ("FilePath", str), + ("InodeSize", int), ] return renderers.TreeGrid( From b9d4605b8ac93382d1d4542fbe15d2e2d7466758 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 13:44:16 +0100 Subject: [PATCH 0575/1352] switch to InodeUser.format_symlink --- volatility3/framework/plugins/linux/pagecache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 3fa8cf181..c2bf6fcca 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -162,10 +162,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): and inode.i_link and inode.i_link.is_readable() ): - i_link_str = inode.i_link.dereference().cast( + symlink_dest = inode.i_link.dereference().cast( "string", max_length=255, encoding="utf-8", errors="replace" ) - symlink_path = f"{symlink_path} -> {i_link_str}" + symlink_path = InodeUser.format_symlink(symlink_path, symlink_dest) return symlink_path From 8d9d0f5689a31cadcf40b3125f0f8d67ea668a29 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 13:45:23 +0100 Subject: [PATCH 0576/1352] add and use follow_symlinks parameter --- volatility3/framework/plugins/linux/pagecache.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index c2bf6fcca..5f3e3e558 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -226,12 +226,14 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str, + follow_symlinks: bool = True, ) -> Iterable[InodeInternal]: """Retrieves the inodes from the superblocks Args: context: The context that the plugin will operate within vmlinux_module_name: The name of the kernel module on which to operate + follow_symlinks: Whether to follow symlinks or not Yields: An InodeInternal object @@ -311,7 +313,8 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue seen_inodes.add(file_inode_ptr) - file_path = cls._follow_symlink(file_inode_ptr, file_path) + if follow_symlinks: + file_path = cls._follow_symlink(file_inode_ptr, file_path) inode_in = InodeInternal( superblock=superblock, mountpoint=mountpoint, From 03f6fa95332da64a15f7176eb6e5419518424998 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 13:45:46 +0100 Subject: [PATCH 0577/1352] 1.0.3 -> 1.1.0 Files bump --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 5f3e3e558..702c5986e 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -112,7 +112,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - _version = (1, 0, 3) + _version = (1, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 223f2d69bbcd4a7877e642b7a50b70355731551b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 13:47:37 +0100 Subject: [PATCH 0578/1352] switch to context and layer_name calling convention --- volatility3/framework/plugins/linux/pagecache.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 702c5986e..5f12d7228 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -451,14 +451,17 @@ class InodePages(plugins.PluginInterface): @classmethod def write_inode_content_to_file( cls, + context: interfaces.context.ContextInterface, + layer_name: str, inode: interfaces.objects.ObjectInterface, filename: str, open_method: Type[interfaces.plugins.FileHandlerInterface], - vmlinux_layer: interfaces.layers.TranslationLayerInterface, ) -> None: """Extracts the inode's contents from the page cache and saves them to a file Args: + context: The context on which to operate + layer_name: The name of the layer on which to operate inode: The inode to dump filename: Filename for writing the inode content open_method: class for constructing output files @@ -587,7 +590,7 @@ class InodePages(plugins.PluginInterface): filename = open_method.sanitize_filename(f"inode_0x{inode_address:x}.dmp") vollog.info("[*] Writing inode at 0x%x to '%s'", inode_address, filename) self.write_inode_content_to_file( - inode, filename, open_method, vmlinux_layer + self.context, vmlinux_layer.name, inode, filename, open_method ) else: yield from self._generate_inode_fields(inode, vmlinux_layer) From 826281b3b903790874f9c48ed501b16b8243f867 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 13:48:59 +0100 Subject: [PATCH 0579/1352] add and use write_inode_content_to_stream --- .../framework/plugins/linux/pagecache.py | 75 ++++++++++++------- 1 file changed, 46 insertions(+), 29 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 5f12d7228..05544bc91 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -465,51 +465,68 @@ class InodePages(plugins.PluginInterface): inode: The inode to dump filename: Filename for writing the inode content open_method: class for constructing output files - vmlinux_layer: The kernel layer to obtain the page size + """ + try: + with open_method(filename) as file_obj: + cls.write_inode_content_to_stream(context, layer_name, inode, file_obj) + except OSError as e: + vollog.error("Unable to write to file (%s): %s", filename, e) + + @classmethod + def write_inode_content_to_stream( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + inode: interfaces.objects.ObjectInterface, + stream: IO, + ) -> None: + """Extracts the inode's contents from the page cache and saves them to a stream + + Args: + context: The context on which to operate + layer_name: The name of the layer on which to operate + inode: The inode to dump + stream: An IO stream to write to, typically FileHandlerInterface or BytesIO """ if not inode.is_reg: vollog.error("The inode is not a regular file") return None - # By using truncate/seek, provided the filesystem supports it, a sparse file will be + layer = context.layers[layer_name] + # By using truncate/seek, provided the filesystem supports it, and the + # stream is a File interface, a sparse file will be # created, saving both disk space and I/O time. # Additionally, using the page index will guarantee that each page is written at the # appropriate file position. inode_size = inode.i_size try: - file_initialized = False - with open_method(filename) as file_obj: - for page_idx, page_content in inode.get_contents(): - current_fp = page_idx * vmlinux_layer.page_size - max_length = inode_size - current_fp - page_bytes_len = min(max_length, len(page_content)) - if ( - current_fp >= inode_size - or current_fp + page_bytes_len > inode_size - ): - vollog.error( - "Page out of file bounds: inode 0x%x, inode size %d, page index %d", - inode.vol.offset, - inode_size, - page_idx, - ) - continue - page_bytes = page_content[:page_bytes_len] + stream_initialized = False + for page_idx, page_content in inode.get_contents(): + current_fp = page_idx * layer.page_size + max_length = inode_size - current_fp + page_bytes_len = min(max_length, len(page_content)) + if current_fp >= inode_size or current_fp + page_bytes_len > inode_size: + vollog.error( + "Page out of file bounds: inode 0x%x, inode size %d, page index %d", + inode.vol.offset, + inode_size, + page_idx, + ) + continue + page_bytes = page_content[:page_bytes_len] - if not file_initialized: - # Lazy initialization to avoid truncating the file until we are - # certain there is something to write - file_obj.truncate(inode_size) - file_initialized = True + if not stream_initialized: + # Lazy initialization to avoid truncating the stream until we are + # certain there is something to write + stream.truncate(inode_size) + stream_initialized = True - file_obj.seek(current_fp) - file_obj.write(page_bytes) + stream.seek(current_fp) + stream.write(page_bytes) except exceptions.LinuxPageCacheException: vollog.error( f"Error dumping cached pages for inode at {inode.vol.offset:#x}" ) - except OSError as e: - vollog.error("Unable to write to file (%s): %s", filename, e) def _generate_inode_fields( self, From f1b34df26ba76d67a10e3169db866cf5e459b18a Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sun, 9 Feb 2025 13:49:24 +0100 Subject: [PATCH 0580/1352] 2.0.2 -> 3.0.0 InodePages bump --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 05544bc91..de02ad022 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -417,7 +417,7 @@ class InodePages(plugins.PluginInterface): _required_framework_version = (2, 0, 0) - _version = (2, 0, 2) + _version = (3, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 444376cbbad407bbe00cb4ed3cb51b6ae07ec489 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 9 Feb 2025 15:39:49 +0000 Subject: [PATCH 0581/1352] Fix typos and try setting back requirement change --- volatility3/framework/configuration/requirements.py | 2 +- volatility3/framework/plugins/windows/bigpools.py | 2 +- volatility3/framework/plugins/windows/callbacks.py | 12 ++++++------ volatility3/framework/plugins/windows/handles.py | 4 ++-- volatility3/framework/plugins/windows/modules.py | 2 +- volatility3/framework/plugins/windows/pslist.py | 2 +- volatility3/framework/plugins/windows/psscan.py | 2 +- .../framework/plugins/windows/registry/hivelist.py | 2 +- .../framework/plugins/windows/unloadedmodules.py | 2 +- volatility3/framework/plugins/windows/vadinfo.py | 2 +- .../framework/symbols/windows/extensions/__init__.py | 6 +++--- 11 files changed, 19 insertions(+), 19 deletions(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index aa16c6090..3e3608000 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -638,12 +638,12 @@ class ModuleRequirement( self.add_requirement( TranslationLayerRequirement(name="layer_name", architectures=architectures) ) + self.add_requirement(SymbolTableRequirement(name="symbol_table_name")) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ IntRequirement(name="offset"), - SymbolTableRequirement(name="symbol_table_name"), ] def unsatisfied( diff --git a/volatility3/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py index f6217ac50..9da702ae0 100644 --- a/volatility3/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -69,7 +69,7 @@ class BigPools(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 9d54f4331..7bb90863d 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -364,7 +364,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) @@ -425,7 +425,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) full_type_name = ( @@ -476,7 +476,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) full_type_name = callback_table_name + constants.BANG + "_CM_CALLBACK_ENTRY" @@ -521,7 +521,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) @@ -581,7 +581,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) @@ -649,7 +649,7 @@ class Callbacks(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 384528f0a..276ce5d51 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -147,7 +147,7 @@ class Handles(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) @@ -209,7 +209,7 @@ class Handles(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) return context.object( symbol_table + constants.BANG + "unsigned int", diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 0dfa5a7e8..62a622491 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -250,7 +250,7 @@ class Modules(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 3e8be08a4..3d3f12869 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -229,7 +229,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 21671eb9b..81e5fb792 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -197,7 +197,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) tleoffset = ntkrnlmp.get_type("_ETHREAD").relative_child_offset( diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index 2963a7b8b..36be35a68 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -218,7 +218,7 @@ class HiveList(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index 855f0730b..4359199c1 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -91,7 +91,7 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) unloadedmodules_offset = ntkrnlmp.get_symbol("MmUnloadedDrivers").address diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index f309aa3fd..35bf54d98 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -102,7 +102,7 @@ class VadInfo(interfaces.plugins.PluginInterface): kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) addr = ntkrnlmp.get_symbol("MmProtectToValue").address diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 595b63256..4e7d6d920 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -843,7 +843,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = self._context.module( @@ -1040,7 +1040,7 @@ class TOKEN(objects.StructType): ) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) symbol_table = self.get_symbol_table_name() ntkrnlmp = self._context.module( @@ -1148,7 +1148,7 @@ class KTIMER(objects.StructType): ) if not kvo: raise ValueError( - "Intel layer does not have an associatd kernel virtual offset, failing" + "Intel layer does not have an associated kernel virtual offset, failing" ) ntkrnlmp = self._context.module( symbol_table_name, From 64d8a675a70f873577c78d63a784e0b82b8f48ba Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 10 Feb 2025 11:49:23 +0100 Subject: [PATCH 0582/1352] initial linux.pagecache.recoverfs --- .../framework/plugins/linux/pagecache.py | 211 ++++++++++++++++++ 1 file changed, 211 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index de02ad022..d0c085719 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -5,8 +5,11 @@ import math import logging import datetime +import time +import tarfile from dataclasses import dataclass, astuple from typing import IO, List, Set, Type, Iterable, Tuple +from io import BytesIO from volatility3.framework.constants import architectures from volatility3.framework import renderers, interfaces, exceptions @@ -625,3 +628,211 @@ class InodePages(plugins.PluginInterface): return renderers.TreeGrid( headers, Files.format_fields_with_headers(headers, self._generator()) ) + + +class RecoverFs(plugins.PluginInterface): + """Recovers the cached filesystem (directories, files, symlinks) into a compressed tarball. + + Metadata aren't replicated to extracted objects and timestamps are set to the plugin run time. To prevent extraction errors related to long paths, please consider using https://github.com/mxmlnkn/ratarmount. + To mount: + "ratarmount recovered_fs.tar.gz ./recovered_fs_mounted/". + To unmount: + "umount ./recovered_fs_mounted/". + """ + + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.PluginRequirement( + name="files", plugin=Files, version=(1, 1, 0) + ), + requirements.PluginRequirement( + name="inodepages", plugin=InodePages, version=(3, 0, 0) + ), + requirements.ChoiceRequirement( + name="compression_format", + description="Compression format (default: gz)", + choices=["gz", "bz2", "xz"], + default="gz", + optional=True, + ), + ] + + @classmethod + def _tar_add_reg_inode( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + tar: tarfile.TarFile, + reg_inode_in: InodeInternal, + mtime: float = None, + ) -> int: + """Extracts a REG inode content and writes it to a TarFile object. + + Args: + context: The context on which to operate + layer_name: The name of the layer on which to operate + tar: The TarFile object to write to + reg_inode_in: The inode to extract content from + mtime: The modification time to set the TarInfo object to + + Returns: + The number of extracted bytes + """ + inode_content_buffer = BytesIO() + InodePages.write_inode_content_to_stream( + context, layer_name, reg_inode_in.inode, inode_content_buffer + ) + inode_content_buffer.seek(0) + handle_buffer_size = inode_content_buffer.getbuffer().nbytes + + tar_info = tarfile.TarInfo(reg_inode_in.path) + # The tarfile module only has read support for sparse files: + # https://docs.python.org/3.12/library/tarfile.html#tarfile.LNKTYPE:~:text=and%20longlink%20extensions%2C-,read%2Donly%20support,-for%20all%20variants + tar_info.type = tarfile.REGTYPE + tar_info.size = handle_buffer_size + tar_info.mode = 0o444 + if mtime is not None: + tar_info.mtime = mtime + tar.addfile(tar_info, inode_content_buffer) + + return handle_buffer_size + + @classmethod + def _tar_add_dir_inode( + cls, + tar: tarfile.TarFile, + reg_dir_in: InodeInternal, + mtime: float = None, + ) -> None: + """Adds a directory path to a TarFile object, based on a DIR inode. + + Args: + tar: The TarFile object to write to + reg_dir_in: The inode to base the new directory on + mtime: The modification time to set the TarInfo object to + """ + tar_info = tarfile.TarInfo(reg_dir_in.path) + tar_info.type = tarfile.DIRTYPE + tar_info.mode = 0o755 + if mtime is not None: + tar_info.mtime = mtime + tar.addfile(tar_info) + + @classmethod + def _tar_add_lnk( + cls, + tar: tarfile.TarFile, + symlink_source: str, + symlink_dest: str, + mtime: float = None, + ) -> None: + """Adds a symlink to a TarFile object. + + Args: + tar: The TarFile object to write to + symlink_source: The symlink source path + symlink_dest: The symlink target/destination + mtime: The modification time to set the TarInfo object to + """ + # Patch symlinks pointing to absolute paths, + # to prevent referencing the host filesystem. + if symlink_dest.startswith("/"): + inode_depth = symlink_source.strip("/").count("/") + symlink_dest = "../" * inode_depth + symlink_dest.lstrip("/") + + tar_info = tarfile.TarInfo(symlink_source) + tar_info.type = tarfile.SYMTYPE + tar_info.linkname = symlink_dest + tar_info.mode = 0o444 + if mtime is not None: + tar_info.mtime = mtime + tar.addfile(tar_info) + + def _generator(self): + vmlinux_module_name = self.config["kernel"] + vmlinux = self.context.modules[vmlinux_module_name] + vmlinux_layer = self.context.layers[vmlinux.layer_name] + tar_buffer = BytesIO() + tar = tarfile.open( + fileobj=tar_buffer, + mode=f"w:{self.config['compression_format']}", + ) + # Set a unique timestamp for all extracted files + mtime = time.time() + + inodes_iter = Files.get_inodes( + context=self.context, + vmlinux_module_name=vmlinux_module_name, + follow_symlinks=False, + ) + visited_paths = set() + for inode_in in inodes_iter: + if inode_in.path in visited_paths: + continue + visited_paths.add(inode_in.path) + extracted_file_size = renderers.NotApplicableValue() + + # Inodes parent directory is yielded first, which + # ensures that a file parent path will exist beforehand. + # tarfile will take care of creating it anyway. + if inode_in.inode.is_reg: + extracted_file_size = self._tar_add_reg_inode( + self.context, vmlinux_layer.name, tar, inode_in, mtime + ) + elif inode_in.inode.is_dir: + self._tar_add_dir_inode(tar, inode_in, mtime) + elif ( + inode_in.inode.is_link + and inode_in.inode.has_member("i_link") + and inode_in.inode.i_link + and inode_in.inode.i_link.is_readable() + ): + symlink_dest = inode_in.inode.i_link.dereference().cast( + "string", max_length=255, encoding="utf-8", errors="replace" + ) + self._tar_add_lnk(tar, inode_in.path, symlink_dest, mtime) + # Set path to a user friendly representation before yielding + inode_in.path = InodeUser.format_symlink(inode_in.path, symlink_dest) + else: + continue + + inode_out = inode_in.to_user(vmlinux_layer) + yield (0, astuple(inode_out) + (extracted_file_size,)) + + tar.close() + tar_buffer.seek(0) + output_filename = f"recovered_fs.tar.{self.config['compression_format']}" + with self.open(output_filename) as f: + f.write(tar_buffer.getvalue()) + + def run(self): + headers = [ + ("SuperblockAddr", format_hints.Hex), + ("MountPoint", str), + ("Device", str), + ("InodeNum", int), + ("InodeAddr", format_hints.Hex), + ("FileType", str), + ("InodePages", int), + ("CachedPages", int), + ("FileMode", str), + ("AccessTime", datetime.datetime), + ("ModificationTime", datetime.datetime), + ("ChangeTime", datetime.datetime), + ("FilePath", str), + ("InodeSize", int), + ("Recovered FileSize", int), + ] + + return renderers.TreeGrid( + headers, Files.format_fields_with_headers(headers, self._generator()) + ) From 773231280933319e8433932521298808d618b146 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 11 Feb 2025 17:45:12 +0100 Subject: [PATCH 0583/1352] switch property to functools.cached_property --- volatility3/framework/symbols/linux/extensions/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index b4dc1ac20..d5959823a 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1057,11 +1057,11 @@ class super_block(objects.StructType): SB_LAZYTIME: "lazytime", } - @property + @functools.cached_property def major(self) -> int: return self.s_dev >> self.MINORBITS - @property + @functools.cached_property def minor(self) -> int: return self.s_dev & ((1 << self.MINORBITS) - 1) From ec61da6dac21fb2a285f300daf9b471f9017eee3 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 11 Feb 2025 17:45:31 +0100 Subject: [PATCH 0584/1352] add uuid property to super_block --- .../symbols/linux/extensions/__init__.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index d5959823a..927858ca7 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -10,6 +10,7 @@ import binascii import stat import datetime import socket as socket_module +import uuid from typing import ( Generator, Iterable, @@ -1065,6 +1066,20 @@ class super_block(objects.StructType): def minor(self) -> int: return self.s_dev & ((1 << self.MINORBITS) - 1) + @functools.cached_property + def uuid(self) -> str: + if not self.has_member("s_uuid"): + raise AttributeError( + "super_block struct does not support s_uuid direct attribute access, probably indicating a kernel version < 2.6.39-rc1." + ) + + if self.s_uuid.has_member("b"): + uuid_as_ints = self.s_uuid.b + else: + uuid_as_ints = self.s_uuid + + return str(uuid.UUID(bytes=bytes(uuid_as_ints))) + def get_flags_access(self) -> str: return "ro" if self.s_flags & self.SB_RDONLY else "rw" From f82fd5375351dd554275eea04422a817b65a58ad Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 11 Feb 2025 17:46:03 +0100 Subject: [PATCH 0585/1352] 2.20.1 -> 2.21.0 bump --- volatility3/framework/constants/_version.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 3aca23898..0393a9669 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 20 # Number of changes that only add to the interface -VERSION_PATCH = 1 # Number of changes that do not change the interface +VERSION_MINOR = 21 # Number of changes that only add to the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From 999f3d0d2ce67aa8d41ee03af10045c9f42cb6b0 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 11 Feb 2025 17:48:34 +0100 Subject: [PATCH 0586/1352] add superblock or device numbers path prepending --- .../framework/plugins/linux/pagecache.py | 55 +++++++++++++------ 1 file changed, 39 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index d0c085719..2a137fc89 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -633,11 +633,8 @@ class InodePages(plugins.PluginInterface): class RecoverFs(plugins.PluginInterface): """Recovers the cached filesystem (directories, files, symlinks) into a compressed tarball. - Metadata aren't replicated to extracted objects and timestamps are set to the plugin run time. To prevent extraction errors related to long paths, please consider using https://github.com/mxmlnkn/ratarmount. - To mount: - "ratarmount recovered_fs.tar.gz ./recovered_fs_mounted/". - To unmount: - "umount ./recovered_fs_mounted/". + Details: level 0 directories are named after the UUID of the parent superblock; metadata aren't replicated to extracted objects; objects modification time is set to the plugin run time. + Troubleshooting: to fix extraction errors related to long paths, please consider using https://github.com/mxmlnkn/ratarmount. """ _version = (1, 0, 0) @@ -673,6 +670,7 @@ class RecoverFs(plugins.PluginInterface): layer_name: str, tar: tarfile.TarFile, reg_inode_in: InodeInternal, + path_prefix: str = "", mtime: float = None, ) -> int: """Extracts a REG inode content and writes it to a TarFile object. @@ -682,6 +680,7 @@ class RecoverFs(plugins.PluginInterface): layer_name: The name of the layer on which to operate tar: The TarFile object to write to reg_inode_in: The inode to extract content from + path_prefix: A custom path prefix to prepend the inode path with mtime: The modification time to set the TarInfo object to Returns: @@ -694,7 +693,7 @@ class RecoverFs(plugins.PluginInterface): inode_content_buffer.seek(0) handle_buffer_size = inode_content_buffer.getbuffer().nbytes - tar_info = tarfile.TarInfo(reg_inode_in.path) + tar_info = tarfile.TarInfo(path_prefix + reg_inode_in.path) # The tarfile module only has read support for sparse files: # https://docs.python.org/3.12/library/tarfile.html#tarfile.LNKTYPE:~:text=and%20longlink%20extensions%2C-,read%2Donly%20support,-for%20all%20variants tar_info.type = tarfile.REGTYPE @@ -707,20 +706,20 @@ class RecoverFs(plugins.PluginInterface): return handle_buffer_size @classmethod - def _tar_add_dir_inode( + def _tar_add_dir( cls, tar: tarfile.TarFile, - reg_dir_in: InodeInternal, + directory_path: str, mtime: float = None, ) -> None: """Adds a directory path to a TarFile object, based on a DIR inode. Args: tar: The TarFile object to write to - reg_dir_in: The inode to base the new directory on + directory_path: The directory path to create mtime: The modification time to set the TarInfo object to """ - tar_info = tarfile.TarInfo(reg_dir_in.path) + tar_info = tarfile.TarInfo(directory_path) tar_info.type = tarfile.DIRTYPE tar_info.mode = 0o755 if mtime is not None: @@ -774,11 +773,30 @@ class RecoverFs(plugins.PluginInterface): vmlinux_module_name=vmlinux_module_name, follow_symlinks=False, ) - visited_paths = set() + + # Prefix paths by the super_block uuid's to prevent overlaps. + # Switch to device major and device minor for older kernels (< 2.6.39-rc1). + uuid_as_prefix = vmlinux.get_type("super_block").has_member("s_uuid") + if not uuid_as_prefix: + vollog.warning( + "super_block struct does not support s_uuid attribute. Consequently, level 0 directories won't refer to the superblock uuid's, but to its device_major:device_minor numbers." + ) + + visited_paths = seen_prefixes = set() for inode_in in inodes_iter: - if inode_in.path in visited_paths: + if uuid_as_prefix: + prefix = f"/{inode_in.superblock.uuid}" + else: + prefix = f"/{inode_in.superblock.major}:{inode_in.superblock.minor}" + prefixed_path = prefix + inode_in.path + + if prefixed_path in visited_paths: continue - visited_paths.add(inode_in.path) + elif prefix not in seen_prefixes: + self._tar_add_dir(tar, prefix, mtime) + seen_prefixes.add(prefix) + + visited_paths.add(prefixed_path) extracted_file_size = renderers.NotApplicableValue() # Inodes parent directory is yielded first, which @@ -786,10 +804,15 @@ class RecoverFs(plugins.PluginInterface): # tarfile will take care of creating it anyway. if inode_in.inode.is_reg: extracted_file_size = self._tar_add_reg_inode( - self.context, vmlinux_layer.name, tar, inode_in, mtime + self.context, + vmlinux_layer.name, + tar, + inode_in, + prefix, + mtime, ) elif inode_in.inode.is_dir: - self._tar_add_dir_inode(tar, inode_in, mtime) + self._tar_add_dir(tar, prefixed_path, mtime) elif ( inode_in.inode.is_link and inode_in.inode.has_member("i_link") @@ -799,7 +822,7 @@ class RecoverFs(plugins.PluginInterface): symlink_dest = inode_in.inode.i_link.dereference().cast( "string", max_length=255, encoding="utf-8", errors="replace" ) - self._tar_add_lnk(tar, inode_in.path, symlink_dest, mtime) + self._tar_add_lnk(tar, prefixed_path, symlink_dest, mtime) # Set path to a user friendly representation before yielding inode_in.path = InodeUser.format_symlink(inode_in.path, symlink_dest) else: From de42e58bfa96cf9208fe8e426716056ff44b2c31 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 11 Feb 2025 17:54:19 +0100 Subject: [PATCH 0587/1352] require framework v2.21.0 for recoverfs --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 2a137fc89..d2c201bbe 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -638,7 +638,7 @@ class RecoverFs(plugins.PluginInterface): """ _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 21, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 1530e62a8626793edb1ac29a92f6273fcdc7ce1f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 11 Feb 2025 17:59:19 +0100 Subject: [PATCH 0588/1352] typo --- volatility3/framework/plugins/linux/pagecache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index d2c201bbe..730c6d6e6 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -774,7 +774,7 @@ class RecoverFs(plugins.PluginInterface): follow_symlinks=False, ) - # Prefix paths by the super_block uuid's to prevent overlaps. + # Prefix paths with the superblock UUID's to prevent overlaps. # Switch to device major and device minor for older kernels (< 2.6.39-rc1). uuid_as_prefix = vmlinux.get_type("super_block").has_member("s_uuid") if not uuid_as_prefix: From 443cfd25158e8e2a114ea6c504280729dd8dcf9b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 12 Feb 2025 10:02:31 -0600 Subject: [PATCH 0589/1352] Windows Envars: Fix unbound locals Technically, these were protected against `UnboundLocalError` exceptions through the use of the `sys` and `ntuser` boolean variables, but this really isn't the best way to prevent that from happening, and type-checkers still warn about the potentially unbound locals. This fix instead uses the `sys` and `ntuser` variables to hold the registry keys, preinitializing them to `None` and checking their value before attempting to access instance methods. --- .../framework/plugins/windows/envars.py | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 48e1ef671..4c98ffe5e 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -67,24 +67,20 @@ class Envars(interfaces.plugins.PluginInterface): symbol_table=kernel.symbol_table_name, hive_offsets=None, ): - sys = False - ntuser = False - ## The global variables + sys = None try: - key = hive.get_key( + sys = hive.get_key( "CurrentControlSet\\Control\\Session Manager\\Environment" ) - sys = True except (KeyError, registry.RegistryFormatException): with contextlib.suppress(KeyError, registry.RegistryFormatException): - key = hive.get_key( + sys = hive.get_key( "ControlSet001\\Control\\Session Manager\\Environment" ) - sys = True if sys: with contextlib.suppress(KeyError, registry.RegistryFormatException): - for node in key.get_values(): + for node in sys.get_values(): try: value_node_name = node.get_name() if value_node_name: @@ -99,13 +95,13 @@ class Envars(interfaces.plugins.PluginInterface): ) continue + ntuser = None ## The user-specific variables with contextlib.suppress(KeyError, registry.RegistryFormatException): - key = hive.get_key("Environment") - ntuser = True + ntuser = hive.get_key("Environment") if ntuser: with contextlib.suppress(KeyError, registry.RegistryFormatException): - for node in key.get_values(): + for node in ntuser.get_values(): try: value_node_name = node.get_name() if value_node_name: From bcbfc27d4fc9364fe925abc57fa667e1bfb721ec Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 12 Feb 2025 10:11:23 -0600 Subject: [PATCH 0590/1352] Windows Cmdline: Clean up output The strings being used as return values here would (IMO) be better as debug statements, with the plugin returning `renderers.UnreadableValue()` for any of the `InvalidAddressException` code paths. --- volatility3/framework/plugins/windows/cmdline.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index 9bd9eda0e..bad333a4c 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -70,6 +70,7 @@ class CmdLine(interfaces.plugins.PluginInterface): for proc in procs: process_name = utility.array_to_string(proc.ImageFileName) proc_id = "Unknown" + result_text = None try: proc_id = proc.UniqueProcessId @@ -78,13 +79,22 @@ class CmdLine(interfaces.plugins.PluginInterface): ) except exceptions.SwappedInvalidAddressException as exp: - result_text = f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)" + vollog.debug( + f"Required memory at {exp.invalid_address:#x} is inaccessible (swapped)" + ) except exceptions.PagedInvalidAddressException as exp: - result_text = f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)" + vollog.debug( + f"Required memory at {exp.invalid_address:#x} is not valid (process exited?)" + ) except exceptions.InvalidAddressException as exp: - result_text = f"Process {proc_id}: Required memory at {exp.invalid_address:#x} is not valid (incomplete layer {exp.layer_name}?)" + vollog.debug( + f"Process {proc_id}: Required memory at {exp.invalid_address:#x} is not valid (incomplete layer {exp.layer_name}?)" + ) + + if not result_text: + result_text = renderers.UnreadableValue() yield (0, (proc.UniqueProcessId, process_name, result_text)) From 4712cafa4befc72d451acb71ea370fb1ac21f0d9 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 12 Feb 2025 10:22:03 -0600 Subject: [PATCH 0591/1352] Windows Envars: Remove extra config check Tiny bit of cleanup here - there's no need to re-check the config for `SILENT` for each variable. We can just initialize it once as either an empty list or the calculated list of silent vars depending on the config value. --- volatility3/framework/plugins/windows/envars.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 48e1ef671..f76b00f7a 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -200,15 +200,13 @@ class Envars(interfaces.plugins.PluginInterface): return values def _generator(self, data): - silent_vars = [] - if self.config.get("SILENT", None): - silent_vars = self._get_silent_vars() + silent_vars = self._get_silent_vars() if self.config.get("SILENT") else [] for task in data: for var, val in task.environment_variables(): - if self.config.get("silent", None): - if var in silent_vars: - continue + if var in silent_vars: + continue + yield ( 0, ( From 9b78099a0871bbee02ea534d0384c1119c1dac31 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Feb 2025 19:24:26 +0000 Subject: [PATCH 0592/1352] Enforce kernel boundaries correctly. Fix bugs. Closes #1474 --- .../framework/plugins/windows/modules.py | 30 +++++++++++++- .../plugins/windows/orphan_kernel_threads.py | 41 ++++++++++++------- 2 files changed, 54 insertions(+), 17 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 62a622491..75b15217a 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -4,7 +4,7 @@ import logging from typing import Generator, Iterable, List, Optional -from volatility3.framework import constants, exceptions, interfaces, renderers +from volatility3.framework import symbols, constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed @@ -18,7 +18,7 @@ class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + _version = (2, 0, 2) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -127,6 +127,32 @@ class Modules(interfaces.plugins.PluginInterface): file_output, ) + @classmethod + def get_kernel_space_start(cls, context, layer_name: str, module_name: str) -> int: + """ + Returns the starting address of the kernel address space + + This method allows plugins that analyze kernel data structures to quickly detect + smeared or otherwise invalid data as many pointers must point into the kernel or + access during runtime would crash the system + """ + module = context.modules[module_name] + + if symbols.symbol_table_is_64bit(context, module.symbol_table_name): + object_type = "unsigned long long" + else: + object_type = "unsigned long" + + range_start_offset = module.get_symbol("MmSystemRangeStart").address + + kernel_space_start = module.object( + object_type=object_type, offset=range_start_offset + ) + + layer = context.layers[layer_name] + + return kernel_space_start & layer.address_mask + @classmethod def get_session_layers( cls, diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index f4901dc8c..7a865c675 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -5,9 +5,9 @@ import logging from typing import List, Generator -from volatility3.framework import interfaces, symbols +from volatility3.framework import interfaces, exceptions from volatility3.framework.configuration import requirements -from volatility3.plugins.windows import thrdscan, ssdt +from volatility3.plugins.windows import thrdscan, ssdt, modules vollog = logging.getLogger(__name__) @@ -37,6 +37,9 @@ class Threads(thrdscan.ThrdScan): requirements.PluginRequirement( name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) ), + requirements.PluginRequirement( + name="modules", plugin=modules.Modules, version=(2, 0, 2) + ), ] @classmethod @@ -56,24 +59,27 @@ class Threads(thrdscan.ThrdScan): """ module = context.modules[module_name] layer_name = module.layer_name - symbol_table = module.symbol_table_name + symbol_table_name = module.symbol_table_name collection = ssdt.SSDT.build_module_collection( - context, layer_name, symbol_table + context, layer_name, symbol_table_name ) - # FIXME - use a proper constant once established - # used to filter out smeared pointers - if symbols.symbol_table_is_64bit(context, symbol_table): - kernel_start = 0xFFFFF80000000000 - else: - kernel_start = 0x80000000 + kernel_space_start = modules.Modules.get_kernel_space_start( + context, layer_name, module_name + ) for thread in thrdscan.ThrdScan.scan_threads(context, module_name): - # we don't want smeared or terminated threads + # We don't want smeared or terminated threads + # So we access the owning process (which could also be terminated or smeared) + # Plus check the start address holding page try: proc = thread.owning_process() - except AttributeError: + pid = proc.UniqueProcessId + ppid = proc.InheritedFromUniqueProcessId + + thread_start = thread.StartAddress + except (AttributeError, exceptions.InvalidAddressException): continue # we only care about kernel threads, 4 = System @@ -81,14 +87,19 @@ class Threads(thrdscan.ThrdScan): # such as bit fields and flags are not stable in Win10+ # so we check if the thread is from the kernel itself or one its child # kernel processes (MemCompression, Regsitry, ...) - if proc.UniqueProcessId != 4 and proc.InheritedFromUniqueProcessId != 4: + if pid != 4 and ppid != 4: continue - if thread.StartAddress < kernel_start: + # if the thread has an exit time or terminated (4) state, then skip it + if thread.ExitTime.QuadPart > 0 or thread.Tcb.State == 4: + continue + + # threads pointing into userland, which is from smeared or terminated threads + if thread_start < kernel_space_start: continue module_symbols = list( - collection.get_module_symbols_by_absolute_location(thread.StartAddress) + collection.get_module_symbols_by_absolute_location(thread_start) ) # alert on threads that do not map to a module From 92db0e3f08006501f37ea1ae3379f7382d025efa Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Feb 2025 20:42:00 +0000 Subject: [PATCH 0593/1352] Address feedback --- volatility3/framework/plugins/windows/modules.py | 6 +++--- .../framework/plugins/windows/orphan_kernel_threads.py | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 75b15217a..a21a87bbd 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -18,7 +18,7 @@ class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 2) + _version = (2, 1, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -128,7 +128,7 @@ class Modules(interfaces.plugins.PluginInterface): ) @classmethod - def get_kernel_space_start(cls, context, layer_name: str, module_name: str) -> int: + def get_kernel_space_start(cls, context, module_name: str) -> int: """ Returns the starting address of the kernel address space @@ -149,7 +149,7 @@ class Modules(interfaces.plugins.PluginInterface): object_type=object_type, offset=range_start_offset ) - layer = context.layers[layer_name] + layer = context.layers[module.layer_name] return kernel_space_start & layer.address_mask diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 7a865c675..18e087553 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -38,7 +38,7 @@ class Threads(thrdscan.ThrdScan): name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 0, 2) + name="modules", plugin=modules.Modules, version=(2, 1, 0) ), ] @@ -66,7 +66,7 @@ class Threads(thrdscan.ThrdScan): ) kernel_space_start = modules.Modules.get_kernel_space_start( - context, layer_name, module_name + context, module_name ) for thread in thrdscan.ThrdScan.scan_threads(context, module_name): From 6babe158f0ad9d02a6221694babe457c426d8016 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Feb 2025 00:35:31 +0000 Subject: [PATCH 0594/1352] Address feedback --- .../framework/plugins/windows/dumpfiles.py | 29 +++++++++---------- 1 file changed, 14 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index b10c519e7..9ce9e3141 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -47,13 +47,13 @@ class DumpFiles(interfaces.plugins.PluginInterface): requirements.ListRequirement( name="virtaddr", element_type=int, - description="Dump a single _FILE_OBJECT at this virtual address", + description="Dump the _FILE_OBJECTs at the given virtual address(es)", optional=True, ), requirements.ListRequirement( name="physaddr", element_type=int, - description="Dump a single _FILE_OBJECT at this physical address", + description="Dump a single _FILE_OBJECTs at the given physical address(es)", optional=True, ), requirements.StringRequirement( @@ -320,25 +320,24 @@ class DumpFiles(interfaces.plugins.PluginInterface): ) elif offsets: + virtual_layer_name = kernel.layer_name - # Now process any offsets explicitly requested by the user. + #FIXME - change this after standard access to physical layer + physical_layer_name = self.context.layers[virtual_layer_name].config[ + "memory_layer" + ] + + # Now process any offsets explicitly requested by the user. for offset, is_virtual in offsets: try: - layer_name = kernel.layer_name - # switch to a memory layer if the user provided --physaddr instead of --virtaddr - if not is_virtual: - layer_name = self.context.layers[layer_name].config[ - "memory_layer" - ] - file_obj = self.context.object( kernel.symbol_table_name + constants.BANG + "_FILE_OBJECT", - layer_name=layer_name, - native_layer_name=kernel.layer_name, + layer_name=virtual_layer_name if is_virtual else physical_layer_name, + native_layer_name=virtual_layer_name, offset=offset, ) for result in self.process_file_object( - self.context, kernel.layer_name, self.open, file_obj + self.context, virtual_layer_name, self.open, file_obj ): yield (0, result) except exceptions.InvalidAddressException: @@ -362,11 +361,11 @@ class DumpFiles(interfaces.plugins.PluginInterface): for virtaddr in self.config["virtaddr"]: offsets.append((virtaddr, True)) - elif self.config.get("physaddr"): + if self.config.get("physaddr"): for physaddr in self.config["physaddr"]: offsets.append((physaddr, False)) - else: + if not offsets: filter_func = pslist.PsList.create_pid_filter( [self.config.get("pid", None)] ) From 49b40eb30a31618630ac9106b171a4771f3594d7 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Feb 2025 00:36:12 +0000 Subject: [PATCH 0595/1352] Make black happy --- volatility3/framework/plugins/windows/dumpfiles.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index 9ce9e3141..42f245800 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -322,17 +322,19 @@ class DumpFiles(interfaces.plugins.PluginInterface): elif offsets: virtual_layer_name = kernel.layer_name - #FIXME - change this after standard access to physical layer + # FIXME - change this after standard access to physical layer physical_layer_name = self.context.layers[virtual_layer_name].config[ "memory_layer" ] - # Now process any offsets explicitly requested by the user. + # Now process any offsets explicitly requested by the user. for offset, is_virtual in offsets: try: file_obj = self.context.object( kernel.symbol_table_name + constants.BANG + "_FILE_OBJECT", - layer_name=virtual_layer_name if is_virtual else physical_layer_name, + layer_name=( + virtual_layer_name if is_virtual else physical_layer_name + ), native_layer_name=virtual_layer_name, offset=offset, ) From 9484430036cb6cbe61ee9ee78da418b21ebe6226 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 15 Feb 2025 13:16:58 +0100 Subject: [PATCH 0596/1352] convert private classmethods to simple methods --- volatility3/framework/plugins/linux/pagecache.py | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 730c6d6e6..4b00e456b 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -663,9 +663,8 @@ class RecoverFs(plugins.PluginInterface): ), ] - @classmethod def _tar_add_reg_inode( - cls, + self, context: interfaces.context.ContextInterface, layer_name: str, tar: tarfile.TarFile, @@ -705,9 +704,8 @@ class RecoverFs(plugins.PluginInterface): return handle_buffer_size - @classmethod def _tar_add_dir( - cls, + self, tar: tarfile.TarFile, directory_path: str, mtime: float = None, @@ -726,9 +724,8 @@ class RecoverFs(plugins.PluginInterface): tar_info.mtime = mtime tar.addfile(tar_info) - @classmethod def _tar_add_lnk( - cls, + self, tar: tarfile.TarFile, symlink_source: str, symlink_dest: str, From 51b66f7573ef568e2873909b0e1eac234ab69ceb Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 15 Feb 2025 14:14:02 +0100 Subject: [PATCH 0597/1352] add symlink details in description --- volatility3/framework/plugins/linux/pagecache.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 4b00e456b..5ebdf67d9 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -633,7 +633,8 @@ class InodePages(plugins.PluginInterface): class RecoverFs(plugins.PluginInterface): """Recovers the cached filesystem (directories, files, symlinks) into a compressed tarball. - Details: level 0 directories are named after the UUID of the parent superblock; metadata aren't replicated to extracted objects; objects modification time is set to the plugin run time. + Details: level 0 directories are named after the UUID of the parent superblock; metadata aren't replicated to extracted objects; objects modification time is set to the plugin run time; absolute symlinks + are converted to relative symlinks to prevent referencing the analyst filesystem. Troubleshooting: to fix extraction errors related to long paths, please consider using https://github.com/mxmlnkn/ratarmount. """ From c2f8697cc589385bea752905ec8b975a19ef0e3b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 15 Feb 2025 15:24:53 +0100 Subject: [PATCH 0598/1352] normalize symlinks by relying on purepath --- .../framework/plugins/linux/pagecache.py | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 5ebdf67d9..29883cb9e 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -10,9 +10,10 @@ import tarfile from dataclasses import dataclass, astuple from typing import IO, List, Set, Type, Iterable, Tuple from io import BytesIO +from pathlib import PurePath from volatility3.framework.constants import architectures -from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework import constants, renderers, interfaces, exceptions from volatility3.framework.renderers import format_hints from volatility3.framework.interfaces import plugins from volatility3.framework.configuration import requirements @@ -730,6 +731,7 @@ class RecoverFs(plugins.PluginInterface): tar: tarfile.TarFile, symlink_source: str, symlink_dest: str, + symlink_source_prefix: str = "", mtime: float = None, ) -> None: """Adds a symlink to a TarFile object. @@ -738,15 +740,21 @@ class RecoverFs(plugins.PluginInterface): tar: The TarFile object to write to symlink_source: The symlink source path symlink_dest: The symlink target/destination + symlink_source_prefix: A custom path prefix to prepend the symlink source with mtime: The modification time to set the TarInfo object to """ # Patch symlinks pointing to absolute paths, # to prevent referencing the host filesystem. if symlink_dest.startswith("/"): - inode_depth = symlink_source.strip("/").count("/") - symlink_dest = "../" * inode_depth + symlink_dest.lstrip("/") - - tar_info = tarfile.TarInfo(symlink_source) + relative_dest = PurePath(symlink_dest).relative_to(PurePath("/")) + # Remove the leading "/" to prevent an extra undesired "../" in the output + symlink_dest = ( + PurePath( + *[".."] * len(PurePath(symlink_source.lstrip("/")).parent.parts) + ) + / relative_dest + ).as_posix() + tar_info = tarfile.TarInfo(symlink_source_prefix + symlink_source) tar_info.type = tarfile.SYMTYPE tar_info.linkname = symlink_dest tar_info.mode = 0o444 @@ -820,7 +828,7 @@ class RecoverFs(plugins.PluginInterface): symlink_dest = inode_in.inode.i_link.dereference().cast( "string", max_length=255, encoding="utf-8", errors="replace" ) - self._tar_add_lnk(tar, prefixed_path, symlink_dest, mtime) + self._tar_add_lnk(tar, inode_in.path, symlink_dest, prefix, mtime) # Set path to a user friendly representation before yielding inode_in.path = InodeUser.format_symlink(inode_in.path, symlink_dest) else: From b86e54e4278e18159be1ae9e44584e2c6b975f26 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 15 Feb 2025 15:25:26 +0100 Subject: [PATCH 0599/1352] extra checks and debug messages --- .../framework/plugins/linux/pagecache.py | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 29883cb9e..6d9b0c69b 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -790,13 +790,34 @@ class RecoverFs(plugins.PluginInterface): visited_paths = seen_prefixes = set() for inode_in in inodes_iter: + + # Code is slightly duplicated here with the if-block below. + # However this prevents unneeded tar manipulation if fifo + # or sock inodes comes through for example. + if not ( + inode_in.inode.is_reg or inode_in.inode.is_dir or inode_in.inode.is_link + ): + continue + + if not inode_in.path.startswith("/"): + vollog.debug( + f'Skipping processing of potentially smeared "{inode_in.path}" inode name as it does not starts with a "/".' + ) + continue + + # Construct the output path if uuid_as_prefix: prefix = f"/{inode_in.superblock.uuid}" else: prefix = f"/{inode_in.superblock.major}:{inode_in.superblock.minor}" prefixed_path = prefix + inode_in.path + # Sanity check for already processed paths if prefixed_path in visited_paths: + vollog.log( + constants.LOGLEVEL_VV, + f'Already processed prefixed inode path: "{prefixed_path}".', + ) continue elif prefix not in seen_prefixes: self._tar_add_dir(tar, prefix, mtime) From 2bf0a26c7371cc1d1843acaa8c2338f2bf75dd87 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 15 Feb 2025 15:28:23 +0100 Subject: [PATCH 0600/1352] typos --- volatility3/framework/plugins/linux/pagecache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 6d9b0c69b..7a1cf2506 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -635,7 +635,7 @@ class RecoverFs(plugins.PluginInterface): """Recovers the cached filesystem (directories, files, symlinks) into a compressed tarball. Details: level 0 directories are named after the UUID of the parent superblock; metadata aren't replicated to extracted objects; objects modification time is set to the plugin run time; absolute symlinks - are converted to relative symlinks to prevent referencing the analyst filesystem. + are converted to relative symlinks to prevent referencing the analyst's filesystem. Troubleshooting: to fix extraction errors related to long paths, please consider using https://github.com/mxmlnkn/ratarmount. """ @@ -793,7 +793,7 @@ class RecoverFs(plugins.PluginInterface): # Code is slightly duplicated here with the if-block below. # However this prevents unneeded tar manipulation if fifo - # or sock inodes comes through for example. + # or sock inodes come through for example. if not ( inode_in.inode.is_reg or inode_in.inode.is_dir or inode_in.inode.is_link ): From ca5f81140567e7ab8b58049d39a6e516c2b40ce2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Feb 2025 21:26:54 +0000 Subject: [PATCH 0601/1352] Stop reporting terminated/smeared drivers. Enforce names present. Add kernel start checking in all places --- .../framework/plugins/windows/devicetree.py | 7 +- .../framework/plugins/windows/driverirp.py | 42 +++++++++--- .../framework/plugins/windows/drivermodule.py | 31 +++++++-- .../framework/plugins/windows/driverscan.py | 66 ++++++++++++++----- .../framework/plugins/windows/modules.py | 12 +++- 5 files changed, 124 insertions(+), 34 deletions(-) diff --git a/volatility3/framework/plugins/windows/devicetree.py b/volatility3/framework/plugins/windows/devicetree.py index 6f39799c1..215d89490 100644 --- a/volatility3/framework/plugins/windows/devicetree.py +++ b/volatility3/framework/plugins/windows/devicetree.py @@ -90,7 +90,7 @@ class DeviceTree(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(1, 0, 0) + name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) ), ] @@ -99,7 +99,10 @@ class DeviceTree(interfaces.plugins.PluginInterface): # Scan the Layer for drivers for driver in driverscan.DriverScan.scan_drivers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], + kernel.layer_name, + kernel.symbol_table_name, ): try: try: diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index c3eb7c5c1..315583d11 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -2,11 +2,15 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging + from volatility3.framework import constants from volatility3.framework import renderers, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import ssdt, driverscan +from volatility3.plugins.windows import ssdt, driverscan, modules + +vollog = logging.getLogger(__name__) MAJOR_FUNCTIONS = [ "IRP_MJ_CREATE", @@ -58,7 +62,10 @@ class DriverIrp(interfaces.plugins.PluginInterface): name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) ), requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(1, 0, 0) + name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) + ), + requirements.PluginRequirement( + name="modules", plugin=modules.Modules, version=(2, 1, 0) ), ] @@ -69,17 +76,36 @@ class DriverIrp(interfaces.plugins.PluginInterface): self.context, kernel.layer_name, kernel.symbol_table_name ) + kernel_space_start = modules.Modules.get_kernel_space_start( + self.context, self.config["kernel"] + ) + for driver in driverscan.DriverScan.scan_drivers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], + kernel.layer_name, + kernel.symbol_table_name, ): try: driver_name = driver.get_driver_name() except (ValueError, exceptions.InvalidAddressException): driver_name = renderers.NotApplicableValue() - for i, address in enumerate(driver.MajorFunction): + for i in range(len(driver.MajorFunction)): + try: + irp_handler = driver.MajorFunction[i] + except exceptions.InvalidAddressException: + vollog.debug( + f"Failed to get IRP handler entry at index {i} for driver at {driver.vol.offset:#x}" + ) + continue + + # smear + if irp_handler < kernel_space_start: + continue + module_symbols = collection.get_module_symbols_by_absolute_location( - address + irp_handler ) module_found = False @@ -96,7 +122,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], - format_hints.Hex(address), + format_hints.Hex(irp_handler), module_name, symbol.split(constants.BANG)[1], ), @@ -109,7 +135,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], - format_hints.Hex(address), + format_hints.Hex(irp_handler), module_name, renderers.NotAvailableValue(), ), @@ -122,7 +148,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): format_hints.Hex(driver.vol.offset), driver_name, MAJOR_FUNCTIONS[i], - format_hints.Hex(address), + format_hints.Hex(irp_handler), renderers.NotAvailableValue(), renderers.NotAvailableValue(), ), diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index de827602e..a6de37981 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -5,7 +5,7 @@ from typing import Iterator, List, Tuple from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import ssdt, driverscan +from volatility3.plugins.windows import ssdt, driverscan, modules # built in Windows-components that trigger false positives KNOWN_DRIVERS = ["ACPI_HAL", "PnpManager", "RAW", "WMIxWDM", "Win32k", "Fs_Rec"] @@ -29,7 +29,10 @@ class DriverModule(interfaces.plugins.PluginInterface): name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) ), requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(1, 0, 0) + name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) + ), + requirements.PluginRequirement( + name="modules", plugin=modules.Modules, version=(2, 1, 0) ), ] @@ -45,9 +48,21 @@ class DriverModule(interfaces.plugins.PluginInterface): self.context, kernel.layer_name, kernel.symbol_table_name ) + kernel_space_start = modules.Modules.get_kernel_space_start( + self.context, self.config["kernel"] + ) + for driver in driverscan.DriverScan.scan_drivers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], + kernel.layer_name, + kernel.symbol_table_name, ): + # We want starts of 0 as rootkits often set this value + # greater than 0 but less than the kernel space start is smear/terminated though + if 0 < driver.DriverStart < kernel_space_start: + continue + # we do not care about actual symbol names, we just want to know if the driver points to a known module module_symbols = list( collection.get_module_symbols_by_absolute_location(driver.DriverStart) @@ -59,6 +74,10 @@ class DriverModule(interfaces.plugins.PluginInterface): name, ) = driverscan.DriverScan.get_names_for_driver(driver) + # drivers without any names will not produce useful output + if not driver_name and not service_key and not name: + continue + known_exception = driver_name in KNOWN_DRIVERS yield ( @@ -66,9 +85,9 @@ class DriverModule(interfaces.plugins.PluginInterface): ( format_hints.Hex(driver.vol.offset), known_exception, - driver_name, - service_key, - name, + driver_name or renderers.NotAvailableValue(), + service_key or renderers.NotAvailableValue(), + name or renderers.NotAvailableValue(), ), ) diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index d388ffbb7..22615f052 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -2,19 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Iterable +from typing import Iterable, Optional, Tuple from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import poolscanner +from volatility3.plugins.windows import poolscanner, modules class DriverScan(interfaces.plugins.PluginInterface): """Scans for drivers present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -33,8 +33,9 @@ class DriverScan(interfaces.plugins.PluginInterface): def scan_drivers( cls, context: interfaces.context.ContextInterface, + kernel_module_name: str, layer_name: str, - symbol_table: str, + symbol_table_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for drivers using the poolscanner module and constraints. @@ -48,17 +49,45 @@ class DriverScan(interfaces.plugins.PluginInterface): """ constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"Dri\xf6", b"Driv"] + symbol_table_name, [b"Dri\xf6", b"Driv"] + ) + + module = context.module(symbol_table_name, layer_name, 0) + driver_start_offset = module.get_type("_DRIVER_OBJECT").relative_child_offset( + "DriverStart" + ) + + kernel_space_start = modules.Modules.get_kernel_space_start( + context, kernel_module_name ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, layer_name, symbol_table_name, constraints ): _constraint, mem_object, _header = result - yield mem_object + + scanned_layer = context.layers[mem_object.vol.layer_name] + + # *Many* _DRIVER_OBJECT instances were found at the end of a page + # leading to member access causing backtraces across several plugins + # when members were accessed as the next page was paged out. + # `DriverStart` is the first member from the beginning of the structure + # of interest to plugins, so if it is not accessible then this instance + # is not useful or usable during analysis + # 8 covers this value 32 and 64 bit systems + if scanned_layer.is_valid(mem_object.vol.offset + driver_start_offset, 8): + # Many/most rootkits zero out their DriverStart member for anti-forensics + # so we accept a driver start that is either 0 or is points into kernel memory (the current layer) + if ( + mem_object.DriverStart == 0 + or mem_object.DriverStart > kernel_space_start + ): + yield mem_object @classmethod - def get_names_for_driver(cls, driver): + def get_names_for_driver( + cls, driver + ) -> Tuple[Optional[str], Optional[str], Optional[str]]: """ Convenience method for getting the commonly used names associated with a driver @@ -72,17 +101,17 @@ class DriverScan(interfaces.plugins.PluginInterface): try: driver_name = driver.get_driver_name() except (ValueError, exceptions.InvalidAddressException): - driver_name = renderers.NotApplicableValue() + driver_name = None try: service_key = driver.DriverExtension.ServiceKeyName.String except exceptions.InvalidAddressException: - service_key = renderers.NotApplicableValue() + service_key = None try: name = driver.DriverName.String except exceptions.InvalidAddressException: - name = renderers.NotApplicableValue() + name = None return driver_name, service_key, name @@ -90,19 +119,26 @@ class DriverScan(interfaces.plugins.PluginInterface): kernel = self.context.modules[self.config["kernel"]] for driver in self.scan_drivers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], + kernel.layer_name, + kernel.symbol_table_name, ): driver_name, service_key, name = self.get_names_for_driver(driver) + # Prior to #1481, this plugin reported dozens to hundreds of junk drivers per sample + if not driver_name and not service_key and not name: + continue + yield ( 0, ( format_hints.Hex(driver.vol.offset), format_hints.Hex(driver.DriverStart), format_hints.Hex(driver.DriverSize), - service_key, - driver_name, - name, + service_key or renderers.NotAvailableValue(), + driver_name or renderers.NotAvailableValue(), + name or renderers.NotAvailableValue(), ), ) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index a21a87bbd..717a1b0d2 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -138,16 +138,22 @@ class Modules(interfaces.plugins.PluginInterface): """ module = context.modules[module_name] + # default is used if/when MmSystemRangeStart is paged out if symbols.symbol_table_is_64bit(context, module.symbol_table_name): object_type = "unsigned long long" + default_start = 0xFFFF800000000000 else: object_type = "unsigned long" + default_start = 0x80000000 range_start_offset = module.get_symbol("MmSystemRangeStart").address - kernel_space_start = module.object( - object_type=object_type, offset=range_start_offset - ) + try: + kernel_space_start = module.object( + object_type=object_type, offset=range_start_offset + ) + except exceptions.InvalidAddressException: + kernel_space_start = default_start layer = context.layers[module.layer_name] From d5976146fb53428a6af7a1a4be128f4e21349201 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 18:24:23 +0000 Subject: [PATCH 0602/1352] Layers: Restore get_valid_table caching Partially restore performance as per #1618 --- volatility3/framework/layers/intel.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index b6f59fee1..55b930177 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -284,6 +284,7 @@ class Intel(linear.LinearlyMappedLayer): return entry, position + @functools.lru_cache(maxsize=1025) def _get_valid_table(self, base_address: int) -> Optional[bytes]: """Extracts the table, validates it and returns it if it's valid.""" table = self._context.layers.read( From 346e58e798d4c51a735005f0c9fa98de8d249fdb Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 18:50:44 +0000 Subject: [PATCH 0603/1352] Layers: Reduce double bounds test and simplify intel translation --- volatility3/framework/layers/intel.py | 26 +++----------------------- 1 file changed, 3 insertions(+), 23 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 55b930177..1069b7f6d 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -159,7 +159,7 @@ class Intel(linear.LinearlyMappedLayer): translated address lives in and the layer_name that the address lives in """ - entry, position = self._translate_entry(offset) + entry, position = self._translate_entry(offset & self.page_mask) # Now we're done if not self._page_is_valid(entry): @@ -181,23 +181,8 @@ class Intel(linear.LinearlyMappedLayer): """Extracts the page frame number (PFN) from the page table entry (PTE) entry""" return self._mask(entry, self._maxphyaddr - 1, 0) >> self.page_shift - def _translate_entry(self, offset: int) -> Tuple[int, int]: - """Translates a specific offset based on paging tables. - - Returns the translated entry value - """ - offset &= self.address_mask - - if not (self.minimum_address <= offset <= self.maximum_address): - raise exceptions.InvalidAddressException( - offset, f"Address {offset:#x} outside virtual address range" - ) - - page_address = offset & self.page_mask - return self._translate_page(page_address) - @functools.lru_cache(maxsize=1024) - def _translate_page(self, page_address: int) -> int: + def _translate_entry(self, page_address: int) -> int: """Translates a page address based on paging tables. Args: @@ -206,11 +191,6 @@ class Intel(linear.LinearlyMappedLayer): Returns: the translated entry value """ - if page_address & ~self.page_mask != 0: - raise exceptions.InvalidAddressException( - page_address, - f"Invalid page address {page_address:#x}. The address must be aligned to the page size", - ) # Setup the entry and how far we are through the offset # Position maintains the number of bits left to process # We or with 0x1 to ensure our page_map_offset is always valid @@ -310,7 +290,7 @@ class Intel(linear.LinearlyMappedLayer): def is_dirty(self, offset: int) -> bool: """Returns whether the page at offset is marked dirty""" - return self._page_is_dirty(self._translate_entry(offset)[0]) + return self._page_is_dirty(self._translate_entry(offset & self.page_mask)[0]) def mapping( self, offset: int, length: int, ignore_errors: bool = False From 7a533054f791c5748474c34c889a7c968f0b4444 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 16 Feb 2025 21:24:33 +0000 Subject: [PATCH 0604/1352] Address feedback --- volatility3/framework/plugins/windows/devicetree.py | 4 ---- volatility3/framework/plugins/windows/driverirp.py | 2 -- volatility3/framework/plugins/windows/drivermodule.py | 2 -- volatility3/framework/plugins/windows/driverscan.py | 11 +++++------ volatility3/framework/plugins/windows/modules.py | 3 +++ 5 files changed, 8 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/windows/devicetree.py b/volatility3/framework/plugins/windows/devicetree.py index 215d89490..012a8750d 100644 --- a/volatility3/framework/plugins/windows/devicetree.py +++ b/volatility3/framework/plugins/windows/devicetree.py @@ -95,14 +95,10 @@ class DeviceTree(interfaces.plugins.PluginInterface): ] def _generator(self) -> Iterator[Tuple]: - kernel = self.context.modules[self.config["kernel"]] - # Scan the Layer for drivers for driver in driverscan.DriverScan.scan_drivers( self.context, self.config["kernel"], - kernel.layer_name, - kernel.symbol_table_name, ): try: try: diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 315583d11..a1959453a 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -83,8 +83,6 @@ class DriverIrp(interfaces.plugins.PluginInterface): for driver in driverscan.DriverScan.scan_drivers( self.context, self.config["kernel"], - kernel.layer_name, - kernel.symbol_table_name, ): try: driver_name = driver.get_driver_name() diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index a6de37981..db1255637 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -55,8 +55,6 @@ class DriverModule(interfaces.plugins.PluginInterface): for driver in driverscan.DriverScan.scan_drivers( self.context, self.config["kernel"], - kernel.layer_name, - kernel.symbol_table_name, ): # We want starts of 0 as rootkits often set this value # greater than 0 but less than the kernel space start is smear/terminated though diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index 22615f052..f179ff548 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -34,8 +34,6 @@ class DriverScan(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, kernel_module_name: str, - layer_name: str, - symbol_table_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for drivers using the poolscanner module and constraints. @@ -48,6 +46,11 @@ class DriverScan(interfaces.plugins.PluginInterface): A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures """ + kernel = context.modules[kernel_module_name] + + symbol_table_name = kernel.symbol_table_name + layer_name = kernel.layer_name + constraints = poolscanner.PoolScanner.builtin_constraints( symbol_table_name, [b"Dri\xf6", b"Driv"] ) @@ -116,13 +119,9 @@ class DriverScan(interfaces.plugins.PluginInterface): return driver_name, service_key, name def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - for driver in self.scan_drivers( self.context, self.config["kernel"], - kernel.layer_name, - kernel.symbol_table_name, ): driver_name, service_key, name = self.get_names_for_driver(driver) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 717a1b0d2..44a67f472 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -153,6 +153,9 @@ class Modules(interfaces.plugins.PluginInterface): object_type=object_type, offset=range_start_offset ) except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to read MmSystemRangeStart. Defaulting to {default_start:#x} for the kernel space start." + ) kernel_space_start = default_start layer = context.layers[module.layer_name] From ea2c50710e6d234b637067d155c91307f39f1795 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 21:44:30 +0000 Subject: [PATCH 0605/1352] Linux: Correct enum import issues --- volatility3/framework/constants/linux/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 8df3d2665..0eaf227d5 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -5,7 +5,7 @@ Linux-specific values that aren't found in debug symbols """ -from enum import IntEnum, Flag +import enum from dataclasses import dataclass KERNEL_NAME = "__kernel__" @@ -342,7 +342,7 @@ class ELF_IDENT(enum.IntEnum): EI_PAD = 8 -class ELF_CLASS(IntEnum): +class ELF_CLASS(enum.IntEnum): """ELF header class types""" ELFCLASSNONE = 0 @@ -364,7 +364,7 @@ PTRACE_O_EXITKILL = 1 << 20 PTRACE_O_SUSPEND_SECCOMP = 1 << 21 -class PT_FLAGS(Flag): +class PT_FLAGS(enum.Flag): "PTrace flags" PT_PTRACED = 0x00001 PT_SEIZED = 0x10000 From 6486b4a569544c7a941a77c6fcab34a6f4e0dd73 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 21:46:26 +0000 Subject: [PATCH 0606/1352] Linux: Fix some black issues --- volatility3/framework/constants/linux/__init__.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 0eaf227d5..ba0b92cc7 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -328,6 +328,7 @@ class IF_OPER_STATES(enum.Enum): DORMANT = 5 UP = 6 + class ELF_IDENT(enum.IntEnum): """ELF header e_ident indexes""" @@ -349,6 +350,7 @@ class ELF_CLASS(enum.IntEnum): ELFCLASS32 = 1 ELFCLASS64 = 2 + # PTrace PT_OPT_FLAG_SHIFT = 3 @@ -366,6 +368,7 @@ PTRACE_O_SUSPEND_SECCOMP = 1 << 21 class PT_FLAGS(enum.Flag): "PTrace flags" + PT_PTRACED = 0x00001 PT_SEIZED = 0x10000 From a31ea33f847e1273f4b9abf6ad335daa76a50a1f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 22:28:54 +0000 Subject: [PATCH 0607/1352] Windows: Fix console potentially unbound variables --- .../framework/plugins/windows/consoles.py | 36 +++++++++++++------ 1 file changed, 26 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index a448989c0..b345d4b77 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -7,7 +7,7 @@ import logging import os import struct -from typing import Tuple, Generator, Set, Dict, Any, Type +from typing import Tuple, Optional, Generator, Set, Dict, Any, Type from volatility3.framework import interfaces, symbols, exceptions from volatility3.framework import renderers @@ -74,7 +74,7 @@ class Consoles(interfaces.plugins.PluginInterface): @classmethod def find_conhost_proc( cls, proc_list: Generator[interfaces.objects.ObjectInterface, None, None] - ) -> Tuple[interfaces.context.ContextInterface, str]: + ) -> Generator[Tuple[interfaces.objects.ObjectInterface, str], None, None]: """ Walks the process list and returns the conhost instances. @@ -87,6 +87,7 @@ class Consoles(interfaces.plugins.PluginInterface): for proc in proc_list: if utility.array_to_string(proc.ImageFileName).lower() == "conhost.exe": + proc_id = "Unknown" try: proc_id = proc.UniqueProcessId proc_layer_name = proc.add_process_layer() @@ -100,8 +101,8 @@ class Consoles(interfaces.plugins.PluginInterface): @classmethod def find_conhostexe( - cls, conhost_proc: interfaces.context.ContextInterface - ) -> Tuple[int, int]: + cls, conhost_proc: interfaces.objects.ObjectInterface + ) -> Tuple[Optional[int], Optional[int]]: """ Finds the base address of conhost.exe @@ -130,7 +131,7 @@ class Consoles(interfaces.plugins.PluginInterface): config_path: str, conhost_layer_name: str, conhost_base: int, - ) -> Tuple[str, Type]: + ) -> Tuple[Optional[str], Dict[str, Type]]: """Tries to determine which symbol filename to use for the image's console information. This is similar to the netstat plugin. @@ -341,6 +342,11 @@ class Consoles(interfaces.plugins.PluginInterface): conhost_base, ) + if symbol_filename is None: + raise ValueError( + "Symbol filename could not be determined for conhost version" + ) + vollog.debug(f"Using symbol file '{symbol_filename}' and types {class_types}") return intermed.IntermediateSymbolTable.create( @@ -362,10 +368,14 @@ class Consoles(interfaces.plugins.PluginInterface): procs: Generator[interfaces.objects.ObjectInterface, None, None], max_history: Set[int], max_buffers: Set[int], - ) -> Tuple[ - interfaces.context.ContextInterface, - interfaces.context.ContextInterface, - Dict[str, Any], + ) -> Generator[ + Tuple[ + interfaces.objects.ObjectInterface, + Optional[interfaces.objects.ObjectInterface], + list[Any], + ], + None, + None, ]: """Gets the Console Information structure and its related properties for each conhost process @@ -401,6 +411,11 @@ class Consoles(interfaces.plugins.PluginInterface): "Unable to find the location of conhost.exe. Analysis cannot proceed." ) continue + if conhostexe_size is None: + vollog.info( + "Unable to determine the size of conhost.exe. Analysis cannot proceed." + ) + continue vollog.debug(f"Found conhost.exe base at {conhostexe_base:#x}") proc_layer = context.layers[proc_layer_name] @@ -420,6 +435,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) found_console_info_for_proc = False + console_info = None # scan for potential _CONSOLE_INFORMATION structures by using the CommandHistorySize for max_history_value in max_history: max_history_bytes = struct.pack("H", max_history_value) @@ -431,7 +447,7 @@ class Consoles(interfaces.plugins.PluginInterface): scanners.BytesScanner(max_history_bytes), sections=[(conhostexe_base, conhostexe_size)], ): - + console_info = None console_properties = [] try: From 8106a1652908ef975d71a4dfefbdcf4bfc869fb2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 22:33:57 +0000 Subject: [PATCH 0608/1352] Windows: Fix typing in lower python versions --- volatility3/framework/plugins/windows/consoles.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index b345d4b77..63bb3e9b9 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -7,7 +7,7 @@ import logging import os import struct -from typing import Tuple, Optional, Generator, Set, Dict, Any, Type +from typing import Tuple, Optional, Generator, Set, Dict, Any, Type, List from volatility3.framework import interfaces, symbols, exceptions from volatility3.framework import renderers @@ -372,7 +372,7 @@ class Consoles(interfaces.plugins.PluginInterface): Tuple[ interfaces.objects.ObjectInterface, Optional[interfaces.objects.ObjectInterface], - list[Any], + List[Any], ], None, None, From 3ea563bde87fa4c67f7b0bc4de4f216614096ec6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 19 Feb 2025 18:48:32 +0000 Subject: [PATCH 0609/1352] Windows: Use built-in libraries where possible (idea from #1627) --- volatility3/framework/plugins/windows/hashdump.py | 3 +-- volatility3/framework/plugins/windows/lsadump.py | 6 +++--- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 621b0ae53..1fea3d49d 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -8,7 +8,6 @@ from struct import pack, unpack from typing import List, Optional, Tuple from Crypto.Cipher import AES, ARC4, DES -from Crypto.Hash import MD5 from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements @@ -529,7 +528,7 @@ class Hashdump(interfaces.plugins.PluginInterface): (des_k1, des_k2) = cls.sid_to_key(rid) des1 = DES.new(des_k1, DES.MODE_ECB) des2 = DES.new(des_k2, DES.MODE_ECB) - md5 = MD5.new() + md5 = hashlib.md5() md5.update(hbootkey[:0x10] + pack(" Date: Wed, 19 Feb 2025 23:42:37 +0000 Subject: [PATCH 0610/1352] Separate out the net symbols from standard linux Also includes some typing changes. --- volatility3/framework/plugins/linux/ip.py | 11 +- .../framework/plugins/linux/netfilter.py | 25 +- .../framework/plugins/linux/sockstat.py | 39 +- .../framework/symbols/linux/__init__.py | 37 +- .../symbols/linux/extensions/__init__.py | 645 +----------------- .../framework/symbols/linux/extensions/net.py | 631 +++++++++++++++++ volatility3/framework/symbols/linux/net.py | 27 + 7 files changed, 758 insertions(+), 657 deletions(-) create mode 100644 volatility3/framework/symbols/linux/extensions/net.py create mode 100644 volatility3/framework/symbols/linux/net.py diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 6b523379b..36efa0609 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -6,6 +6,7 @@ from typing import List from volatility3.framework import interfaces, renderers, constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins +from volatility3.framework.symbols.linux import net class Addr(plugins.PluginInterface): @@ -23,6 +24,9 @@ class Addr(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="Net", component=net.NetSymbols, version=(1, 0, 0) + ), ] def _gather_net_dev_info(self, net_dev): @@ -94,7 +98,10 @@ class Link(plugins.PluginInterface): name="kernel", description="Linux kernel", architectures=["Intel32", "Intel64"], - ) + ), + requirements.VersionRequirement( + name="Net", component=net.NetSymbols, version=(1, 0, 0) + ), ] def _gather_net_dev_link_info(self, net_device): @@ -123,6 +130,8 @@ class Link(plugins.PluginInterface): def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] + net.NetSymbols.apply(self.context.symbol_space[vmlinux.symbol_table_name]) + net_type_symname = vmlinux.symbol_table_name + constants.BANG + "net" net_device_symname = vmlinux.symbol_table_name + constants.BANG + "net_device" diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index ccb7509aa..5e1bf283f 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -17,6 +17,7 @@ from volatility3.framework import ( from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.symbols import linux +from volatility3.framework.symbols.linux import net from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -82,7 +83,7 @@ class AbstractNetfilter(ABC): self.list_head_size = self.vmlinux.get_type("list_head").size lsmod_required_version = Netfilter._required_lsmod_version - lsmod_current_version = lsmod.Lsmod._version + lsmod_current_version = lsmod.Lsmod.version if not requirements.VersionRequirement.matches_required( lsmod_required_version, lsmod_current_version ): @@ -91,7 +92,7 @@ class AbstractNetfilter(ABC): ) linuxutils_required_version = Netfilter._required_linuxutils_version - linuxutils_current_version = linux.LinuxUtilities._version + linuxutils_current_version = linux.LinuxUtilities.version if not requirements.VersionRequirement.matches_required( linuxutils_required_version, linuxutils_current_version ): @@ -99,11 +100,20 @@ class AbstractNetfilter(ABC): f"linux.LinuxUtilities version not suitable: required {linuxutils_required_version} found {linuxutils_current_version}" ) + linux_net_required_version = Netfilter._required_linuxnet_version + linux_net_current_version = net.NetSymbols.version + if not requirements.VersionRequirement.matches_required( + linux_net_required_version, linux_net_current_version + ): + raise exceptions.PluginRequirementException( + f"symbols.linux.net.NetSymbols version not suitable: required {linux_net_required_version} found {linux_net_current_version}" + ) + linux_utilities_modules_required_version = ( Netfilter._required_linux_utilities_modules_version ) linux_utilities_modules_current_version = ( - linux_utilities_modules.Modules._version + linux_utilities_modules.Modules.version ) if not requirements.VersionRequirement.matches_required( linux_utilities_modules_required_version, @@ -113,6 +123,9 @@ class AbstractNetfilter(ABC): f"linux_utilities_modules.Modules version not suitable: required {linux_utilities_modules_required_version} found {linux_utilities_modules_current_version}" ) + symbol_table = self._context.symbol_space[self.vmlinux.symbol_table_name] + net.NetSymbols.apply(symbol_table) + modules = lsmod.Lsmod.list_modules(context, kernel_module_name) self.handlers = linux.LinuxUtilities.generate_kernel_handler_info( context, kernel_module_name, modules @@ -697,6 +710,7 @@ class Netfilter(interfaces.plugins.PluginInterface): _required_linux_utilities_modules_version = (1, 0, 0) _required_linuxutils_version = (2, 1, 0) _required_lsmod_version = (2, 0, 0) + _required_linuxnet_version = (1, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -719,6 +733,11 @@ class Netfilter(interfaces.plugins.PluginInterface): component=linux.LinuxUtilities, version=cls._required_linuxutils_version, ), + requirements.VersionRequirement( + name="linuxnet", + component=net.NetSymbols, + version=cls._required_linuxnet_version, + ), ] def _format_fields(self, fields): diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 3d2df655b..ad74a6ee7 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -13,6 +13,7 @@ from volatility3.framework.objects import utility from volatility3.framework.symbols import linux from volatility3.plugins.linux import lsof from volatility3.plugins.linux import pslist +from volatility3.framework.symbols.linux import net vollog = logging.getLogger(__name__) @@ -22,13 +23,24 @@ class SockHandlers(interfaces.configuration.VersionableInterface): """Handles several socket families extracting the sockets information.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) + _version = (4, 0, 0) + _net_version_required = (1, 0, 0) - def __init__(self, vmlinux, task, *args, **kwargs): + def __init__(self, context, vmlinux_name, task, *args, **kwargs): super().__init__(*args, **kwargs) - self._vmlinux = vmlinux + self._vmlinux = context.modules[vmlinux_name] + self._symbol_table = context.symbol_space[self._vmlinux.symbol_table_name] self._task = task + if not requirements.VersionRequirement.matches_required( + net.NetSymbols.version, self._net_version_required + ): + raise ValueError( + f"Version mismatch of volatility library NetSymbols version ({net.NetSymbols.version}) and needed version ({self._net_version_required})" + ) + + net.NetSymbols.apply(self._symbol_table) + try: netns_id = task.nsproxy.net_ns.get_inode() except AttributeError: @@ -438,7 +450,7 @@ class Sockstat(plugins.PluginInterface): """Lists all network connections for all processes.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 3) + _version = (3, 0, 4) @classmethod def get_requirements(cls): @@ -449,7 +461,7 @@ class Sockstat(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="SockHandlers", component=SockHandlers, version=(3, 0, 0) + name="SockHandlers", component=SockHandlers, version=(4, 0, 0) ), requirements.PluginRequirement( name="lsof", plugin=lsof.Lsof, version=(2, 0, 0) @@ -460,6 +472,9 @@ class Sockstat(plugins.PluginInterface): requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="linux_net", component=net.NetSymbols, version=(1, 0, 0) + ), requirements.BooleanRequirement( name="unix", description=("Show UNIX domain Sockets only"), @@ -578,7 +593,7 @@ class Sockstat(plugins.PluginInterface): return tuple(sock_stat), protocol - def _generator(self, pids: List[int], netns_id_arg: int, symbol_table: str): + def _generator(self, pids: List[int], netns_id_arg: int, kernel_module_name: str): """Enumerate tasks sockets. Each row represents a kernel socket. Args: @@ -599,9 +614,13 @@ class Sockstat(plugins.PluginInterface): tasks: String with a list of tasks and FDs using a socket. It can also have extended information such as socket filters, bpf info, etc. """ + vmlinux = self.context.modules[kernel_module_name] + symbol_table = self.context.symbol_space[vmlinux.symbol_table_name] + net.NetSymbols.apply(symbol_table) + filter_func = pslist.PsList.create_pid_filter(pids) socket_generator = self.list_sockets( - self.context, symbol_table, filter_func=filter_func + self.context, kernel_module_name, filter_func=filter_func ) for ( @@ -646,7 +665,7 @@ class Sockstat(plugins.PluginInterface): def run(self): pids = self.config.get("pids") netns_id = self.config["netns"] - symbol_table = self.config["kernel"] + kernel_module_name = self.config["kernel"] tree_grid_args = [ ("NetNS", int), @@ -666,4 +685,6 @@ class Sockstat(plugins.PluginInterface): ("Filter", str), ] - return TreeGrid(tree_grid_args, self._generator(pids, netns_id, symbol_table)) + return TreeGrid( + tree_grid_args, self._generator(pids, netns_id, kernel_module_name) + ) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index fb6c35d31..8162689db 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -64,6 +64,25 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): # kernels < 4.18. Reuses timespec64 obj extension, since both has the same members self.optional_set_type_class("timespec", extensions.timespec64) + # Network + # FIXME: Deprecate all of this once the framework hits version 3 + self.set_type_class("net", extensions.net.net) + self.set_type_class("net_device", extensions.net.net_device) + self.set_type_class("in_device", extensions.net.in_device) + self.set_type_class("in_ifaddr", extensions.net.in_ifaddr) + self.set_type_class("inet6_dev", extensions.net.inet6_dev) + self.set_type_class("inet6_ifaddr", extensions.net.inet6_ifaddr) + self.set_type_class("socket", extensions.net.socket) + self.set_type_class("sock", extensions.net.sock) + self.set_type_class("inet_sock", extensions.net.inet_sock) + self.set_type_class("unix_sock", extensions.net.unix_sock) + # Might not exist in older kernels or the current symbols + self.optional_set_type_class("netlink_sock", extensions.net.netlink_sock) + self.optional_set_type_class("vsock_sock", extensions.net.vsock_sock) + self.optional_set_type_class("packet_sock", extensions.net.packet_sock) + self.optional_set_type_class("bt_sock", extensions.net.bt_sock) + self.optional_set_type_class("xdp_sock", extensions.net.xdp_sock) + # Mount self.set_type_class("vfsmount", extensions.vfsmount) # Might not exist in older kernels or the current symbols @@ -71,24 +90,6 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.optional_set_type_class("mnt_namespace", extensions.mnt_namespace) self.optional_set_type_class("rb_root", extensions.rb_root) - # Network - self.set_type_class("net", extensions.net) - self.set_type_class("net_device", extensions.net_device) - self.set_type_class("in_device", extensions.in_device) - self.set_type_class("in_ifaddr", extensions.in_ifaddr) - self.set_type_class("inet6_dev", extensions.inet6_dev) - self.set_type_class("inet6_ifaddr", extensions.inet6_ifaddr) - self.set_type_class("socket", extensions.socket) - self.set_type_class("sock", extensions.sock) - self.set_type_class("inet_sock", extensions.inet_sock) - self.set_type_class("unix_sock", extensions.unix_sock) - # Might not exist in older kernels or the current symbols - self.optional_set_type_class("netlink_sock", extensions.netlink_sock) - self.optional_set_type_class("vsock_sock", extensions.vsock_sock) - self.optional_set_type_class("packet_sock", extensions.packet_sock) - self.optional_set_type_class("bt_sock", extensions.bt_sock) - self.optional_set_type_class("xdp_sock", extensions.xdp_sock) - # Only found in 6.1+ kernels self.optional_set_type_class("maple_tree", extensions.maple_tree) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 5e5fc1ccf..901a82e69 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -9,7 +9,6 @@ import functools import binascii import stat import datetime -import socket as socket_module import uuid from typing import ( Generator, @@ -24,12 +23,11 @@ from typing import ( ) from volatility3.framework import constants, exceptions, objects, interfaces, symbols -from volatility3.framework.renderers import conversion, UnparsableValue +from volatility3.framework.renderers import conversion from volatility3.framework.constants import linux as linux_constants from volatility3.framework.layers import linear, intel from volatility3.framework.objects import utility from volatility3.framework.symbols import generic, linux, intermed -from volatility3.framework.symbols.wrappers import Flags from volatility3.framework.symbols.linux.extensions import elf vollog = logging.getLogger(__name__) @@ -273,7 +271,7 @@ class module(generic.GenericIntelProcess): yield (sym_name, sym_address) @functools.lru_cache - def get_module_address_boundaries(self) -> Tuple[int, int]: + def get_module_address_boundaries(self) -> Optional[Tuple[int, int]]: """Return the module address boundaries based on its symbol addresses""" if not self.section_strtab or self.num_symtab < 1: @@ -731,7 +729,9 @@ class task_struct(generic.GenericIntelProcess): raise exceptions.VolatilityException("Unsupported") - def get_boottime(self, root_time_namespace: bool = True) -> datetime.datetime: + def get_boottime( + self, root_time_namespace: bool = True + ) -> Optional[datetime.datetime]: """Returns the boot time in UTC as a datetime. Args: @@ -755,7 +755,7 @@ class task_struct(generic.GenericIntelProcess): return boottime.to_datetime() - def get_create_time(self) -> datetime.datetime: + def get_create_time(self) -> Optional[datetime.datetime]: """Retrieves the task's start time from its time namespace. Args: context: The context to retrieve required elements (layers, symbol tables) from @@ -771,6 +771,8 @@ class task_struct(generic.GenericIntelProcess): # The kernel exports only tv_sec to procfs, see kernel's show_stat(). # This means user-space tools, like those in the procps package (e.g., ps, top, etc.), # only use the boot time seconds to compute dates relatives to this. + if boottime is None: + return None boottime = boottime.replace(microsecond=0) task_start_time_timedelta = self._get_task_start_time() @@ -1239,7 +1241,7 @@ class qstr(objects.StructType): else: str_length = 255 try: - ret = objects.utility.pointer_to_string(self.name, str_length) + ret = utility.pointer_to_string(self.name, str_length) except (exceptions.InvalidAddressException, ValueError): ret = "" return ret @@ -1320,7 +1322,7 @@ class dentry(objects.StructType): dentry_type_name = self.get_symbol_table_name() + constants.BANG + "dentry" yield from list_head_member.to_list(dentry_type_name, walk_member) - def get_inode(self) -> interfaces.objects.ObjectInterface: + def get_inode(self) -> Optional[interfaces.objects.ObjectInterface]: """Returns the inode associated with this dentry""" inode_ptr = self.d_inode @@ -1345,7 +1347,7 @@ class struct_file(objects.StructType): raise AttributeError("Unable to find file -> vfs mount") - def get_inode(self) -> interfaces.objects.ObjectInterface: + def get_inode(self) -> Optional[interfaces.objects.ObjectInterface]: """Returns an inode associated with this file""" inode_ptr = None @@ -1873,7 +1875,7 @@ class mnt_namespace(objects.StructType): def get_mount_points( self, - ) -> Iterator[interfaces.objects.ObjectInterface]: + ) -> Iterator[Optional[interfaces.objects.ObjectInterface]]: """Yields the mount points for this mount namespace. Yields: @@ -1909,619 +1911,6 @@ class mnt_namespace(objects.StructType): ) -class net(objects.StructType): - def get_inode(self): - """Get the namespace id for this network namespace. - - Raises: - AttributeError: If it cannot find the network namespace id for the - current kernel. - - Returns: - int: the namespace id - """ - if self.has_member("proc_inum"): - # 3.8.13 <= kernel < 3.19.8 - return self.proc_inum - elif self.has_member("ns") and self.ns.has_member("inum"): - # kernel >= 3.19.8 - return self.ns.inum - else: - # kernel < 3.8.13 - raise AttributeError("Unable to find net_namespace inode") - - -class net_device(objects.StructType): - def get_device_name(self) -> str: - """Return the network device name - - Returns: - str: The network device name - """ - return utility.array_to_string(self.name) - - def _format_as_mac_address(self, hwaddr): - return ":".join([f"{x:02x}" for x in hwaddr[: self.addr_len]]) - - def get_mac_address(self) -> str: - """Get the MAC address of this network interface. - - Returns: - str: the MAC address of this network interface. - """ - if self.has_member("perm_addr"): - null_mac_addr_bytes = b"\x00" * self.addr_len - null_mac_addr = self._format_as_mac_address(null_mac_addr_bytes) - mac_addr = self._format_as_mac_address(self.perm_addr) - if mac_addr != null_mac_addr: - return mac_addr - - parent_layer = self._context.layers[self.vol.layer_name] - try: - hwaddr = parent_layer.read(self.dev_addr, self.addr_len, pad=True) - except exceptions.InvalidAddressException: - vollog.debug( - f"Unable to read network inteface mac address from {self.dev_addr:#x}" - ) - return None - - return self._format_as_mac_address(hwaddr) - - def _get_flag_choices(self) -> Dict: - """Return the net_device flags as a list of strings""" - vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) - try: - # kernels >= 3.15 - net_device_flags_enum = vmlinux.get_enumeration("net_device_flags") - choices = net_device_flags_enum.choices - except exceptions.SymbolError: - # kernels < 3.15 - choices = linux_constants.NET_DEVICE_FLAGS - - return choices - - def _get_net_device_flag_value(self, name): - """Return the net_device flag value based on the flag name""" - return self._get_flag_choices().get(name, UnparsableValue()) - - def _get_netdev_state_t(self): - vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) - try: - # At least from kernels 2.6.30 - return vmlinux.get_enumeration("netdev_state_t") - except exceptions.SymbolError: - raise exceptions.VolatilityException( - "Unsupported kernel or wrong ISF. Cannot find 'netdev_state_t' enumeration" - ) - - def is_running(self) -> bool: - """Test if the network device has been brought up - Based on netif_running() - - Returns: - bool: True if the device is UP - """ - netdev_state_t_enum = self._get_netdev_state_t() - - # It should be safe. netdev_state_t::__LINK_STATE_START has been available since - # at least kernels 2.6.30 - return ( - self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_START"]) != 0 - ) - - def is_carrier_ok(self) -> bool: - """Check if carrier is present on network device - Based on netif_carrier_ok() - - Returns: - bool: True if carrier present - """ - netdev_state_t_enum = self._get_netdev_state_t() - - # It should be safe. netdev_state_t::__LINK_STATE_NOCARRIER has been available - # since at least kernels 2.6.30 - return ( - self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_NOCARRIER"]) - == 0 - ) - - def is_dormant(self) -> bool: - """Check if the network device is dormant - Based on netif_dormant(() - - Returns: - bool: True if the network device is dormant - """ - netdev_state_t_enum = self._get_netdev_state_t() - - # It should be safe. netdev_state_t::__LINK_STATE_DORMANT has been available - # since at least kernels 2.6.30 - return ( - self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_DORMANT"]) != 0 - ) - - def is_operational(self) -> bool: - """Test if the carrier is operational - Based on netif_oper_up() - - Returns: - bool: True if the device is UP - """ - - return self.get_operational_state() in ("UP", "UNKNOWN") - - def get_flag_names(self) -> List[str]: - """Return the net_device flags as a list of strings. - This is the combination of flags exported through kernel APIs to userspace. - Based on dev_get_flags() - - Returns: - List[str]: A list of flag names - """ - choices = self._get_flag_choices() - clear_flags = choices.get("IFF_PROMISC", 0) - clear_flags |= choices.get("IFF_ALLMULTI", 0) - clear_flags |= choices.get("IFF_RUNNING", 0) - clear_flags |= choices.get("IFF_LOWER_UP", 0) - clear_flags |= choices.get("IFF_DORMANT", 0) - - clear_gflags = choices.get("IFF_PROMISC", 0) - clear_gflags |= choices.get("IFF_ALLMULTI)", 0) - - flags = (self.flags & ~clear_flags) | (self.gflags & ~clear_gflags) - - if self.is_running(): - if self.is_operational(): - flags |= choices.get("IFF_RUNNING", 0) - if self.is_carrier_ok(): - flags |= choices.get("IFF_LOWER_UP", 0) - if self.is_dormant(): - flags |= choices.get("IFF_DORMANT", 0) - - net_device_flags_enum_flags = Flags(choices) - net_device_flags = net_device_flags_enum_flags(flags) - - # It's preferable to provide a deterministic list of items. i.e. for testing - return sorted(net_device_flags) - - @property - def promisc(self): - """Return if this network interface is in promiscuous mode. - - Returns: - bool: True if this network interface is in promiscuous mode. Otherwise, False - """ - return self.flags & self._get_net_device_flag_value("IFF_PROMISC") != 0 - - def get_net_namespace_id(self) -> int: - """Return the network namespace id for this network interface. - - Returns: - int: the network namespace id for this network interface - """ - nd_net = self.nd_net - if nd_net.has_member("net"): - # In kernel 4.1.52 the 'nd_net' member type was changed from - # 'struct net*' to 'possible_net_t' which has a 'struct net *net' member. - net_ns_id = nd_net.net.get_inode() - else: - # In kernels < 4.1.52 the 'nd_net'member type was 'struct net*' - net_ns_id = nd_net.get_inode() - - return net_ns_id - - def get_operational_state(self) -> str: - """Return the netwok device oprational state (RFC 2863) string - - Returns: - str: A string with the operational state - """ - try: - return linux_constants.IF_OPER_STATES(self.operstate).name - except ValueError: - vollog.warning(f"Invalid net_device operational state '{self.operstate}'") - return UnparsableValue() - - def get_qdisc_name(self) -> str: - """Return the network device queuing discipline (qdisc) name - - Returns: - str: A string with the queuing discipline (qdisc) name - """ - return utility.array_to_string(self.qdisc.ops.id) - - def get_queue_length(self) -> int: - """Return the netwrok device transmision qeueue length (qlen) - - Returns: - int: the netwrok device transmision qeueue length (qlen) - """ - return self.tx_queue_len - - -class in_device(objects.StructType): - def get_addresses(self): - """Yield the IPv4 ifaddr addresses - - Yields: - in_ifaddr: An IPv4 ifaddr address - """ - cur = self.ifa_list - while cur and cur.vol.offset: - yield cur - cur = cur.ifa_next - - -class inet6_dev(objects.StructType): - def get_addresses(self): - """Yield the IPv6 ifaddr addresses - - Yields: - inet6_ifaddr: An IPv6 ifaddr address - """ - if not self.has_member( - "addr_list" - ) or not self.addr_list.vol.type_name.endswith(constants.BANG + "list_head"): - # kernels < 3.0 - # FIXME: struct inet6_ifaddr *addr_list; - vollog.warning( - "IPv6 is unsupported for this kernel. Check if the ISF contains the appropriate 'inet6_dev' type" - ) - return - - symbol_space = self._context.symbol_space - table_name = self.get_symbol_table_name() - inet6_ifaddr_symname = table_name + constants.BANG + "inet6_ifaddr" - if not symbol_space.has_type(inet6_ifaddr_symname) or not symbol_space.get_type( - inet6_ifaddr_symname - ).has_member("if_list"): - vollog.warning( - "IPv6 is unsupported for this kernel. Check if the ISF contains the appropriate 'inet6_ifaddr' type" - ) - return - - # 'if_list' member was added to 'inet6_ifaddr' type in kernels 3.0 - yield from self.addr_list.to_list(inet6_ifaddr_symname, "if_list") - - -class in_ifaddr(objects.StructType): - # Translation to text based on iproute2 package. See 'rtnl_rtscope_tab' in lib/rt_names.c - _rtnl_rtscope_tab = { - "RT_SCOPE_UNIVERSE": "global", - "RT_SCOPE_NOWHERE": "nowhere", - "RT_SCOPE_HOST": "host", - "RT_SCOPE_LINK": "link", - "RT_SCOPE_SITE": "site", - } - - def get_scope_type(self): - """Get the scope type for this IPv4 address - - Returns: - str: the IPv4 scope type. - """ - table_name = self.get_symbol_table_name() - rt_scope_enum = self._context.symbol_space.get_enumeration( - table_name + constants.BANG + "rt_scope_t" - ) - try: - rt_scope = rt_scope_enum.lookup(self.ifa_scope) - except ValueError: - return "unknown" - - return self._rtnl_rtscope_tab.get(rt_scope, "unknown") - - def get_address(self): - """Get an string with the IPv4 address - - Returns: - str: the IPv4 address - """ - return conversion.convert_ipv4(self.ifa_address) - - def get_prefix_len(self): - """Get the IPv4 address prefix len - - Returns: - int: the IPv4 address prefix len - """ - return self.ifa_prefixlen - - -class inet6_ifaddr(objects.StructType): - def get_scope_type(self): - """Get the scope type for this IPv6 address - - Returns: - str: the IPv6 scope type. - """ - if (self.scope & linux_constants.IFA_HOST) != 0: - return "host" - elif (self.scope & linux_constants.IFA_LINK) != 0: - return "link" - elif (self.scope & linux_constants.IFA_SITE) != 0: - return "site" - else: - return "global" - - def get_address(self): - """Get an string with the IPv6 address - - Returns: - str: the IPv6 address - """ - return conversion.convert_ipv6(self.addr.in6_u.u6_addr32) - - def get_prefix_len(self): - """Get the IPv6 address prefix len - - Returns: - int: the IPv6 address prefix len - """ - return self.prefix_len - - -class socket(objects.StructType): - def _get_vol_kernel(self): - symbol_table_arr = self.vol.type_name.split("!", 1) - symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None - - module_names = list( - self._context.modules.get_modules_by_symbol_tables(symbol_table) - ) - if not module_names: - raise ValueError(f"No module using the symbol table {symbol_table}") - kernel_module_name = module_names[0] - kernel = self._context.modules[kernel_module_name] - return kernel - - def get_inode(self): - try: - kernel = self._get_vol_kernel() - except ValueError: - return 0 - socket_alloc = linux.LinuxUtilities.container_of( - self.vol.offset, "socket_alloc", "socket", kernel - ) - vfs_inode = socket_alloc.vfs_inode - - return vfs_inode.i_ino - - def get_state(self): - socket_state_idx = self.state - if 0 <= socket_state_idx < len(linux_constants.SOCKET_STATES): - return linux_constants.SOCKET_STATES[socket_state_idx] - - -class sock(objects.StructType): - def get_family(self): - family_idx = self.__sk_common.skc_family - if 0 <= family_idx < len(linux_constants.SOCK_FAMILY): - return linux_constants.SOCK_FAMILY[family_idx] - - def get_type(self): - return linux_constants.SOCK_TYPES.get(self.sk_type, "") - - def get_inode(self): - if not self.sk_socket: - return 0 - return self.sk_socket.get_inode() - - def get_protocol(self): - return None - - def get_state(self): - # Return the generic socket state - if self.has_member("sk"): - return self.sk.sk_socket.get_state() - return self.sk_socket.get_state() - - -class unix_sock(objects.StructType): - def get_name(self): - if not self.addr: - return None - sockaddr_un = self.addr.name.cast("sockaddr_un") - saddr = str(utility.array_to_string(sockaddr_un.sun_path)) - return saddr - - def get_protocol(self): - return None - - def get_state(self): - """Return a string representing the sock state.""" - - # Unix socket states reuse (a subset) of the inet_sock states contants - if self.sk.get_type() == "STREAM": - state_idx = self.sk.__sk_common.skc_state - if 0 <= state_idx < len(linux_constants.TCP_STATES): - return linux_constants.TCP_STATES[state_idx] - else: - # Return the generic socket state - return self.sk.sk_socket.get_state() - - def get_inode(self): - return self.sk.get_inode() - - -class inet_sock(objects.StructType): - def get_family(self): - family_idx = self.sk.__sk_common.skc_family - if 0 <= family_idx < len(linux_constants.SOCK_FAMILY): - return linux_constants.SOCK_FAMILY[family_idx] - - def get_protocol(self): - # If INET6 family and a proto is defined, we use that specific IPv6 protocol. - # Otherwise, we use the standard IP protocol. - protocol = linux_constants.IP_PROTOCOLS.get(self.sk.sk_protocol) - if self.get_family() == "AF_INET6": - protocol = linux_constants.IPV6_PROTOCOLS.get(self.sk.sk_protocol, protocol) - return protocol - - def get_state(self): - """Return a string representing the sock state.""" - - if self.sk.get_type() == "STREAM": - state_idx = self.sk.__sk_common.skc_state - if 0 <= state_idx < len(linux_constants.TCP_STATES): - return linux_constants.TCP_STATES[state_idx] - else: - # Return the generic socket state - return self.sk.sk_socket.get_state() - - def get_src_port(self): - sport_le = getattr(self, "sport", getattr(self, "inet_sport", None)) - if sport_le is not None: - return socket_module.htons(sport_le) - - def get_dst_port(self): - sk_common = self.sk.__sk_common - if hasattr(sk_common, "skc_portpair"): - dport_le = sk_common.skc_portpair & 0xFFFF - elif hasattr(self, "dport"): - dport_le = self.dport - elif hasattr(self, "inet_dport"): - dport_le = self.inet_dport - elif hasattr(sk_common, "skc_dport"): - dport_le = sk_common.skc_dport - else: - return None - return socket_module.htons(dport_le) - - def get_src_addr(self): - sk_common = self.sk.__sk_common - family = sk_common.skc_family - if family == socket_module.AF_INET: - addr_size = 4 - if hasattr(self, "rcv_saddr"): - saddr = self.rcv_saddr - elif hasattr(self, "inet_rcv_saddr"): - saddr = self.inet_rcv_saddr - else: - saddr = sk_common.skc_rcv_saddr - elif family == socket_module.AF_INET6: - addr_size = 16 - saddr = self.pinet6.saddr - else: - return None - parent_layer = self._context.layers[self.vol.layer_name] - try: - addr_bytes = parent_layer.read(saddr.vol.offset, addr_size) - except exceptions.InvalidAddressException: - vollog.debug( - f"Unable to read socket src address from {saddr.vol.offset:#x}" - ) - return None - return socket_module.inet_ntop(family, addr_bytes) - - def get_dst_addr(self): - sk_common = self.sk.__sk_common - family = sk_common.skc_family - if family == socket_module.AF_INET: - if hasattr(self, "daddr") and self.daddr: - daddr = self.daddr - elif hasattr(self, "inet_daddr") and self.inet_daddr: - daddr = self.inet_daddr - else: - daddr = sk_common.skc_daddr - addr_size = 4 - elif family == socket_module.AF_INET6: - if hasattr(self.pinet6, "daddr"): - daddr = self.pinet6.daddr - else: - daddr = sk_common.skc_v6_daddr - addr_size = 16 - else: - return None - parent_layer = self._context.layers[self.vol.layer_name] - try: - addr_bytes = parent_layer.read(daddr.vol.offset, addr_size) - except exceptions.InvalidAddressException: - vollog.debug( - f"Unable to read socket dst address from {daddr.vol.offset:#x}" - ) - return None - return socket_module.inet_ntop(family, addr_bytes) - - -class netlink_sock(objects.StructType): - def get_protocol(self): - protocol_idx = self.sk.sk_protocol - if 0 <= protocol_idx < len(linux_constants.NETLINK_PROTOCOLS): - return linux_constants.NETLINK_PROTOCOLS[protocol_idx] - - def get_state(self): - # Return the generic socket state - return self.sk.sk_socket.get_state() - - def get_portid(self): - if self.has_member("pid"): - # kernel < 3.7.10 - return self.pid - if self.has_member("portid"): - # kernel >= 3.7.10 - return self.portid - else: - raise AttributeError("Unable to find a source port id") - - def get_dst_portid(self): - if self.has_member("dst_pid"): - # kernel < 3.7.10 - return self.dst_pid - if self.has_member("dst_portid"): - # kernel >= 3.7.10 - return self.dst_portid - else: - raise AttributeError("Unable to find a destination port id") - - -class vsock_sock(objects.StructType): - def get_protocol(self): - # The protocol should always be 0 for vsocks - return None - - def get_state(self): - # Return the generic socket state - return self.sk.sk_socket.get_state() - - -class packet_sock(objects.StructType): - def get_protocol(self): - eth_proto = socket_module.htons(self.num) - if eth_proto == 0: - return None - elif eth_proto in linux_constants.ETH_PROTOCOLS: - return linux_constants.ETH_PROTOCOLS[eth_proto] - else: - return f"0x{eth_proto:x}" - - def get_state(self): - # Return the generic socket state - return self.sk.sk_socket.get_state() - - -class bt_sock(objects.StructType): - def get_protocol(self): - type_idx = self.sk.sk_protocol - if 0 <= type_idx < len(linux_constants.BLUETOOTH_PROTOCOLS): - return linux_constants.BLUETOOTH_PROTOCOLS[type_idx] - - def get_state(self): - state_idx = self.sk.__sk_common.skc_state - if 0 <= state_idx < len(linux_constants.BLUETOOTH_STATES): - return linux_constants.BLUETOOTH_STATES[state_idx] - - -class xdp_sock(objects.StructType): - def get_protocol(self): - # The protocol should always be 0 for xdp_sock - return None - - def get_state(self): - # xdp_sock.state is an enum - return self.state.lookup() - - class bpf_prog(objects.StructType): _BPF_PROG_CHUNK_SHIFT = 6 _BPF_PROG_CHUNK_SIZE = 1 << _BPF_PROG_CHUNK_SHIFT @@ -3013,7 +2402,9 @@ class inode(objects.StructType): else: return None - def _time_member_to_datetime(self, member) -> datetime.datetime: + def _time_member_to_datetime( + self, member + ) -> datetime.datetime | interfaces.renderers.BaseAbsentValue: if self.has_member(f"{member}_sec") and self.has_member(f"{member}_nsec"): # kernels >= 6.11 it's i_*_sec -> time64_t and i_*_nsec -> u32 # Ref Linux commit 3aa63a569c64e708df547a8913c84e64a06e7853 @@ -3292,7 +2683,7 @@ class IDR(objects.StructType): return (1 << bits) - 1 - def idr_find(self, idr_id: int) -> int: + def idr_find(self, idr_id: int) -> Optional[int]: """Finds an ID within the IDR data structure. Based on idr_find_slowpath(), 3.9 <= Kernel < 4.11 Args: @@ -3368,7 +2759,9 @@ class IDR(objects.StructType): class rb_root(objects.StructType): - def _walk_nodes(self, root_node: int) -> Iterator[int]: + def _walk_nodes( + self, root_node: interfaces.objects.ObjectInterface + ) -> Iterator[int]: """Traverses the Red-Black tree from the root node and yields a pointer to each node in this tree. diff --git a/volatility3/framework/symbols/linux/extensions/net.py b/volatility3/framework/symbols/linux/extensions/net.py new file mode 100644 index 000000000..a5836062e --- /dev/null +++ b/volatility3/framework/symbols/linux/extensions/net.py @@ -0,0 +1,631 @@ +import logging +from typing import Dict, List + +from volatility3.framework import objects, exceptions, renderers, interfaces, constants +from volatility3.framework.objects import utility +from volatility3.framework.constants import linux as linux_constants +from volatility3.framework.symbols import wrappers +from volatility3.framework.symbols import linux +from volatility3.framework.renderers import conversion +import socket as socket_module + + +vollog = logging.getLogger(__name__) + + +class net(objects.StructType): + def get_inode(self): + """Get the namespace id for this network namespace. + + Raises: + AttributeError: If it cannot find the network namespace id for the + current kernel. + + Returns: + int: the namespace id + """ + if self.has_member("proc_inum"): + # 3.8.13 <= kernel < 3.19.8 + return self.proc_inum + elif self.has_member("ns") and self.ns.has_member("inum"): + # kernel >= 3.19.8 + return self.ns.inum + else: + # kernel < 3.8.13 + raise AttributeError("Unable to find net_namespace inode") + + +class net_device(objects.StructType): + def get_device_name(self) -> str: + """Return the network device name + + Returns: + str: The network device name + """ + return utility.array_to_string(self.name) + + def _format_as_mac_address(self, hwaddr): + return ":".join([f"{x:02x}" for x in hwaddr[: self.addr_len]]) + + def get_mac_address(self) -> Optional[str]: + """Get the MAC address of this network interface. + + Returns: + str: the MAC address of this network interface. + """ + if self.has_member("perm_addr"): + null_mac_addr_bytes = b"\x00" * self.addr_len + null_mac_addr = self._format_as_mac_address(null_mac_addr_bytes) + mac_addr = self._format_as_mac_address(self.perm_addr) + if mac_addr != null_mac_addr: + return mac_addr + + parent_layer = self._context.layers[self.vol.layer_name] + try: + hwaddr = parent_layer.read(self.dev_addr, self.addr_len, pad=True) + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to read network inteface mac address from {self.dev_addr:#x}" + ) + return None + + return self._format_as_mac_address(hwaddr) + + def _get_flag_choices(self) -> Dict: + """Return the net_device flags as a list of strings""" + vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + try: + # kernels >= 3.15 + net_device_flags_enum = vmlinux.get_enumeration("net_device_flags") + choices = net_device_flags_enum.choices + except exceptions.SymbolError: + # kernels < 3.15 + choices = linux_constants.NET_DEVICE_FLAGS + + return choices + + def _get_net_device_flag_value(self, name): + """Return the net_device flag value based on the flag name""" + return self._get_flag_choices().get(name, renderers.UnparsableValue()) + + def _get_netdev_state_t(self): + vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) + try: + # At least from kernels 2.6.30 + return vmlinux.get_enumeration("netdev_state_t") + except exceptions.SymbolError: + raise exceptions.VolatilityException( + "Unsupported kernel or wrong ISF. Cannot find 'netdev_state_t' enumeration" + ) + + def is_running(self) -> bool: + """Test if the network device has been brought up + Based on netif_running() + + Returns: + bool: True if the device is UP + """ + netdev_state_t_enum = self._get_netdev_state_t() + + # It should be safe. netdev_state_t::__LINK_STATE_START has been available since + # at least kernels 2.6.30 + return ( + self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_START"]) != 0 + ) + + def is_carrier_ok(self) -> bool: + """Check if carrier is present on network device + Based on netif_carrier_ok() + + Returns: + bool: True if carrier present + """ + netdev_state_t_enum = self._get_netdev_state_t() + + # It should be safe. netdev_state_t::__LINK_STATE_NOCARRIER has been available + # since at least kernels 2.6.30 + return ( + self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_NOCARRIER"]) + == 0 + ) + + def is_dormant(self) -> bool: + """Check if the network device is dormant + Based on netif_dormant(() + + Returns: + bool: True if the network device is dormant + """ + netdev_state_t_enum = self._get_netdev_state_t() + + # It should be safe. netdev_state_t::__LINK_STATE_DORMANT has been available + # since at least kernels 2.6.30 + return ( + self.state & (1 << netdev_state_t_enum.choices["__LINK_STATE_DORMANT"]) != 0 + ) + + def is_operational(self) -> bool: + """Test if the carrier is operational + Based on netif_oper_up() + + Returns: + bool: True if the device is UP + """ + + return self.get_operational_state() in ("UP", "UNKNOWN") + + def get_flag_names(self) -> List[str]: + """Return the net_device flags as a list of strings. + This is the combination of flags exported through kernel APIs to userspace. + Based on dev_get_flags() + + Returns: + List[str]: A list of flag names + """ + choices = self._get_flag_choices() + clear_flags = choices.get("IFF_PROMISC", 0) + clear_flags |= choices.get("IFF_ALLMULTI", 0) + clear_flags |= choices.get("IFF_RUNNING", 0) + clear_flags |= choices.get("IFF_LOWER_UP", 0) + clear_flags |= choices.get("IFF_DORMANT", 0) + + clear_gflags = choices.get("IFF_PROMISC", 0) + clear_gflags |= choices.get("IFF_ALLMULTI)", 0) + + flags = (self.flags & ~clear_flags) | (self.gflags & ~clear_gflags) + + if self.is_running(): + if self.is_operational(): + flags |= choices.get("IFF_RUNNING", 0) + if self.is_carrier_ok(): + flags |= choices.get("IFF_LOWER_UP", 0) + if self.is_dormant(): + flags |= choices.get("IFF_DORMANT", 0) + + net_device_flags_enum_flags = wrappers.Flags(choices) + net_device_flags = net_device_flags_enum_flags(flags) + + # It's preferable to provide a deterministic list of items. i.e. for testing + return sorted(net_device_flags) + + @property + def promisc(self): + """Return if this network interface is in promiscuous mode. + + Returns: + bool: True if this network interface is in promiscuous mode. Otherwise, False + """ + return self.flags & self._get_net_device_flag_value("IFF_PROMISC") != 0 + + def get_net_namespace_id(self) -> int: + """Return the network namespace id for this network interface. + + Returns: + int: the network namespace id for this network interface + """ + nd_net = self.nd_net + if nd_net.has_member("net"): + # In kernel 4.1.52 the 'nd_net' member type was changed from + # 'struct net*' to 'possible_net_t' which has a 'struct net *net' member. + net_ns_id = nd_net.net.get_inode() + else: + # In kernels < 4.1.52 the 'nd_net'member type was 'struct net*' + net_ns_id = nd_net.get_inode() + + return net_ns_id + + def get_operational_state(self) -> str | interfaces.renderers.BaseAbsentValue: + """Return the netwok device oprational state (RFC 2863) string + + Returns: + str: A string with the operational state + """ + try: + return linux_constants.IF_OPER_STATES(self.operstate).name + except ValueError: + vollog.warning(f"Invalid net_device operational state '{self.operstate}'") + return renderers.UnparsableValue() + + def get_qdisc_name(self) -> str: + """Return the network device queuing discipline (qdisc) name + + Returns: + str: A string with the queuing discipline (qdisc) name + """ + return utility.array_to_string(self.qdisc.ops.id) + + def get_queue_length(self) -> int: + """Return the netwrok device transmision qeueue length (qlen) + + Returns: + int: the netwrok device transmision qeueue length (qlen) + """ + return self.tx_queue_len + + +class in_device(objects.StructType): + def get_addresses(self): + """Yield the IPv4 ifaddr addresses + + Yields: + in_ifaddr: An IPv4 ifaddr address + """ + cur = self.ifa_list + while cur and cur.vol.offset: + yield cur + cur = cur.ifa_next + + +class inet6_dev(objects.StructType): + def get_addresses(self): + """Yield the IPv6 ifaddr addresses + + Yields: + inet6_ifaddr: An IPv6 ifaddr address + """ + if not self.has_member( + "addr_list" + ) or not self.addr_list.vol.type_name.endswith(constants.BANG + "list_head"): + # kernels < 3.0 + # FIXME: struct inet6_ifaddr *addr_list; + vollog.warning( + "IPv6 is unsupported for this kernel. Check if the ISF contains the appropriate 'inet6_dev' type" + ) + return + + symbol_space = self._context.symbol_space + table_name = self.get_symbol_table_name() + inet6_ifaddr_symname = table_name + constants.BANG + "inet6_ifaddr" + if not symbol_space.has_type(inet6_ifaddr_symname) or not symbol_space.get_type( + inet6_ifaddr_symname + ).has_member("if_list"): + vollog.warning( + "IPv6 is unsupported for this kernel. Check if the ISF contains the appropriate 'inet6_ifaddr' type" + ) + return + + # 'if_list' member was added to 'inet6_ifaddr' type in kernels 3.0 + yield from self.addr_list.to_list(inet6_ifaddr_symname, "if_list") + + +class in_ifaddr(objects.StructType): + # Translation to text based on iproute2 package. See 'rtnl_rtscope_tab' in lib/rt_names.c + _rtnl_rtscope_tab = { + "RT_SCOPE_UNIVERSE": "global", + "RT_SCOPE_NOWHERE": "nowhere", + "RT_SCOPE_HOST": "host", + "RT_SCOPE_LINK": "link", + "RT_SCOPE_SITE": "site", + } + + def get_scope_type(self): + """Get the scope type for this IPv4 address + + Returns: + str: the IPv4 scope type. + """ + table_name = self.get_symbol_table_name() + rt_scope_enum = self._context.symbol_space.get_enumeration( + table_name + constants.BANG + "rt_scope_t" + ) + try: + rt_scope = rt_scope_enum.lookup(self.ifa_scope) + except ValueError: + return "unknown" + + return self._rtnl_rtscope_tab.get(rt_scope, "unknown") + + def get_address(self): + """Get an string with the IPv4 address + + Returns: + str: the IPv4 address + """ + return conversion.convert_ipv4(self.ifa_address) + + def get_prefix_len(self): + """Get the IPv4 address prefix len + + Returns: + int: the IPv4 address prefix len + """ + return self.ifa_prefixlen + + +class inet6_ifaddr(objects.StructType): + def get_scope_type(self): + """Get the scope type for this IPv6 address + + Returns: + str: the IPv6 scope type. + """ + if (self.scope & linux_constants.IFA_HOST) != 0: + return "host" + elif (self.scope & linux_constants.IFA_LINK) != 0: + return "link" + elif (self.scope & linux_constants.IFA_SITE) != 0: + return "site" + else: + return "global" + + def get_address(self): + """Get an string with the IPv6 address + + Returns: + str: the IPv6 address + """ + return conversion.convert_ipv6(self.addr.in6_u.u6_addr32) + + def get_prefix_len(self): + """Get the IPv6 address prefix len + + Returns: + int: the IPv6 address prefix len + """ + return self.prefix_len + + +class socket(objects.StructType): + def _get_vol_kernel(self): + symbol_table_arr = self.vol.type_name.split("!", 1) + symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None + + if symbol_table is None: + raise ValueError(f"No module using the symbol table {symbol_table}") + + module_names = list( + self._context.modules.get_modules_by_symbol_tables(symbol_table) + ) + if not module_names: + raise ValueError(f"No module using the symbol table {symbol_table}") + kernel_module_name = module_names[0] + kernel = self._context.modules[kernel_module_name] + return kernel + + def get_inode(self): + try: + kernel = self._get_vol_kernel() + except ValueError: + return 0 + socket_alloc = linux.LinuxUtilities.container_of( + self.vol.offset, "socket_alloc", "socket", kernel + ) + if socket_alloc is None: + return 0 + vfs_inode = socket_alloc.vfs_inode + + return vfs_inode.i_ino + + def get_state(self): + socket_state_idx = self.state + if 0 <= socket_state_idx < len(linux_constants.SOCKET_STATES): + return linux_constants.SOCKET_STATES[socket_state_idx] + + +class sock(objects.StructType): + def get_family(self): + family_idx = self.__sk_common.skc_family + if 0 <= family_idx < len(linux_constants.SOCK_FAMILY): + return linux_constants.SOCK_FAMILY[family_idx] + + def get_type(self): + return linux_constants.SOCK_TYPES.get(self.sk_type, "") + + def get_inode(self): + if not self.sk_socket: + return 0 + return self.sk_socket.get_inode() + + def get_protocol(self): + return None + + def get_state(self): + # Return the generic socket state + if self.has_member("sk"): + return self.sk.sk_socket.get_state() + return self.sk_socket.get_state() + + +class unix_sock(objects.StructType): + def get_name(self): + if not self.addr: + return None + sockaddr_un = self.addr.name.cast("sockaddr_un") + saddr = str(utility.array_to_string(sockaddr_un.sun_path)) + return saddr + + def get_protocol(self): + return None + + def get_state(self): + """Return a string representing the sock state.""" + + # Unix socket states reuse (a subset) of the inet_sock states contants + if self.sk.get_type() == "STREAM": + state_idx = self.sk.__sk_common.skc_state + if 0 <= state_idx < len(linux_constants.TCP_STATES): + return linux_constants.TCP_STATES[state_idx] + else: + # Return the generic socket state + return self.sk.sk_socket.get_state() + + def get_inode(self): + return self.sk.get_inode() + + +class inet_sock(objects.StructType): + def get_family(self): + family_idx = self.sk.__sk_common.skc_family + if 0 <= family_idx < len(linux_constants.SOCK_FAMILY): + return linux_constants.SOCK_FAMILY[family_idx] + + def get_protocol(self): + # If INET6 family and a proto is defined, we use that specific IPv6 protocol. + # Otherwise, we use the standard IP protocol. + protocol = linux_constants.IP_PROTOCOLS.get(self.sk.sk_protocol) + if self.get_family() == "AF_INET6": + protocol = linux_constants.IPV6_PROTOCOLS.get(self.sk.sk_protocol, protocol) + return protocol + + def get_state(self): + """Return a string representing the sock state.""" + + if self.sk.get_type() == "STREAM": + state_idx = self.sk.__sk_common.skc_state + if 0 <= state_idx < len(linux_constants.TCP_STATES): + return linux_constants.TCP_STATES[state_idx] + else: + # Return the generic socket state + return self.sk.sk_socket.get_state() + + def get_src_port(self): + sport_le = getattr(self, "sport", getattr(self, "inet_sport", None)) + if sport_le is not None: + return socket_module.htons(sport_le) + + def get_dst_port(self): + sk_common = self.sk.__sk_common + if hasattr(sk_common, "skc_portpair"): + dport_le = sk_common.skc_portpair & 0xFFFF + elif hasattr(self, "dport"): + dport_le = self.dport + elif hasattr(self, "inet_dport"): + dport_le = self.inet_dport + elif hasattr(sk_common, "skc_dport"): + dport_le = sk_common.skc_dport + else: + return None + return socket_module.htons(dport_le) + + def get_src_addr(self): + sk_common = self.sk.__sk_common + family = sk_common.skc_family + if family == socket_module.AF_INET: + addr_size = 4 + if hasattr(self, "rcv_saddr"): + saddr = self.rcv_saddr + elif hasattr(self, "inet_rcv_saddr"): + saddr = self.inet_rcv_saddr + else: + saddr = sk_common.skc_rcv_saddr + elif family == socket_module.AF_INET6: + addr_size = 16 + saddr = self.pinet6.saddr + else: + return None + parent_layer = self._context.layers[self.vol.layer_name] + try: + addr_bytes = parent_layer.read(saddr.vol.offset, addr_size) + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to read socket src address from {saddr.vol.offset:#x}" + ) + return None + return socket_module.inet_ntop(family, addr_bytes) + + def get_dst_addr(self): + sk_common = self.sk.__sk_common + family = sk_common.skc_family + if family == socket_module.AF_INET: + if hasattr(self, "daddr") and self.daddr: + daddr = self.daddr + elif hasattr(self, "inet_daddr") and self.inet_daddr: + daddr = self.inet_daddr + else: + daddr = sk_common.skc_daddr + addr_size = 4 + elif family == socket_module.AF_INET6: + if hasattr(self.pinet6, "daddr"): + daddr = self.pinet6.daddr + else: + daddr = sk_common.skc_v6_daddr + addr_size = 16 + else: + return None + parent_layer = self._context.layers[self.vol.layer_name] + try: + addr_bytes = parent_layer.read(daddr.vol.offset, addr_size) + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to read socket dst address from {daddr.vol.offset:#x}" + ) + return None + return socket_module.inet_ntop(family, addr_bytes) + + +class netlink_sock(objects.StructType): + def get_protocol(self): + protocol_idx = self.sk.sk_protocol + if 0 <= protocol_idx < len(linux_constants.NETLINK_PROTOCOLS): + return linux_constants.NETLINK_PROTOCOLS[protocol_idx] + + def get_state(self): + # Return the generic socket state + return self.sk.sk_socket.get_state() + + def get_portid(self): + if self.has_member("pid"): + # kernel < 3.7.10 + return self.pid + if self.has_member("portid"): + # kernel >= 3.7.10 + return self.portid + else: + raise AttributeError("Unable to find a source port id") + + def get_dst_portid(self): + if self.has_member("dst_pid"): + # kernel < 3.7.10 + return self.dst_pid + if self.has_member("dst_portid"): + # kernel >= 3.7.10 + return self.dst_portid + else: + raise AttributeError("Unable to find a destination port id") + + +class vsock_sock(objects.StructType): + def get_protocol(self): + # The protocol should always be 0 for vsocks + return None + + def get_state(self): + # Return the generic socket state + return self.sk.sk_socket.get_state() + + +class packet_sock(objects.StructType): + def get_protocol(self): + eth_proto = socket_module.htons(self.num) + if eth_proto == 0: + return None + elif eth_proto in linux_constants.ETH_PROTOCOLS: + return linux_constants.ETH_PROTOCOLS[eth_proto] + else: + return f"0x{eth_proto:x}" + + def get_state(self): + # Return the generic socket state + return self.sk.sk_socket.get_state() + + +class bt_sock(objects.StructType): + def get_protocol(self): + type_idx = self.sk.sk_protocol + if 0 <= type_idx < len(linux_constants.BLUETOOTH_PROTOCOLS): + return linux_constants.BLUETOOTH_PROTOCOLS[type_idx] + + def get_state(self): + state_idx = self.sk.__sk_common.skc_state + if 0 <= state_idx < len(linux_constants.BLUETOOTH_STATES): + return linux_constants.BLUETOOTH_STATES[state_idx] + + +class xdp_sock(objects.StructType): + def get_protocol(self): + # The protocol should always be 0 for xdp_sock + return None + + def get_state(self): + # xdp_sock.state is an enum + return self.state.lookup() diff --git a/volatility3/framework/symbols/linux/net.py b/volatility3/framework/symbols/linux/net.py new file mode 100644 index 000000000..44c70460c --- /dev/null +++ b/volatility3/framework/symbols/linux/net.py @@ -0,0 +1,27 @@ +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux.extensions import net +from volatility3.framework.interfaces.configuration import VersionableInterface + + +class NetSymbols(VersionableInterface): + _version = (1, 0, 0) + + @classmethod + def apply(cls, symbol_table: intermed.IntermediateSymbolTable): + # Network + symbol_table.set_type_class("net", net.net) + symbol_table.set_type_class("net_device", net.net_device) + symbol_table.set_type_class("in_device", net.in_device) + symbol_table.set_type_class("in_ifaddr", net.in_ifaddr) + symbol_table.set_type_class("inet6_dev", net.inet6_dev) + symbol_table.set_type_class("inet6_ifaddr", net.inet6_ifaddr) + symbol_table.set_type_class("socket", net.socket) + symbol_table.set_type_class("sock", net.sock) + symbol_table.set_type_class("inet_sock", net.inet_sock) + symbol_table.set_type_class("unix_sock", net.unix_sock) + # Might not exist in older kernels or the current symbols + symbol_table.optional_set_type_class("netlink_sock", net.netlink_sock) + symbol_table.optional_set_type_class("vsock_sock", net.vsock_sock) + symbol_table.optional_set_type_class("packet_sock", net.packet_sock) + symbol_table.optional_set_type_class("bt_sock", net.bt_sock) + symbol_table.optional_set_type_class("xdp_sock", net.xdp_sock) From 2fa0ce8e5ca4d205e15571adb27479a6710c20c2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 19 Feb 2025 23:51:06 +0000 Subject: [PATCH 0611/1352] Bump required version numbers --- volatility3/framework/constants/_version.py | 2 +- volatility3/framework/plugins/linux/ip.py | 4 ++-- volatility3/framework/plugins/linux/netfilter.py | 4 ++-- volatility3/framework/plugins/linux/sockstat.py | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 0393a9669..255b8fc3d 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 21 # Number of changes that only add to the interface +VERSION_MINOR = 22 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 36efa0609..0e3f7ff0e 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -12,9 +12,9 @@ from volatility3.framework.symbols.linux import net class Addr(plugins.PluginInterface): """Lists network interface information for all devices""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 22, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index 5e1bf283f..35517157a 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -703,9 +703,9 @@ class NetfilterNetDevImp_4_14_to_latest(AbstractNetfilterNetDev): class Netfilter(interfaces.plugins.PluginInterface): """Lists Netfilter hooks.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 22, 0) - _version = (1, 1, 0) + _version = (1, 1, 1) _required_linux_utilities_modules_version = (1, 0, 0) _required_linuxutils_version = (2, 1, 0) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index ad74a6ee7..489d2b839 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -22,7 +22,7 @@ vollog = logging.getLogger(__name__) class SockHandlers(interfaces.configuration.VersionableInterface): """Handles several socket families extracting the sockets information.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 22, 0) _version = (4, 0, 0) _net_version_required = (1, 0, 0) From eb21f89cf34323ce324b6df64ce0b00e6825a0b8 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 19 Feb 2025 23:54:15 +0000 Subject: [PATCH 0612/1352] Linux: Fix ruff errors --- volatility3/framework/plugins/linux/netfilter.py | 12 +++++++----- volatility3/framework/plugins/linux/sockstat.py | 4 ++-- .../framework/symbols/linux/extensions/net.py | 2 +- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index 35517157a..839843341 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -204,9 +204,11 @@ class AbstractNetfilter(ABC): module_name [str]: Linux kernel module name hooked [bool]: "True" if the network stack has been hijacked """ - for netns, net in self.get_net_namespaces(): + for netns, network in self.get_net_namespaces(): for proto_idx, proto_name, hook_idx, hook_name in self._proto_hook_loop(): - hooks_container = self.get_hooks_container(net, proto_name, hook_name) + hooks_container = self.get_hooks_container( + network, proto_name, hook_name + ) for hook_container in hooks_container: for hook_ops in self.get_hook_ops( @@ -311,9 +313,9 @@ class AbstractNetfilter(ABC): """ nethead = self.vmlinux.object_from_symbol("net_namespace_list") symbol_net_name = self.get_symbol_fullname("net") - for net in nethead.to_list(symbol_net_name, "list"): - net_ns_id = net.ns.inum - yield net_ns_id, net + for network in nethead.to_list(symbol_net_name, "list"): + net_ns_id = network.ns.inum + yield net_ns_id, network def get_hooks_container(self, net, proto_name, hook_name): """Returns the data structure used in a specific kernel implementation to store diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 489d2b839..771e43412 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -73,14 +73,14 @@ class SockHandlers(interfaces.configuration.VersionableInterface): netdevices_map = {} nethead = self._vmlinux.object_from_symbol(symbol_name="net_namespace_list") net_symname = self._vmlinux.symbol_table_name + constants.BANG + "net" - for net in nethead.to_list(net_symname, "list"): + for network in nethead.to_list(net_symname, "list"): net_device_symname = ( self._vmlinux.symbol_table_name + constants.BANG + "net_device" ) for net_dev in net.dev_base_head.to_list(net_device_symname, "dev_list"): if ( isinstance(netns_id, NotAvailableValue) - or net.get_inode() != netns_id + or network.get_inode() != netns_id ): continue dev_name = utility.array_to_string(net_dev.name) diff --git a/volatility3/framework/symbols/linux/extensions/net.py b/volatility3/framework/symbols/linux/extensions/net.py index a5836062e..da8ad3713 100644 --- a/volatility3/framework/symbols/linux/extensions/net.py +++ b/volatility3/framework/symbols/linux/extensions/net.py @@ -1,5 +1,5 @@ import logging -from typing import Dict, List +from typing import Dict, List, Optional from volatility3.framework import objects, exceptions, renderers, interfaces, constants from volatility3.framework.objects import utility From bfd210236f5c2c3bcbc42194427c56a63ca608bf Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 00:00:53 +0000 Subject: [PATCH 0613/1352] Linux: Fix up too-net typing syntax --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- volatility3/framework/symbols/linux/extensions/net.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 901a82e69..67f6595b1 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -2404,7 +2404,7 @@ class inode(objects.StructType): def _time_member_to_datetime( self, member - ) -> datetime.datetime | interfaces.renderers.BaseAbsentValue: + ) -> Union[datetime.datetime, interfaces.renderers.BaseAbsentValue]: if self.has_member(f"{member}_sec") and self.has_member(f"{member}_nsec"): # kernels >= 6.11 it's i_*_sec -> time64_t and i_*_nsec -> u32 # Ref Linux commit 3aa63a569c64e708df547a8913c84e64a06e7853 diff --git a/volatility3/framework/symbols/linux/extensions/net.py b/volatility3/framework/symbols/linux/extensions/net.py index da8ad3713..ea9d9b100 100644 --- a/volatility3/framework/symbols/linux/extensions/net.py +++ b/volatility3/framework/symbols/linux/extensions/net.py @@ -1,5 +1,5 @@ import logging -from typing import Dict, List, Optional +from typing import Dict, List, Optional, Union from volatility3.framework import objects, exceptions, renderers, interfaces, constants from volatility3.framework.objects import utility @@ -214,7 +214,7 @@ class net_device(objects.StructType): return net_ns_id - def get_operational_state(self) -> str | interfaces.renderers.BaseAbsentValue: + def get_operational_state(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: """Return the netwok device oprational state (RFC 2863) string Returns: From 1458b7dfc7f4bf29612e2361b1a1a3982dff8413 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 00:17:48 +0000 Subject: [PATCH 0614/1352] Linux: Add vast quantities of missing type information --- .../framework/symbols/linux/extensions/net.py | 103 ++++++++++-------- 1 file changed, 58 insertions(+), 45 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/net.py b/volatility3/framework/symbols/linux/extensions/net.py index ea9d9b100..36db827b0 100644 --- a/volatility3/framework/symbols/linux/extensions/net.py +++ b/volatility3/framework/symbols/linux/extensions/net.py @@ -1,5 +1,5 @@ import logging -from typing import Dict, List, Optional, Union +from typing import Dict, Generator, List, Optional, Union from volatility3.framework import objects, exceptions, renderers, interfaces, constants from volatility3.framework.objects import utility @@ -14,7 +14,7 @@ vollog = logging.getLogger(__name__) class net(objects.StructType): - def get_inode(self): + def get_inode(self) -> int: """Get the namespace id for this network namespace. Raises: @@ -44,7 +44,7 @@ class net_device(objects.StructType): """ return utility.array_to_string(self.name) - def _format_as_mac_address(self, hwaddr): + def _format_as_mac_address(self, hwaddr) -> str: return ":".join([f"{x:02x}" for x in hwaddr[: self.addr_len]]) def get_mac_address(self) -> Optional[str]: @@ -71,7 +71,7 @@ class net_device(objects.StructType): return self._format_as_mac_address(hwaddr) - def _get_flag_choices(self) -> Dict: + def _get_flag_choices(self) -> Dict[str, int]: """Return the net_device flags as a list of strings""" vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) try: @@ -84,7 +84,9 @@ class net_device(objects.StructType): return choices - def _get_net_device_flag_value(self, name): + def _get_net_device_flag_value( + self, name + ) -> Union[int, interfaces.renderers.BaseAbsentValue]: """Return the net_device flag value based on the flag name""" return self._get_flag_choices().get(name, renderers.UnparsableValue()) @@ -189,7 +191,7 @@ class net_device(objects.StructType): return sorted(net_device_flags) @property - def promisc(self): + def promisc(self) -> bool: """Return if this network interface is in promiscuous mode. Returns: @@ -244,7 +246,9 @@ class net_device(objects.StructType): class in_device(objects.StructType): - def get_addresses(self): + def get_addresses( + self, + ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Yield the IPv4 ifaddr addresses Yields: @@ -257,7 +261,7 @@ class in_device(objects.StructType): class inet6_dev(objects.StructType): - def get_addresses(self): + def get_addresses(self) -> Generator[interfaces.objects.ObjectInterface]: """Yield the IPv6 ifaddr addresses Yields: @@ -298,7 +302,7 @@ class in_ifaddr(objects.StructType): "RT_SCOPE_SITE": "site", } - def get_scope_type(self): + def get_scope_type(self) -> str: """Get the scope type for this IPv4 address Returns: @@ -315,7 +319,7 @@ class in_ifaddr(objects.StructType): return self._rtnl_rtscope_tab.get(rt_scope, "unknown") - def get_address(self): + def get_address(self) -> str: """Get an string with the IPv4 address Returns: @@ -323,7 +327,7 @@ class in_ifaddr(objects.StructType): """ return conversion.convert_ipv4(self.ifa_address) - def get_prefix_len(self): + def get_prefix_len(self) -> int: """Get the IPv4 address prefix len Returns: @@ -333,7 +337,7 @@ class in_ifaddr(objects.StructType): class inet6_ifaddr(objects.StructType): - def get_scope_type(self): + def get_scope_type(self) -> str: """Get the scope type for this IPv6 address Returns: @@ -348,7 +352,7 @@ class inet6_ifaddr(objects.StructType): else: return "global" - def get_address(self): + def get_address(self) -> str: """Get an string with the IPv6 address Returns: @@ -356,7 +360,7 @@ class inet6_ifaddr(objects.StructType): """ return conversion.convert_ipv6(self.addr.in6_u.u6_addr32) - def get_prefix_len(self): + def get_prefix_len(self) -> int: """Get the IPv6 address prefix len Returns: @@ -366,7 +370,7 @@ class inet6_ifaddr(objects.StructType): class socket(objects.StructType): - def _get_vol_kernel(self): + def _get_vol_kernel(self) -> interfaces.context.ModuleInterface: symbol_table_arr = self.vol.type_name.split("!", 1) symbol_table = symbol_table_arr[0] if len(symbol_table_arr) == 2 else None @@ -382,7 +386,7 @@ class socket(objects.StructType): kernel = self._context.modules[kernel_module_name] return kernel - def get_inode(self): + def get_inode(self) -> int: try: kernel = self._get_vol_kernel() except ValueError: @@ -396,30 +400,32 @@ class socket(objects.StructType): return vfs_inode.i_ino - def get_state(self): + def get_state(self) -> str: socket_state_idx = self.state if 0 <= socket_state_idx < len(linux_constants.SOCKET_STATES): return linux_constants.SOCKET_STATES[socket_state_idx] + return "Unknown socket state" class sock(objects.StructType): - def get_family(self): + def get_family(self) -> str: family_idx = self.__sk_common.skc_family if 0 <= family_idx < len(linux_constants.SOCK_FAMILY): return linux_constants.SOCK_FAMILY[family_idx] + return "Unknown socket family" - def get_type(self): + def get_type(self) -> str: return linux_constants.SOCK_TYPES.get(self.sk_type, "") - def get_inode(self): + def get_inode(self) -> int: if not self.sk_socket: return 0 return self.sk_socket.get_inode() - def get_protocol(self): + def get_protocol(self) -> Optional[str]: return None - def get_state(self): + def get_state(self) -> str: # Return the generic socket state if self.has_member("sk"): return self.sk.sk_socket.get_state() @@ -427,17 +433,17 @@ class sock(objects.StructType): class unix_sock(objects.StructType): - def get_name(self): + def get_name(self) -> Optional[str]: if not self.addr: return None sockaddr_un = self.addr.name.cast("sockaddr_un") saddr = str(utility.array_to_string(sockaddr_un.sun_path)) return saddr - def get_protocol(self): + def get_protocol(self) -> Optional[str]: return None - def get_state(self): + def get_state(self) -> str: """Return a string representing the sock state.""" # Unix socket states reuse (a subset) of the inet_sock states contants @@ -445,21 +451,23 @@ class unix_sock(objects.StructType): state_idx = self.sk.__sk_common.skc_state if 0 <= state_idx < len(linux_constants.TCP_STATES): return linux_constants.TCP_STATES[state_idx] - else: - # Return the generic socket state - return self.sk.sk_socket.get_state() + else: + return "Unknown unix_sock stream state" + # Return the generic socket state + return self.sk.sk_socket.get_state() - def get_inode(self): + def get_inode(self) -> int: return self.sk.get_inode() class inet_sock(objects.StructType): - def get_family(self): + def get_family(self) -> str: family_idx = self.sk.__sk_common.skc_family if 0 <= family_idx < len(linux_constants.SOCK_FAMILY): return linux_constants.SOCK_FAMILY[family_idx] + return "Unknown inet_sock family" - def get_protocol(self): + def get_protocol(self) -> Optional[str]: # If INET6 family and a proto is defined, we use that specific IPv6 protocol. # Otherwise, we use the standard IP protocol. protocol = linux_constants.IP_PROTOCOLS.get(self.sk.sk_protocol) @@ -467,23 +475,25 @@ class inet_sock(objects.StructType): protocol = linux_constants.IPV6_PROTOCOLS.get(self.sk.sk_protocol, protocol) return protocol - def get_state(self): + def get_state(self) -> str: """Return a string representing the sock state.""" if self.sk.get_type() == "STREAM": state_idx = self.sk.__sk_common.skc_state if 0 <= state_idx < len(linux_constants.TCP_STATES): return linux_constants.TCP_STATES[state_idx] - else: - # Return the generic socket state - return self.sk.sk_socket.get_state() + else: + return "Unknown inet_sock stream state" + # Return the generic socket state + return self.sk.sk_socket.get_state() - def get_src_port(self): + def get_src_port(self) -> Optional[int]: sport_le = getattr(self, "sport", getattr(self, "inet_sport", None)) if sport_le is not None: return socket_module.htons(sport_le) + return None - def get_dst_port(self): + def get_dst_port(self) -> Optional[int]: sk_common = self.sk.__sk_common if hasattr(sk_common, "skc_portpair"): dport_le = sk_common.skc_portpair & 0xFFFF @@ -497,7 +507,7 @@ class inet_sock(objects.StructType): return None return socket_module.htons(dport_le) - def get_src_addr(self): + def get_src_addr(self) -> Optional[str]: sk_common = self.sk.__sk_common family = sk_common.skc_family if family == socket_module.AF_INET: @@ -523,7 +533,7 @@ class inet_sock(objects.StructType): return None return socket_module.inet_ntop(family, addr_bytes) - def get_dst_addr(self): + def get_dst_addr(self) -> Optional[str]: sk_common = self.sk.__sk_common family = sk_common.skc_family if family == socket_module.AF_INET: @@ -554,16 +564,17 @@ class inet_sock(objects.StructType): class netlink_sock(objects.StructType): - def get_protocol(self): + def get_protocol(self) -> str: protocol_idx = self.sk.sk_protocol if 0 <= protocol_idx < len(linux_constants.NETLINK_PROTOCOLS): return linux_constants.NETLINK_PROTOCOLS[protocol_idx] + return "Unknown netlink_sock protocol" def get_state(self): # Return the generic socket state return self.sk.sk_socket.get_state() - def get_portid(self): + def get_portid(self) -> int: if self.has_member("pid"): # kernel < 3.7.10 return self.pid @@ -573,7 +584,7 @@ class netlink_sock(objects.StructType): else: raise AttributeError("Unable to find a source port id") - def get_dst_portid(self): + def get_dst_portid(self) -> int: if self.has_member("dst_pid"): # kernel < 3.7.10 return self.dst_pid @@ -595,7 +606,7 @@ class vsock_sock(objects.StructType): class packet_sock(objects.StructType): - def get_protocol(self): + def get_protocol(self) -> Optional[str]: eth_proto = socket_module.htons(self.num) if eth_proto == 0: return None @@ -610,15 +621,17 @@ class packet_sock(objects.StructType): class bt_sock(objects.StructType): - def get_protocol(self): + def get_protocol(self) -> Optional[str]: type_idx = self.sk.sk_protocol if 0 <= type_idx < len(linux_constants.BLUETOOTH_PROTOCOLS): return linux_constants.BLUETOOTH_PROTOCOLS[type_idx] + return None - def get_state(self): + def get_state(self) -> Optional[str]: state_idx = self.sk.__sk_common.skc_state if 0 <= state_idx < len(linux_constants.BLUETOOTH_STATES): return linux_constants.BLUETOOTH_STATES[state_idx] + return None class xdp_sock(objects.StructType): From 056d7813a7ce01e19f388bd75608f788c4115231 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 00:25:31 +0000 Subject: [PATCH 0615/1352] Linux: fix up typing typo --- volatility3/framework/symbols/linux/extensions/net.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/net.py b/volatility3/framework/symbols/linux/extensions/net.py index 36db827b0..ed739894d 100644 --- a/volatility3/framework/symbols/linux/extensions/net.py +++ b/volatility3/framework/symbols/linux/extensions/net.py @@ -261,7 +261,9 @@ class in_device(objects.StructType): class inet6_dev(objects.StructType): - def get_addresses(self) -> Generator[interfaces.objects.ObjectInterface]: + def get_addresses( + self, + ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Yield the IPv6 ifaddr addresses Yields: From 815d695aaba37e3f7a47fe55d7782431d78b9e4b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 00:30:48 +0000 Subject: [PATCH 0616/1352] Linux: Leave the existing symbol table the same --- .../framework/symbols/linux/__init__.py | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 8162689db..ae8c8de31 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -64,14 +64,16 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): # kernels < 4.18. Reuses timespec64 obj extension, since both has the same members self.optional_set_type_class("timespec", extensions.timespec64) + # Mount + self.set_type_class("vfsmount", extensions.vfsmount) + # Might not exist in older kernels or the current symbols + self.optional_set_type_class("mount", extensions.mount) + self.optional_set_type_class("mnt_namespace", extensions.mnt_namespace) + self.optional_set_type_class("rb_root", extensions.rb_root) + # Network # FIXME: Deprecate all of this once the framework hits version 3 self.set_type_class("net", extensions.net.net) - self.set_type_class("net_device", extensions.net.net_device) - self.set_type_class("in_device", extensions.net.in_device) - self.set_type_class("in_ifaddr", extensions.net.in_ifaddr) - self.set_type_class("inet6_dev", extensions.net.inet6_dev) - self.set_type_class("inet6_ifaddr", extensions.net.inet6_ifaddr) self.set_type_class("socket", extensions.net.socket) self.set_type_class("sock", extensions.net.sock) self.set_type_class("inet_sock", extensions.net.inet_sock) @@ -83,13 +85,6 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.optional_set_type_class("bt_sock", extensions.net.bt_sock) self.optional_set_type_class("xdp_sock", extensions.net.xdp_sock) - # Mount - self.set_type_class("vfsmount", extensions.vfsmount) - # Might not exist in older kernels or the current symbols - self.optional_set_type_class("mount", extensions.mount) - self.optional_set_type_class("mnt_namespace", extensions.mnt_namespace) - self.optional_set_type_class("rb_root", extensions.rb_root) - # Only found in 6.1+ kernels self.optional_set_type_class("maple_tree", extensions.maple_tree) From 2ff7dea5125b16dedcaf9ac63752850f35d0fd58 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 01:07:10 +0000 Subject: [PATCH 0617/1352] Linux: Remember to apply the symbols to addr as well as link --- volatility3/framework/plugins/linux/ip.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 0e3f7ff0e..460774daf 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -7,6 +7,7 @@ from volatility3.framework import interfaces, renderers, constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.symbols.linux import net +from volatility3.framework.symbols.linux.extensions import net as net_extensions class Addr(plugins.PluginInterface): @@ -29,7 +30,7 @@ class Addr(plugins.PluginInterface): ), ] - def _gather_net_dev_info(self, net_dev): + def _gather_net_dev_info(self, net_dev: net_extensions.net_device): mac_addr = net_dev.get_mac_address() promisc = net_dev.promisc operational_state = net_dev.get_operational_state() @@ -61,6 +62,7 @@ class Addr(plugins.PluginInterface): net_type_symname = vmlinux.symbol_table_name + constants.BANG + "net" net_device_symname = vmlinux.symbol_table_name + constants.BANG + "net_device" + net.NetSymbols.apply(self.context.symbol_space[vmlinux.symbol_table_name]) # 'net_namespace_list' exists from kernels >= 2.6.24 net_namespace_list = vmlinux.object_from_symbol("net_namespace_list") From 17ea6e9fd0d54d534344c7e8c9e1e938b861132a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 09:20:57 +0000 Subject: [PATCH 0618/1352] Linux: Fix altered SockHandlers signature --- volatility3/framework/plugins/linux/sockstat.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 771e43412..d11d2ce66 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -556,7 +556,7 @@ class Sockstat(plugins.PluginInterface): try: sock_type = sock.get_type() family = sock.get_family() - sock_handler = SockHandlers(vmlinux, task) + sock_handler = SockHandlers(context, vmlinux.name, task) sock_fields = sock_handler.process_sock(sock) except exceptions.InvalidAddressException: continue From 70a9171fd4ffdf55cd96b9721484b9443a81665a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 09:24:38 +0000 Subject: [PATCH 0619/1352] Windows: Remove pid filtering option from threads --- volatility3/framework/plugins/windows/threads.py | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 84daa8595..f620eebef 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -31,12 +31,6 @@ class Threads(thrdscan.ThrdScan): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.ListRequirement( - name="pid", - description="Filter on specific process IDs", - element_type=int, - optional=True, - ), requirements.PluginRequirement( name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) ), @@ -74,12 +68,10 @@ class Threads(thrdscan.ThrdScan): layer_name = module.layer_name symbol_table_name = module.symbol_table_name - filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None)) - for proc in pslist.PsList.list_processes( context=context, layer_name=layer_name, symbol_table=symbol_table_name, - filter_func=filter_func, + filter_func=None, ): yield from cls.list_threads(module, proc) From 6c019776ac6d23d9ad9a1ba7128e76721f649637 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 09:39:45 +0000 Subject: [PATCH 0620/1352] Windows: Remove non-functional threads filtering Filtering can be carried out through --filter commands on the CLI --- volatility3/framework/plugins/windows/debugregisters.py | 5 ++++- volatility3/framework/plugins/windows/threads.py | 7 ++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 57dd1822c..d4375685a 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -24,7 +24,7 @@ vollog = logging.getLogger(__name__) class DebugRegisters(interfaces.plugins.PluginInterface): # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List: @@ -37,6 +37,9 @@ class DebugRegisters(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="threads", component=threads.Threads, version=(1, 0, 0) + ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(1, 0, 0) ), diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index f620eebef..f962a3fed 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -59,9 +59,7 @@ class Threads(thrdscan.ThrdScan): @classmethod def list_process_threads( - cls, - context: interfaces.context.ContextInterface, - module_name: str, + cls, context: interfaces.context.ContextInterface, module_name: str ) -> Iterable[interfaces.objects.ObjectInterface]: """Runs through all processes and lists threads for each process""" module = context.modules[module_name] @@ -72,6 +70,5 @@ class Threads(thrdscan.ThrdScan): context=context, layer_name=layer_name, symbol_table=symbol_table_name, - filter_func=None, ): yield from cls.list_threads(module, proc) From ce490298bfbe6438eb4878c96b0747cfb98a03b0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 20 Feb 2025 09:51:43 +0000 Subject: [PATCH 0621/1352] Linux: Fix up typo unchanged net instance in sockscan --- volatility3/framework/plugins/linux/sockstat.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index d11d2ce66..4f5cc7521 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -77,7 +77,9 @@ class SockHandlers(interfaces.configuration.VersionableInterface): net_device_symname = ( self._vmlinux.symbol_table_name + constants.BANG + "net_device" ) - for net_dev in net.dev_base_head.to_list(net_device_symname, "dev_list"): + for net_dev in network.dev_base_head.to_list( + net_device_symname, "dev_list" + ): if ( isinstance(netns_id, NotAvailableValue) or network.get_inode() != netns_id From 944c841278a287decb1940983d62686970620326 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 23 Feb 2025 15:44:38 +0000 Subject: [PATCH 0622/1352] Linux: Rename net extensions to allow for net variable name --- volatility3/framework/plugins/linux/ip.py | 10 +++---- .../framework/plugins/linux/netfilter.py | 20 +++++++------- .../framework/plugins/linux/sockstat.py | 6 ++--- .../framework/symbols/linux/__init__.py | 20 +++++++------- .../linux/extensions/{net.py => network.py} | 0 volatility3/framework/symbols/linux/net.py | 27 ------------------- .../framework/symbols/linux/network.py | 27 +++++++++++++++++++ 7 files changed, 54 insertions(+), 56 deletions(-) rename volatility3/framework/symbols/linux/extensions/{net.py => network.py} (100%) delete mode 100644 volatility3/framework/symbols/linux/net.py create mode 100644 volatility3/framework/symbols/linux/network.py diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 460774daf..3a189d91b 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -6,8 +6,8 @@ from typing import List from volatility3.framework import interfaces, renderers, constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins -from volatility3.framework.symbols.linux import net -from volatility3.framework.symbols.linux.extensions import net as net_extensions +from volatility3.framework.symbols.linux import network +from volatility3.framework.symbols.linux.extensions import network as net_extensions class Addr(plugins.PluginInterface): @@ -26,7 +26,7 @@ class Addr(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="Net", component=net.NetSymbols, version=(1, 0, 0) + name="Net", component=network.NetSymbols, version=(1, 0, 0) ), ] @@ -62,7 +62,7 @@ class Addr(plugins.PluginInterface): net_type_symname = vmlinux.symbol_table_name + constants.BANG + "net" net_device_symname = vmlinux.symbol_table_name + constants.BANG + "net_device" - net.NetSymbols.apply(self.context.symbol_space[vmlinux.symbol_table_name]) + network.NetSymbols.apply(self.context.symbol_space[vmlinux.symbol_table_name]) # 'net_namespace_list' exists from kernels >= 2.6.24 net_namespace_list = vmlinux.object_from_symbol("net_namespace_list") @@ -102,7 +102,7 @@ class Link(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="Net", component=net.NetSymbols, version=(1, 0, 0) + name="Net", component=network.NetSymbols, version=(1, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index 839843341..c12c99d1e 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -17,7 +17,7 @@ from volatility3.framework import ( from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.symbols import linux -from volatility3.framework.symbols.linux import net +from volatility3.framework.symbols.linux import network from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -101,7 +101,7 @@ class AbstractNetfilter(ABC): ) linux_net_required_version = Netfilter._required_linuxnet_version - linux_net_current_version = net.NetSymbols.version + linux_net_current_version = network.NetSymbols.version if not requirements.VersionRequirement.matches_required( linux_net_required_version, linux_net_current_version ): @@ -124,7 +124,7 @@ class AbstractNetfilter(ABC): ) symbol_table = self._context.symbol_space[self.vmlinux.symbol_table_name] - net.NetSymbols.apply(symbol_table) + network.NetSymbols.apply(symbol_table) modules = lsmod.Lsmod.list_modules(context, kernel_module_name) self.handlers = linux.LinuxUtilities.generate_kernel_handler_info( @@ -204,11 +204,9 @@ class AbstractNetfilter(ABC): module_name [str]: Linux kernel module name hooked [bool]: "True" if the network stack has been hijacked """ - for netns, network in self.get_net_namespaces(): + for netns, net in self.get_net_namespaces(): for proto_idx, proto_name, hook_idx, hook_name in self._proto_hook_loop(): - hooks_container = self.get_hooks_container( - network, proto_name, hook_name - ) + hooks_container = self.get_hooks_container(net, proto_name, hook_name) for hook_container in hooks_container: for hook_ops in self.get_hook_ops( @@ -313,9 +311,9 @@ class AbstractNetfilter(ABC): """ nethead = self.vmlinux.object_from_symbol("net_namespace_list") symbol_net_name = self.get_symbol_fullname("net") - for network in nethead.to_list(symbol_net_name, "list"): - net_ns_id = network.ns.inum - yield net_ns_id, network + for net in nethead.to_list(symbol_net_name, "list"): + net_ns_id = net.ns.inum + yield net_ns_id, net def get_hooks_container(self, net, proto_name, hook_name): """Returns the data structure used in a specific kernel implementation to store @@ -737,7 +735,7 @@ class Netfilter(interfaces.plugins.PluginInterface): ), requirements.VersionRequirement( name="linuxnet", - component=net.NetSymbols, + component=network.NetSymbols, version=cls._required_linuxnet_version, ), ] diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 4f5cc7521..2c0c566e4 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -13,7 +13,7 @@ from volatility3.framework.objects import utility from volatility3.framework.symbols import linux from volatility3.plugins.linux import lsof from volatility3.plugins.linux import pslist -from volatility3.framework.symbols.linux import net +from volatility3.framework.symbols.linux import network vollog = logging.getLogger(__name__) @@ -475,7 +475,7 @@ class Sockstat(plugins.PluginInterface): name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), requirements.VersionRequirement( - name="linux_net", component=net.NetSymbols, version=(1, 0, 0) + name="linux_net", component=network.NetSymbols, version=(1, 0, 0) ), requirements.BooleanRequirement( name="unix", @@ -618,7 +618,7 @@ class Sockstat(plugins.PluginInterface): """ vmlinux = self.context.modules[kernel_module_name] symbol_table = self.context.symbol_space[vmlinux.symbol_table_name] - net.NetSymbols.apply(symbol_table) + network.NetSymbols.apply(symbol_table) filter_func = pslist.PsList.create_pid_filter(pids) socket_generator = self.list_sockets( diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index ae8c8de31..5f6a66860 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -73,17 +73,17 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): # Network # FIXME: Deprecate all of this once the framework hits version 3 - self.set_type_class("net", extensions.net.net) - self.set_type_class("socket", extensions.net.socket) - self.set_type_class("sock", extensions.net.sock) - self.set_type_class("inet_sock", extensions.net.inet_sock) - self.set_type_class("unix_sock", extensions.net.unix_sock) + self.set_type_class("net", extensions.network.net) + self.set_type_class("socket", extensions.network.socket) + self.set_type_class("sock", extensions.network.sock) + self.set_type_class("inet_sock", extensions.network.inet_sock) + self.set_type_class("unix_sock", extensions.network.unix_sock) # Might not exist in older kernels or the current symbols - self.optional_set_type_class("netlink_sock", extensions.net.netlink_sock) - self.optional_set_type_class("vsock_sock", extensions.net.vsock_sock) - self.optional_set_type_class("packet_sock", extensions.net.packet_sock) - self.optional_set_type_class("bt_sock", extensions.net.bt_sock) - self.optional_set_type_class("xdp_sock", extensions.net.xdp_sock) + self.optional_set_type_class("netlink_sock", extensions.network.netlink_sock) + self.optional_set_type_class("vsock_sock", extensions.network.vsock_sock) + self.optional_set_type_class("packet_sock", extensions.network.packet_sock) + self.optional_set_type_class("bt_sock", extensions.network.bt_sock) + self.optional_set_type_class("xdp_sock", extensions.network.xdp_sock) # Only found in 6.1+ kernels self.optional_set_type_class("maple_tree", extensions.maple_tree) diff --git a/volatility3/framework/symbols/linux/extensions/net.py b/volatility3/framework/symbols/linux/extensions/network.py similarity index 100% rename from volatility3/framework/symbols/linux/extensions/net.py rename to volatility3/framework/symbols/linux/extensions/network.py diff --git a/volatility3/framework/symbols/linux/net.py b/volatility3/framework/symbols/linux/net.py deleted file mode 100644 index 44c70460c..000000000 --- a/volatility3/framework/symbols/linux/net.py +++ /dev/null @@ -1,27 +0,0 @@ -from volatility3.framework.symbols import intermed -from volatility3.framework.symbols.linux.extensions import net -from volatility3.framework.interfaces.configuration import VersionableInterface - - -class NetSymbols(VersionableInterface): - _version = (1, 0, 0) - - @classmethod - def apply(cls, symbol_table: intermed.IntermediateSymbolTable): - # Network - symbol_table.set_type_class("net", net.net) - symbol_table.set_type_class("net_device", net.net_device) - symbol_table.set_type_class("in_device", net.in_device) - symbol_table.set_type_class("in_ifaddr", net.in_ifaddr) - symbol_table.set_type_class("inet6_dev", net.inet6_dev) - symbol_table.set_type_class("inet6_ifaddr", net.inet6_ifaddr) - symbol_table.set_type_class("socket", net.socket) - symbol_table.set_type_class("sock", net.sock) - symbol_table.set_type_class("inet_sock", net.inet_sock) - symbol_table.set_type_class("unix_sock", net.unix_sock) - # Might not exist in older kernels or the current symbols - symbol_table.optional_set_type_class("netlink_sock", net.netlink_sock) - symbol_table.optional_set_type_class("vsock_sock", net.vsock_sock) - symbol_table.optional_set_type_class("packet_sock", net.packet_sock) - symbol_table.optional_set_type_class("bt_sock", net.bt_sock) - symbol_table.optional_set_type_class("xdp_sock", net.xdp_sock) diff --git a/volatility3/framework/symbols/linux/network.py b/volatility3/framework/symbols/linux/network.py new file mode 100644 index 000000000..c88e6fc69 --- /dev/null +++ b/volatility3/framework/symbols/linux/network.py @@ -0,0 +1,27 @@ +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.linux.extensions import network +from volatility3.framework.interfaces.configuration import VersionableInterface + + +class NetSymbols(VersionableInterface): + _version = (1, 0, 0) + + @classmethod + def apply(cls, symbol_table: intermed.IntermediateSymbolTable): + # Network + symbol_table.set_type_class("net", network.net) + symbol_table.set_type_class("net_device", network.net_device) + symbol_table.set_type_class("in_device", network.in_device) + symbol_table.set_type_class("in_ifaddr", network.in_ifaddr) + symbol_table.set_type_class("inet6_dev", network.inet6_dev) + symbol_table.set_type_class("inet6_ifaddr", network.inet6_ifaddr) + symbol_table.set_type_class("socket", network.socket) + symbol_table.set_type_class("sock", network.sock) + symbol_table.set_type_class("inet_sock", network.inet_sock) + symbol_table.set_type_class("unix_sock", network.unix_sock) + # Might not exist in older kernels or the current symbols + symbol_table.optional_set_type_class("netlink_sock", network.netlink_sock) + symbol_table.optional_set_type_class("vsock_sock", network.vsock_sock) + symbol_table.optional_set_type_class("packet_sock", network.packet_sock) + symbol_table.optional_set_type_class("bt_sock", network.bt_sock) + symbol_table.optional_set_type_class("xdp_sock", network.xdp_sock) From 6d254fa961721ec15600304e2265034eb5569e30 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 23 Feb 2025 15:48:05 +0000 Subject: [PATCH 0623/1352] Linux: Correct partial renaming attempt --- volatility3/framework/plugins/linux/ip.py | 2 +- volatility3/framework/plugins/linux/sockstat.py | 10 ++++------ 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 3a189d91b..8b42ccdbf 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -132,7 +132,7 @@ class Link(plugins.PluginInterface): def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] - net.NetSymbols.apply(self.context.symbol_space[vmlinux.symbol_table_name]) + network.NetSymbols.apply(self.context.symbol_space[vmlinux.symbol_table_name]) net_type_symname = vmlinux.symbol_table_name + constants.BANG + "net" net_device_symname = vmlinux.symbol_table_name + constants.BANG + "net_device" diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index 2c0c566e4..c6487a934 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -39,7 +39,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): f"Version mismatch of volatility library NetSymbols version ({net.NetSymbols.version}) and needed version ({self._net_version_required})" ) - net.NetSymbols.apply(self._symbol_table) + network.NetSymbols.apply(self._symbol_table) try: netns_id = task.nsproxy.net_ns.get_inode() @@ -73,16 +73,14 @@ class SockHandlers(interfaces.configuration.VersionableInterface): netdevices_map = {} nethead = self._vmlinux.object_from_symbol(symbol_name="net_namespace_list") net_symname = self._vmlinux.symbol_table_name + constants.BANG + "net" - for network in nethead.to_list(net_symname, "list"): + for net in nethead.to_list(net_symname, "list"): net_device_symname = ( self._vmlinux.symbol_table_name + constants.BANG + "net_device" ) - for net_dev in network.dev_base_head.to_list( - net_device_symname, "dev_list" - ): + for net_dev in net.dev_base_head.to_list(net_device_symname, "dev_list"): if ( isinstance(netns_id, NotAvailableValue) - or network.get_inode() != netns_id + or net.get_inode() != netns_id ): continue dev_name = utility.array_to_string(net_dev.name) From 5fabd7a04bfefcb961c7aa7c9235dc081b9d7b28 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 23 Feb 2025 15:49:18 +0000 Subject: [PATCH 0624/1352] Linux: Correct partial renaming attempt - take 2 --- volatility3/framework/plugins/linux/sockstat.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index c6487a934..adbb5d6ea 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -33,10 +33,10 @@ class SockHandlers(interfaces.configuration.VersionableInterface): self._task = task if not requirements.VersionRequirement.matches_required( - net.NetSymbols.version, self._net_version_required + network.NetSymbols.version, self._net_version_required ): raise ValueError( - f"Version mismatch of volatility library NetSymbols version ({net.NetSymbols.version}) and needed version ({self._net_version_required})" + f"Version mismatch of volatility library NetSymbols version ({network.NetSymbols.version}) and needed version ({self._net_version_required})" ) network.NetSymbols.apply(self._symbol_table) From e9a6f3214cd54aba2dfe697bef6db74ea4af1fec Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 31 Jan 2025 09:58:31 +0000 Subject: [PATCH 0625/1352] Add comment for where to apply the fix --- volatility3/framework/layers/resources.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index 236d256f1..bf78f1c92 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -204,6 +204,8 @@ class ResourceAccessor: # open it in read mode only and allow breakages to happen if they wanted to write curfile = open(temp_filename, mode="rb") + # Validate the hash or delete the temp_filename and report an error + # Determine whether the file is a particular type of file, and if so, open it as such IMPORTED_MAGIC = False if HAS_MAGIC: From c269086402a0f9cc44aae11228d92ada515d0839 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 23 Feb 2025 20:31:07 +0000 Subject: [PATCH 0626/1352] Core: Improve caching to only allow one open file write at a time --- volatility3/framework/constants/__init__.py | 3 +++ volatility3/framework/layers/resources.py | 18 +++++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 2e6ae0261..429b79c3c 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -120,6 +120,9 @@ OFFLINE = False REMOTE_ISF_URL = None # 'http://localhost:8000/banners.json' """Remote URL to query for a list of ISF addresses""" +DOWNLOAD_TIMEOUT = 30 +"""Length of time (in seconds) to wait for another process to download a resource before using it""" + ### # DEPRECATED VALUES ### diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index bf78f1c92..5b2e20bfd 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import time import bz2 import contextlib import gzip @@ -198,7 +199,22 @@ class ResourceAccessor: cache_file.write(block) block = fp.read(block_size) else: - vollog.debug(f"Using already cached file at: {temp_filename}") + vollog.debug( + f"Trying to use already cached file at: {temp_filename}" + ) + count = 0 + fp.seek(0, os.SEEK_END) + expected_filesize = fp.tell() + stop = False + while count < constants.DOWNLAOD_TIMEOUT and not stop: + time.sleep(1) + if os.stat(temp_filename).st_size == expected_filesize: + stop = True + if not stop: + raise ValueError( + f"Cached file existed, but was not the correct filesize, even after {constants.DOWNLOAD_TIMEOUT} seconds" + ) + # Re-open the cache with a different mode # Since we don't want people thinking they're able to save to the cache file, # open it in read mode only and allow breakages to happen if they wanted to write From 2ff83c4434782872a25e7f152cf1283d213762c3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 23 Feb 2025 20:50:35 +0000 Subject: [PATCH 0627/1352] Core: Ensure cached files aren't saved if incomplete --- volatility3/framework/layers/resources.py | 51 +++++++++++------------ 1 file changed, 24 insertions(+), 27 deletions(-) diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index 5b2e20bfd..273f44cd7 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -178,42 +178,39 @@ class ResourceAccessor: + ".cache", ) + try: + content_length = int(fp.info().get("Content-Length", -1)) + except (AttributeError, ValueError): + # If our fp doesn't have an info member, carry on gracefully + content_length = -1 + if not os.path.exists(temp_filename): vollog.debug(f"Caching file at: {temp_filename}") + cache_file_size = -1 try: - content_length = fp.info().get("Content-Length", -1) - except AttributeError: - # If our fp doesn't have an info member, carry on gracefully - content_length = -1 - with open(temp_filename, "wb") as cache_file: - count = 0 - block = fp.read(block_size) - while block: - count += len(block) - if self._progress_callback: - self._progress_callback( - count * 100 / max(count, int(content_length)), - f"Reading file {url}", - ) - cache_file.write(block) + with open(temp_filename, "wb") as cache_file: + count = 0 block = fp.read(block_size) + while block: + count += len(block) + if self._progress_callback: + self._progress_callback( + count * 100 / max(count, int(content_length)), + f"Reading file {url}", + ) + cache_file.write(block) + block = fp.read(block_size) + cache_file.seek(0, os.SEEK_END) + cache_file_size = cache_file.tell() + finally: + if cache_file_size < content_length: + os.remove(temp_filename) + raise ValueError("Cached file did not download completely") else: vollog.debug( f"Trying to use already cached file at: {temp_filename}" ) - count = 0 - fp.seek(0, os.SEEK_END) - expected_filesize = fp.tell() - stop = False - while count < constants.DOWNLAOD_TIMEOUT and not stop: - time.sleep(1) - if os.stat(temp_filename).st_size == expected_filesize: - stop = True - if not stop: - raise ValueError( - f"Cached file existed, but was not the correct filesize, even after {constants.DOWNLOAD_TIMEOUT} seconds" - ) # Re-open the cache with a different mode # Since we don't want people thinking they're able to save to the cache file, From 48894dae0c7b9164c24e8a9094135677877711ad Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 23 Feb 2025 20:56:17 +0000 Subject: [PATCH 0628/1352] Core: Fix up ruff issue from #1631 --- volatility3/framework/layers/resources.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index 273f44cd7..6121c2cff 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -2,7 +2,6 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import time import bz2 import contextlib import gzip From 335606774d18b5423d15771d136e3880a395dd63 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 23 Feb 2025 22:30:20 +0000 Subject: [PATCH 0629/1352] Check Win10+ SlushSize member to support Windows 11 pool scanning. Restrict the Pools that current scanners accept. --- .../framework/plugins/windows/poolscanner.py | 29 ++++++++++--------- .../framework/symbols/windows/__init__.py | 2 +- 2 files changed, 16 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 5be0e7fa8..5cbb2ffc8 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -205,6 +205,7 @@ class PoolScanner(plugins.PluginInterface): b"AtmT", type_name=symbol_table + constants.BANG + "_RTL_ATOM_TABLE", size=(200, None), + # TODO - update this after the GUI code goes on page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, ), # processes on windows before windows 8 @@ -214,7 +215,7 @@ class PoolScanner(plugins.PluginInterface): object_type="Process", size=(600, None), skip_type_test=True, - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # processes on windows starting with windows 8 PoolConstraint( @@ -223,7 +224,7 @@ class PoolScanner(plugins.PluginInterface): object_type="Process", size=(600, None), skip_type_test=True, - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # threads on windows before windows8 PoolConstraint( @@ -232,7 +233,7 @@ class PoolScanner(plugins.PluginInterface): object_type="Thread", size=(600, None), # -> 0x0258 - size of struct in win5.1 skip_type_test=True, - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # threads on windows starting with windows8 PoolConstraint( @@ -240,7 +241,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_ETHREAD", object_type="Thread", size=(600, None), # -> 0x0258 - size of struct in win5.1 - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # files on windows before windows 8 PoolConstraint( @@ -248,7 +249,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_FILE_OBJECT", object_type="File", size=(150, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # files on windows starting with windows 8 PoolConstraint( @@ -256,7 +257,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_FILE_OBJECT", object_type="File", size=(150, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # mutants on windows before windows 8 PoolConstraint( @@ -264,7 +265,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_KMUTANT", object_type="Mutant", size=(64, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # mutants on windows starting with windows 8 PoolConstraint( @@ -272,7 +273,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_KMUTANT", object_type="Mutant", size=(64, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # drivers on windows before windows 8 PoolConstraint( @@ -280,7 +281,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_DRIVER_OBJECT", object_type="Driver", size=(248, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, additional_structures=["_DRIVER_EXTENSION"], ), # drivers on windows starting with windows 8 @@ -289,14 +290,14 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_DRIVER_OBJECT", object_type="Driver", size=(248, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # kernel modules PoolConstraint( b"MmLd", type_name=symbol_table + constants.BANG + "_LDR_DATA_TABLE_ENTRY", size=(76, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # symlinks on windows before windows 8 PoolConstraint( @@ -304,7 +305,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK", object_type="SymbolicLink", size=(72, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # symlinks on windows starting with windows 8 PoolConstraint( @@ -312,14 +313,14 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK", object_type="SymbolicLink", size=(72, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.NONPAGED | PoolType.FREE, ), # registry hives PoolConstraint( b"CM10", type_name=symbol_table + constants.BANG + "_CMHIVE", size=(800, None), - page_type=PoolType.PAGED | PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.PAGED | PoolType.FREE, skip_type_test=True, ), ] diff --git a/volatility3/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py index c1b7894ff..e4f8854fc 100755 --- a/volatility3/framework/symbols/windows/__init__.py +++ b/volatility3/framework/symbols/windows/__init__.py @@ -48,7 +48,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): # This doesn't exist in very specific versions of windows with contextlib.suppress(ValueError): - if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("PoolType"): + if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("PoolType") or self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("SlushSize"): self.set_type_class("_POOL_HEADER", pool.POOL_HEADER_VISTA) else: self.set_type_class("_POOL_HEADER", pool.POOL_HEADER) From ba56e42634a860aa223accd06bda9e11c6c90b78 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 23 Feb 2025 22:34:23 +0000 Subject: [PATCH 0630/1352] Fix for black --- volatility3/framework/symbols/windows/__init__.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py index e4f8854fc..f9541579e 100755 --- a/volatility3/framework/symbols/windows/__init__.py +++ b/volatility3/framework/symbols/windows/__init__.py @@ -48,7 +48,9 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): # This doesn't exist in very specific versions of windows with contextlib.suppress(ValueError): - if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("PoolType") or self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("SlushSize"): + if self.get_type("_POOL_TRACKER_BIG_PAGES").has_member( + "PoolType" + ) or self.get_type("_POOL_TRACKER_BIG_PAGES").has_member("SlushSize"): self.set_type_class("_POOL_HEADER", pool.POOL_HEADER_VISTA) else: self.set_type_class("_POOL_HEADER", pool.POOL_HEADER) From 5ee09df080f4a0035ae2c95aaf7e35320c799c64 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 25 Feb 2025 09:59:05 +0000 Subject: [PATCH 0631/1352] Symbols: Restore previous protection for non-native missing types Fixes #1480 --- volatility3/framework/symbols/intermed.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index cb0b67969..33035bc70 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -814,7 +814,12 @@ class Version8Format(Version7Format): type_definition = self._json_object["user_types"].get(type_name) if type_definition is None: # Fall back to the natives table - return self.natives.get_type(self.name + constants.BANG + type_name) + if type_name in self.natives.types: + return self.natives.get_type(self.name + constants.BANG + type_name) + else: + raise exceptions.SymbolError( + type_name, self.name, f"Unknown symbol: {type_name}" + ) members = self._process_fields(type_definition["fields"]) From 1c8f9edaf07d8784e7e5e94ed90f9a68a4b78e96 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 25 Feb 2025 10:15:23 +0000 Subject: [PATCH 0632/1352] Linux: Fix typing is lsof Fixes #1443 --- volatility3/framework/plugins/linux/lsof.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index daa8e5a3d..044e9238f 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -54,7 +54,7 @@ class FDInternal: """ task: interfaces.objects.ObjectInterface - fd_fields: Tuple[int, int, str] + fd_fields: Tuple[int, interfaces.objects.ObjectInterface, str] def to_user(self) -> FDUser: """Augment the FD information to be presented to the user From a906506736d6410776ebaf3d6f3760e3c86a1e1d Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Feb 2025 13:25:40 -0600 Subject: [PATCH 0633/1352] #1639 - cast big data to _CM_BIG_DATA --- volatility3/framework/symbols/windows/extensions/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index a8cc7703c..6d660a4b9 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -329,7 +329,7 @@ class CM_KEY_VALUE(objects.StructType): data = layer.read(self.Data.vol.offset, datalen) elif layer.hive.Version == 5 and datalen > 0x4000: # We're bigdata - big_data = layer.get_node(self.Data) + big_data = layer.get_node(self.Data).cast("_CM_BIG_DATA") # Oddly, we get a list of addresses, at which are addresses, which then point to data blocks for i in range(big_data.Count): # The value 4 should actually be unsigned-int.size, but since it's a file format that shouldn't change From 0a5c9376e27722444913f621451ce216550a39cd Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Feb 2025 16:41:40 -0600 Subject: [PATCH 0634/1352] #1476 - fix typo and missing exception --- volatility3/framework/layers/registry.py | 2 +- volatility3/framework/symbols/windows/extensions/registry.py | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 21e1a938e..abae23e2d 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -262,7 +262,7 @@ class RegistryHive(linear.LinearlyMappedLayer): self.name, hex(offset & 0x7FFFFFFF), hex(self._get_hive_maxaddr(volatile)), - "volative" if volatile else "non-volatile", + "volatile" if volatile else "non-volatile", self.get_name(), ), ) diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index a8cc7703c..c807c2cd6 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -199,7 +199,7 @@ class CM_KEY_NODE(objects.StructType): # We could change the array type to a struct with both parts try: signature = node.cast("string", max_length=2, encoding="latin-1") - except (exceptions.InvalidAddressException, RegistryFormatException): + except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex): return None listjump = None @@ -329,7 +329,7 @@ class CM_KEY_VALUE(objects.StructType): data = layer.read(self.Data.vol.offset, datalen) elif layer.hive.Version == 5 and datalen > 0x4000: # We're bigdata - big_data = layer.get_node(self.Data) + big_data = layer.get_node(self.Data).cast("_CM_BIG_DATA") # Oddly, we get a list of addresses, at which are addresses, which then point to data blocks for i in range(big_data.Count): # The value 4 should actually be unsigned-int.size, but since it's a file format that shouldn't change From 56a64150ab6850c7f4b481355dbabc43d80c10e4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 27 Feb 2025 10:27:13 +0000 Subject: [PATCH 0635/1352] Core: Update coding requirement on function calls --- CODING_STYLE.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CODING_STYLE.md b/CODING_STYLE.md index 3695301eb..2f18959c8 100644 --- a/CODING_STYLE.md +++ b/CODING_STYLE.md @@ -32,6 +32,12 @@ Exemptions from this rule: * `collections.abc` module * `typing_extensions` module +Function calls +-------------- + +For longer function calls, where line length is no longer an issue, favour using keyword arguments for clarity over unnamed positional arguments. +This helps coders learning the code from examples to know what parameters to pass in and avoids ordering mistakes. + Global Mutable State -------------------- From 89e87ff24c4fa80a9fd99e68275a5d1e3554eae4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 1 Mar 2025 12:36:40 -0600 Subject: [PATCH 0636/1352] Fix crash-causing bugs. Add typing where possible. --- volatility3/framework/plugins/linux/kmsg.py | 90 ++++++++++++++------- 1 file changed, 59 insertions(+), 31 deletions(-) diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index 849060d3c..1069a312f 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -5,7 +5,7 @@ import re import logging from abc import ABC, abstractmethod from enum import Enum -from typing import Generator, Iterator, List, Tuple, Union +from typing import Generator, Iterator, List, Tuple, Optional from volatility3.framework import ( class_subclasses, @@ -73,7 +73,7 @@ class ABCKmsg(ABC): cls, context: interfaces.context.ContextInterface, config: interfaces.configuration.HierarchicalDict, - ) -> Iterator[Tuple[str, str, str, str, str]]: + ) -> Iterator[Tuple[str, str, str, Optional[str], str]]: """It calls each subclass symtab_checks() to test the required conditions to that specific kernel implementation. @@ -108,10 +108,12 @@ class ABCKmsg(ABC): break if kmsg_inst is None: - vollog.error("Unsupported kernel ring buffer implementation") + vollog.error( + "Unsupported kernel ring buffer implementation. Please file a bug on our issue tracker with your specific kernel version." + ) @abstractmethod - def run(self) -> Iterator[Tuple[str, str, str, str, str]]: + def run(self) -> Iterator[Tuple[str, str, str, Optional[str], str]]: """Walks through the specific kernel implementation. Returns: @@ -135,7 +137,7 @@ class ABCKmsg(ABC): bool: True if the kernel being analyzed fulfill the class requirements. """ - def get_string(self, addr: int, length: int) -> Union[str, None]: + def get_string(self, addr: int, length: int) -> Optional[str]: layer = self._context.layers[self.layer_name] if not layer.is_valid(addr, length): vollog.warning("Failed to read log record at address 0x%x", addr) @@ -161,21 +163,21 @@ class ABCKmsg(ABC): # obj could be log, printk_log or printk_info return self.nsec_to_sec_str(obj.ts_nsec) - def get_caller(self, obj): + def get_caller(self, obj) -> Optional[str]: # In some kernel versions, it's only available if CONFIG_PRINTK_CALLER is defined. # caller_id is a member of printk_log struct from 5.1 to the latest 5.9 # From kernels 5.10 on, it's a member of printk_info struct if obj.has_member("caller_id"): return self.get_caller_text(obj.caller_id) - else: - return renderers.NotAvailableValue() - def get_caller_text(self, caller_id): + return None + + def get_caller_text(self, caller_id) -> str: caller_name = "CPU" if caller_id & 0x80000000 else "Task" caller = f"{caller_name}({caller_id & ~0x80000000})" return caller - def get_prefix(self, obj) -> Tuple[int, int, str, str]: + def get_prefix(self, obj) -> Tuple[int, int, str, Optional[str]]: # obj could be log, printk_log or printk_info return ( obj.facility, @@ -213,6 +215,7 @@ class Kmsg_pre_3_5(ABCKmsg): def symtab_checks(cls, vmlinux) -> bool: return ( vmlinux.has_symbol("log_end") + and vmlinux.has_symbol("log_buf_len") and not vmlinux.has_symbol("log_first_idx") and not ( vmlinux.has_type("log") @@ -220,7 +223,7 @@ class Kmsg_pre_3_5(ABCKmsg): ) ) - def run(self) -> Iterator[Tuple[str, str, str, str, str]]: + def run(self) -> Iterator[Tuple[str, str, str, Optional[str], str]]: log_buf_ptr = self.vmlinux.object_from_symbol(symbol_name="log_buf") log_buf_len = self.vmlinux.object_from_symbol(symbol_name="log_buf_len") log_buf = utility.pointer_to_string(log_buf_ptr, count=log_buf_len) @@ -249,7 +252,7 @@ class Kmsg_pre_3_5(ABCKmsg): facility = level_facility >> 3 level_txt = self.get_level_text(level) facility_txt = self.get_facility_text(facility) - caller = renderers.NotAvailableValue() + caller = None yield facility_txt, level_txt, timestamp_str, caller, line @@ -266,10 +269,10 @@ class Kmsg_3_5_to_3_11(ABCKmsg): and vmlinux.has_symbol("log_first_idx") ) - def _get_log_struct_name(self): + def _get_log_struct_name(self) -> str: return "log" - def get_text_from_log(self, msg) -> Union[str, None]: + def get_text_from_log(self, msg) -> Optional[str]: log_struct_name = self._get_log_struct_name() log_struct_size = self.vmlinux.get_type(log_struct_name).size msg_offset = msg.vol.offset + log_struct_size @@ -283,7 +286,7 @@ class Kmsg_3_5_to_3_11(ABCKmsg): def get_dict_lines(self, msg) -> Generator[str, None, None]: if msg.dict_len == 0: - return None + return log_struct_name = self._get_log_struct_name() log_struct_size = self.vmlinux.get_type(log_struct_name).size @@ -293,12 +296,12 @@ class Kmsg_3_5_to_3_11(ABCKmsg): dict_data = layer.read(dict_offset, msg.dict_len) except exceptions.InvalidAddressException: vollog.debug("Unable to read kmsg dict from 0x%x", dict_offset) - return None + return for chunk in dict_data.split(b"\x00"): - yield " " + chunk.decode() + yield " " + chunk.decode(encoding="utf8", errors="replace") - def run(self) -> Iterator[Tuple[str, str, str, str, str]]: + def run(self) -> Iterator[Tuple[str, str, str, Optional[str], str]]: # First, the ring buffer size is determined in the kernel configuration # by CONFIG_LOG_BUF_SHIFT. This static buffer is held in the '__log_buf' # global variable, with 'log_buf' serving as a pointer to it. @@ -311,7 +314,13 @@ class Kmsg_3_5_to_3_11(ABCKmsg): # remains unused. Therefore, it is crucial to read from 'log_buf' rather # than '__log_buf'. - log_buf_ptr = self.vmlinux.object_from_symbol("log_buf") + # This can happen on kernels where log_buf is declared twice + try: + log_buf_ptr = self.vmlinux.object_from_symbol("log_buf") + except exceptions.InvalidAddressException: + vollog.debug("Unable to access `log_buf`. Bailing.") + return + log_buf_len = self.vmlinux.object_from_symbol("log_buf_len") log_first_idx = int(self.vmlinux.object_from_symbol("log_first_idx")) @@ -327,7 +336,10 @@ class Kmsg_3_5_to_3_11(ABCKmsg): while cur_idx < end_idx: msg_offset = log_buf_ptr + cur_idx # type: ignore - msg = self.vmlinux.object(object_type=log_struct_name, offset=msg_offset) + msg = self.vmlinux.object( + object_type=log_struct_name, offset=msg_offset, absolute=True + ) + try: if msg.len == 0: # As per kernel/printk.c: @@ -359,9 +371,14 @@ class Kmsg_3_11_to_5_10(Kmsg_3_5_to_3_11): @classmethod def symtab_checks(cls, vmlinux) -> bool: - return vmlinux.has_type("printk_log") + return ( + not vmlinux.has_type("printk_ringbuffer") + and vmlinux.has_type("printk_log") + and vmlinux.get_type("printk_log").has_member("ts_nsec") + and vmlinux.has_symbol("log_first_idx") + ) - def _get_log_struct_name(self): + def _get_log_struct_name(self) -> str: return "printk_log" @@ -412,9 +429,9 @@ class Kmsg_5_10_to_(ABCKmsg): @classmethod def symtab_checks(cls, vmlinux) -> bool: - return vmlinux.has_symbol("prb") + return vmlinux.has_symbol("prb") and vmlinux.has_type("printk_ringbuffer") - def get_text_from_data_ring(self, text_data_ring, desc, info) -> Union[str, None]: + def get_text_from_data_ring(self, text_data_ring, desc, info) -> Optional[str]: text_data_sz = text_data_ring.size_bits text_data_mask = 1 << text_data_sz @@ -423,7 +440,7 @@ class Kmsg_5_10_to_(ABCKmsg): # This record doesn't contain text if begin & 1: - return "" + return None # This means a wrap-around to the beginning of the buffer if begin > end: @@ -454,7 +471,7 @@ class Kmsg_5_10_to_(ABCKmsg): if dict_text: yield f" DEVICE={dict_text}" - def run(self) -> Iterator[Tuple[str, str, str, str, str]]: + def run(self) -> Iterator[Tuple[str, str, str, Optional[str], str]]: # static struct printk_ringbuffer *prb = &printk_rb_static; ringbuffers = self.vmlinux.object_from_symbol("prb").dereference() @@ -516,7 +533,7 @@ class Kmsg(interfaces.plugins.PluginInterface): _required_framework_version = (2, 6, 0) - _version = (1, 0, 2) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -528,17 +545,28 @@ class Kmsg(interfaces.plugins.PluginInterface): ), ] - def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str, str]]]: - for values in ABCKmsg.run_all(context=self.context, config=self.config): - yield (0, values) + def _generator( + self, + ) -> Iterator[Tuple[int, Tuple[str, str, str, Optional[str], str]]]: + for facility, level, timestamp, caller, line in ABCKmsg.run_all( + context=self.context, config=self.config + ): + yield 0, ( + facility, + level, + timestamp, + caller or renderers.NotAvailableValue(), + line, + ) def run(self): if not self.context.symbol_space.verify_table_versions( "dwarf2json", lambda version, _: (not version) or version > (0, 4, 1) ): - raise exceptions.SymbolSpaceError( + vollog.info( "Invalid symbol table, please ensure the ISF table produced by dwarf2json was produced using a version > 0.4.1" ) + return return renderers.TreeGrid( [ From 57b086295b269d0f6bfc10b993061a5ba264e87e Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 1 Mar 2025 14:00:42 -0600 Subject: [PATCH 0637/1352] Fix bugs in Linux memory region enumeration --- .../symbols/linux/extensions/__init__.py | 42 +++++++++++++++---- 1 file changed, 33 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 67f6595b1..d5528a8b5 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -849,7 +849,7 @@ class maple_tree(objects.StructType): expected_maple_tree_depth, seen=None, current_depth=1, - ): + ) -> Optional[int]: """Recursively parse Maple Tree Nodes and yield all non empty slots""" # Create seen set if it does not exist, e.g. on the first call into this recursive function. This @@ -898,7 +898,8 @@ class maple_tree(objects.StructType): node_parent_pointer = node_parent_mte & ~(self.MAPLE_NODE_POINTER_MASK) # verify that the node_parent_pointer correctly points to the parent - assert node_parent_pointer == parent + if node_parent_pointer != parent: + return None # create a node object node = self._context.object( @@ -1008,15 +1009,21 @@ class mm_struct(objects.StructType): ) symbol_table_name = self.get_symbol_table_name() for vma_pointer in self.mm_mt.get_slot_iter(): - # Convert pointer to vm_area_struct and yield - vma_object = self._context.object( - symbol_table_name + constants.BANG + "vm_area_struct", - layer_name=self.vol.native_layer_name, - offset=vma_pointer, - ) + try: + vma_object = vma_pointer.dereference().cast( + symbol_table_name + constants.BANG + "vm_area_struct" + ) + except exceptions.InvalidAddressException: + continue + + # The slots will hold values related to their slot if they are invalid + # Before this check, this function was returning objects on the first page of memory... + if vma_object.vol.offset < 0x1000: + continue + yield vma_object - def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: + def _do_get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: """Returns an iterator for the VMAs in an mm_struct. Automatically choosing the mmap or mm_mt as required. @@ -1033,6 +1040,23 @@ class mm_struct(objects.StructType): else: raise AttributeError("Unable to find mmap or mm_mt in mm_struct") + def get_vma_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: + """Returns an iterator for the VMAs in an mm_struct. + Automatically choosing the mmap or mm_mt as required. + + Yields: + vm_area_struct objects + """ + for vma in self._do_get_vma_iter(): + try: + vma.vm_start + vma.vm_end + vma.get_protection() + + yield vma + except exceptions.InvalidAddressException: + vollog.debug(f"Skipping invalid vm_area_struct at {vma.vol.offset:#x}") + class super_block(objects.StructType): # include/linux/kdev_t.h From 8ce77e81eb2faf8c6fcb4684f5e4ca1432fbf876 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 1 Mar 2025 14:47:00 -0600 Subject: [PATCH 0638/1352] Report the memer name and type when attributes cannot be found --- volatility3/framework/interfaces/objects.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index cfbade5fc..12cd1d988 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -133,7 +133,7 @@ class ObjectInterface(metaclass=abc.ABCMeta): def __getattr__(self, attr: str) -> Any: """Method for ensuring volatility members can be returned.""" - raise AttributeError() + raise AttributeError(f"Unable to find {attr} for type {self.vol.type_name}") @property def vol(self) -> ReadOnlyMapping: From d2f16dc0f40937a7e9027f91f7360cc9abe14902 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 1 Mar 2025 15:03:18 -0600 Subject: [PATCH 0639/1352] Correctly check tty instance --- volatility3/framework/plugins/linux/tty_check.py | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index 9bbca246c..742bacb0b 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -81,9 +81,11 @@ class tty_check(plugins.PluginInterface): if tty_dev == 0: continue - name = utility.array_to_string(tty_dev.name) - - recv_buf = tty_dev.ldisc.ops.receive_buf + try: + name = utility.array_to_string(tty_dev.name) + recv_buf = tty_dev.ldisc.ops.receive_buf + except exceptions.InvalidAddressException: + continue module_name, symbol_name = ( linux_utilities_modules.Modules.lookup_module_address( From 367e0ebc0df7b173c56c7ff8a45aeee2bf88ba40 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 4 Mar 2025 16:41:12 +0100 Subject: [PATCH 0640/1352] add sample abstraction --- test/__init__.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/test/__init__.py b/test/__init__.py index e69de29bb..2b59ef5ca 100644 --- a/test/__init__.py +++ b/test/__init__.py @@ -0,0 +1,16 @@ +from enum import Enum + + +class Sample: + def __init__(self, path: str): + self.path = path + + +class WindowsSamples(Enum): + WINDOWSXP_GENERIC = Sample("./test_images/win-xp-laptop-2005-06-25.img") + """WindowsXP sample from early Volatility training.""" + + +class LinuxSamples(Enum): + LINUX_GENERIC = Sample("./test_images/linux-sample-1.bin") + """Linux Debian 3.2.0-4 sample from early Volatility training.""" From f7dfab57fdb9e943772c4db963e6607d99a97b35 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 4 Mar 2025 16:46:03 +0100 Subject: [PATCH 0641/1352] adjust helpers and add match_output_row --- test/test_volatility.py | 50 ++++++++++++++++++++++++++++++----------- 1 file changed, 37 insertions(+), 13 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 07cab2c95..9cc9c3304 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -6,25 +6,24 @@ # import os -import re import subprocess import sys -import shutil import tempfile -import hashlib -import json import contextlib +import functools +from typing import List, Tuple # # HELPER FUNCTIONS # +@functools.lru_cache def runvol(args, volatility, python): volpy = volatility python_cmd = python - cmd = [python_cmd, volpy] + args + cmd = (python_cmd, volpy) + args print(" ".join(cmd)) p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE) stdout, stderr = p.communicate() @@ -38,17 +37,18 @@ def runvol(args, volatility, python): return p.returncode, stdout, stderr -def runvol_plugin(plugin, img, volatility, python, pluginargs=None, globalargs=None): - pluginargs = pluginargs or [] - globalargs = globalargs or [] +@functools.lru_cache +def runvol_plugin( + plugin, img, volatility, python, pluginargs: Tuple = (), globalargs: Tuple = () +): args = ( globalargs - + [ + + ( "--single-location", img, "-q", plugin, - ] + ) + pluginargs ) @@ -60,17 +60,41 @@ def runvolshell(img, volshell, python, volshellargs=None, globalargs=None): globalargs = globalargs or [] args = ( globalargs - + [ + + ( "--single-location", img, "-q", - ] + ) + volshellargs ) return runvol(args, volshell, python) +def match_output_row( + json_out: List[dict], expected_row: dict, exact_match: bool = False +): + """Search each row of a plugin's JSON output for an expected row. Each row is a dict. + + Args: + json_out: The plugin's output in JSON format (typically obtained through -r json and json.loads) + expected_row: The expected row to be found in the output + exact_match: Whether to require exactly the expected row, no more no less, or to anticipate columns' addition by checking only + the expected row keys and values + """ + + if not exact_match: + for row in json_out: + if all(item in expected_row.items() for item in row.items()): + return True + else: + for row in json_out: + if expected_row == row: + return True + + return False + + # # TESTS # @@ -96,7 +120,7 @@ def basic_volshell_test(image, volatility, python, globalargs): img=image, volshell=volatility, python=python, - volshellargs=["--script", filename], + volshellargs=("--script", filename), globalargs=globalargs, ) finally: From a162fceed44372864d4e2857dae2b76112bec88f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 4 Mar 2025 16:54:11 +0100 Subject: [PATCH 0642/1352] migrate windows and linux tests to dedicated files --- test/plugins/linux/__init__.py | 0 test/plugins/linux/linux.py | 617 ++++++++++++++++++++++++ test/plugins/windows/windows.py | 326 +++++++++++++ test/test_volatility.py | 800 +------------------------------- 4 files changed, 944 insertions(+), 799 deletions(-) create mode 100644 test/plugins/linux/__init__.py create mode 100644 test/plugins/linux/linux.py create mode 100644 test/plugins/windows/windows.py diff --git a/test/plugins/linux/__init__.py b/test/plugins/linux/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py new file mode 100644 index 000000000..8ec485735 --- /dev/null +++ b/test/plugins/linux/linux.py @@ -0,0 +1,617 @@ +import contextlib +import tempfile +import os +import re +from test import test_volatility, LinuxSamples + + +class TestLinuxVolshell: + def test_linux_volshell(self, image, volatility, python): + out = test_volatility.basic_volshell_test( + image, volatility, python, globalargs=("-l",) + ) + assert out.count(b" 100 + + +class TestLinuxPslist: + def test_linux_generic_pslist(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.pslist.PsList", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) + assert out.find(b"watchdog") != -1 + assert out.count(b"\n") > 10 + + +class TestLinuxCheckIdt: + def test_linux_generic_check_idt(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.check_idt.Check_idt", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert out.count(b"__kernel__") >= 10 + assert out.count(b"\n") > 10 + + +class TestLinuxCheckSyscall: + def test_linux_generic_check_syscall(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.check_syscall.Check_syscall", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert out.find(b"sys_close") != -1 + assert out.find(b"sys_open") != -1 + assert out.count(b"\n") > 100 + + +class TestLinuxLsmod: + def test_linux_generic_lsmod(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.lsmod.Lsmod", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert out.count(b"\n") > 10 + + +class TestLinuxLsof: + def test_linux_generic_lsof(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.lsof.Lsof", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert out.count(b"socket:") >= 10 + assert out.count(b"\n") > 35 + + +class TestLinuxProcMaps: + def test_linux_generic_proc_maps(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.proc.Maps", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert out.count(b"anonymous mapping") >= 10 + assert out.count(b"\n") > 100 + + +class TestLinuxTtyCheck: + def test_linux_generic_tty_check(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.tty_check.tty_check", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert out.find(b"__kernel__") != -1 + assert out.count(b"\n") >= 5 + + +class TestLinuxSockstat: + def test_linux_generic_sockstat(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.sockstat.Sockstat", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"AF_UNIX") >= 354 + assert out.count(b"AF_BLUETOOTH") >= 5 + assert out.count(b"AF_INET") >= 32 + assert out.count(b"AF_INET6") >= 20 + assert out.count(b"AF_PACKET") >= 1 + assert out.count(b"AF_NETLINK") >= 43 + + +class TestLinuxLibraryList: + def test_linux_specific_library_list(self, volatility, python): + image = LinuxSamples.LINUX_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "linux.library_list.LibraryList", + image, + volatility, + python, + pluginargs=("--pids", "2363"), + ) + + assert rc == 0 + assert re.search( + rb"NetworkManager\s2363\s0x7f52cdda0000\s/lib/x86_64-linux-gnu/libnss_files.so.2", + out, + ) + + assert out.count(b"\n") > 10 + + +class TestLinuxPstree: + def test_linux_generic_pstree(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.pstree.PsTree", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) + assert out.count(b"\n") > 10 + + +class TestLinuxPidhashtable: + def test_linux_generic_pidhashtable(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.pidhashtable.PIDHashTable", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) + assert out.count(b"\n") > 10 + + +class TestLinuxBash: + def test_linux_bash(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.bash.Bash", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"\n") > 10 + + +class TestLinuxBoottime: + def test_linux_generic_boottime(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.boottime.Boottime", image, volatility, python + ) + + assert rc == 0 + out = out.lower() + assert out.count(b"utc") >= 1 + + +class TestLinuxCapabilities: + def test_linux_generic_capabilities(self, image, volatility, python): + rc, out, err = test_volatility.runvol_plugin( + "linux.capabilities.Capabilities", + image, + volatility, + python, + globalargs=("-vvv",), + ) + + if rc != 0 and err.count(b"Unsupported kernel capabilities implementation") > 0: + # The linux-sample-1.bin kernel implementation isn't supported. + # However, we can still check that the plugin requirements are met. + return None + + assert rc == 0 + assert out.count(b"\n") > 10 + + +class TestLinuxCheckCreds: + def test_linux_generic_check_creds(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.check_creds.Check_creds", image, volatility, python + ) + + # linux-sample-1.bin has no processes sharing credentials. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxElfs: + def test_linux_generic_elfs(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.elfs.Elfs", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"\n") > 10 + + +class TestLinuxEnvars: + def test_linux_generic_envars(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.envars.Envars", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"\n") > 10 + + +class TestLinuxKthreads: + def test_linux_generic_kthreads(self, image, volatility, python): + rc, out, err = test_volatility.runvol_plugin( + "linux.kthreads.Kthreads", + image, + volatility, + python, + globalargs=("-vvv",), + ) + + if rc != 0 and err.count(b"Unsupported kthread implementation") > 0: + # The linux-sample-1.bin kernel implementation isn't supported. + # However, we can still check that the plugin requirements are met. + return None + + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxMalfind: + def test_linux_generic_malfind(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.malfind.Malfind", image, volatility, python + ) + + # linux-sample-1.bin has no process memory ranges with potential injected code. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxMountinfo: + def test_linux_generic_mountinfo(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.mountinfo.MountInfo", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"\n") > 10 + + +class TestLinuxPsaux: + def test_linux_generic_psaux(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.psaux.PsAux", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"\n") > 50 + + +class TestLinuxPtrace: + def test_linux_generic_ptrace(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.ptrace.Ptrace", image, volatility, python + ) + + # linux-sample-1.bin has no processes being ptraced. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxVmaregexscan: + def test_linux_generic_vmaregexscan(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.vmaregexscan.VmaRegExScan", + image, + volatility, + python, + pluginargs=("--pid", "1", "--pattern", "\\x7fELF"), + ) + + assert rc == 0 + assert out.count(b"\n") > 10 + + +class TestLinuxVmayarascanYaraRule: + def test_linux_specific_vmayarascan_yara_rule(self, volatility, python): + image = LinuxSamples.LINUX_GENERIC.value.path + yara_rule_01 = r""" + rule fullvmayarascan + { + strings: + $s1 = "_nss_files_parse_grent" + $s2 = "/lib64/ld-linux-x86-64.so.2" + $s3 = "(bufferend - (char *) 0) % sizeof (char *) == 0" + condition: + all of them + } + """ + + # FIXME: When the minimum Python version includes 3.12, replace the following with: + # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... + fd, filename = tempfile.mkstemp(suffix=".yar") + try: + with os.fdopen(fd, "w") as f: + f.write(yara_rule_01) + + rc, out, _err = test_volatility.runvol_plugin( + "linux.vmayarascan.VmaYaraScan", + image, + volatility, + python, + pluginargs=("--pid", "8600", "--yara-file", filename), + ) + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(filename) + + assert rc == 0 + assert out.count(b"\n") > 4 + + +class TestLinuxVmayarascanYaraString: + def test_linux_generic_vmayarascan_yara_string(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.vmayarascan.VmaYaraScan", + image, + volatility, + python, + pluginargs=("--pid", "1", "--yara-string", "ELF"), + ) + + assert rc == 0 + assert out.count(b"\n") > 10 + + +class TestLinuxPageCacheFiles: + def test_linux_specific_page_cache_files(self, volatility, python): + image = LinuxSamples.LINUX_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "linux.pagecache.Files", + image, + volatility, + python, + pluginargs=("--find", "/etc/passwd"), + ) + + assert rc == 0 + assert out.count(b"\n") > 4 + + # inode_num inode_addr ... file_path + assert re.search( + rb"146829\s0x88001ab5c270.*?/etc/passwd", + out, + ) + + +class TestLinuxPageCacheInodepages: + def test_linux_specific_page_cache_inodepages(self, volatility, python): + image = LinuxSamples.LINUX_GENERIC.value.path + inode_address = hex(0x88001AB5C270) + inode_dump_filename = f"inode_{inode_address}.dmp" + + rc, out, _err = test_volatility.runvol_plugin( + "linux.pagecache.InodePages", + image, + volatility, + python, + pluginargs=("--inode", inode_address), + ) + + assert rc == 0 + assert out.count(b"\n") > 4 + + # PageVAddr PagePAddr MappingAddr .. DumpSafe + assert re.search( + rb"0xea000054c5f8\s0x18389000\s0x88001ab5c3b0.*?True", + out, + ) + + try: + rc, out, _err = test_volatility.runvol_plugin( + "linux.pagecache.InodePages", + image, + volatility, + python, + pluginargs=("--inode", inode_address, "--dump"), + ) + + assert rc == 0 + assert out.count(b"\n") >= 4 + + assert os.path.exists(inode_dump_filename) + with open(inode_dump_filename, "rb") as fp: + inode_contents = fp.read() + assert inode_contents.count(b"\n") > 30 + assert inode_contents.count(b"root:x:0:0:root:/root:/bin/bash") > 0 + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(inode_dump_filename) + + +class TestLinuxCheckAfinfo: + def test_linux_generic_check_afinfo(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.check_afinfo.Check_afinfo", image, volatility, python + ) + + # linux-sample-1.bin has no suspicious results. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxCheckModules: + def test_linux_generic_check_modules(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.check_modules.Check_modules", image, volatility, python + ) + + # linux-sample-1.bin has no suspicious results. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxEbpf: + def test_linux_generic_ebpf_progs(self, image, volatility, python): + rc, out, err = test_volatility.runvol_plugin( + "linux.ebpf.EBPF", + image, + volatility, + python, + globalargs=("-vvv",), + ) + + if rc != 0 and err.count(b"Unsupported kernel") > 0: + # The linux-sample-1.bin kernel implementation isn't supported. + # However, we can still check that the plugin requirements are met. + return None + + assert rc == 0 + assert out.count(b"\n") > 4 + + +class TestLinuxIomem: + def test_linux_generic_iomem(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.iomem.IOMem", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"\n") > 100 + + +class TestLinuxKeyboardNotifiers: + def test_linux_generic_keyboard_notifiers(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.keyboard_notifiers.Keyboard_notifiers", image, volatility, python + ) + + # linux-sample-1.bin has no suspicious results for this plugin. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxKmesg: + def test_linux_generic_kmesg(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.kmsg.Kmsg", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"\n") > 100 + + +class TestLinuxNetfilter: + def test_linux_generic_netfilter(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.netfilter.Netfilter", image, volatility, python + ) + + # linux-sample-1.bin has no suspicious results for this plugin. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxPsscan: + def test_linux_generic__psscan(self, image, volatility, python): + rc, out, _err = test_volatility.runvol_plugin( + "linux.psscan.PsScan", image, volatility, python + ) + + assert rc == 0 + assert out.count(b"\n") > 100 + + +class TestLinuxHiddenModules: + def test_linux_specific_hidden_modules(self, volatility, python): + # TODO: this check should be specific, against a distinct infected sample + image = LinuxSamples.LINUX_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "linux.hidden_modules.Hidden_modules", image, volatility, python + ) + + # linux-sample-1.bin has no hidden modules. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") >= 4 + + +class TestLinuxIpAddr: + def test_linux_specific_ip_addr(self, volatility, python): + image = LinuxSamples.LINUX_GENERIC.value.path + rc, out, err = test_volatility.runvol_plugin( + "linux.ip.Addr", image, volatility, python + ) + + assert re.search( + rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+False\s+192.168.201.161\s+24\s+global\s+UP", + out, + ) + assert re.search( + rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+False\s+fe80::20c:29ff:fe8f:edca\s+64\s+link\s+UP", + out, + ) + assert out.count(b"\n") >= 8 + assert rc == 0 + + +class TestLinuxIpLink: + def test_linux_specific_ip_link(self, volatility, python): + image = LinuxSamples.LINUX_GENERIC.value.path + rc, out, err = test_volatility.runvol_plugin( + "linux.ip.Link", image, volatility, python + ) + + assert re.search( + rb"-\s+lo\s+00:00:00:00:00:00\s+UNKNOWN\s+16436\s+noqueue\s+0\s+LOOPBACK,LOWER_UP,UP", + out, + ) + assert re.search( + rb"-\s+eth0\s+00:0c:29:8f:ed:ca\s+UP\s+1500\s+pfifo_fast\s+1000\s+BROADCAST,LOWER_UP,MULTICAST,UP", + out, + ) + assert out.count(b"\n") >= 6 + assert rc == 0 + + +class TestLinuxKallsyms: + def test_linux_specific_kallsyms(self, volatility, python): + image = LinuxSamples.LINUX_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "linux.kallsyms.Kallsyms", + image, + volatility, + python, + pluginargs=("--modules",), + ) + # linux-sample-1.bin has no hidden modules. + # This validates that plugin requirements are met and exceptions are not raised. + assert rc == 0 + assert out.count(b"\n") > 1000 + + # Addr Type Size Exported SubSystem ModuleName SymbolName Description + # 0xffffa009eba9 t 28 False module usbcore usb_mon_register Symbol is in the text (code) section + assert re.search( + rb"0xffffa009eba9\s+t\s+28\s+False\s+module\s+usbcore\s+usb_mon_register\s+Symbol is in the text \(code\) section", + out, + ) + + +class TestLinuxPscallstack: + def test_linux_specific_pscallstack(self, volatility, python): + image = LinuxSamples.LINUX_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "linux.pscallstack.PsCallStack", + image, + volatility, + python, + pluginargs=("--pid", "1"), + ) + + assert rc == 0 + assert out.count(b"\n") > 30 + + # TID Comm Position Address Value Name Type Module + # 1 init 39 0x88001f999a40 0xffff81109039 do_select T kernel + assert re.search( + rb"1\s+init\s+39\s+0x88001f999a40.*?0xffff81109039\s+do_select\s+T\s+kernel", + out, + ) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py new file mode 100644 index 000000000..4d8bb3e54 --- /dev/null +++ b/test/plugins/windows/windows.py @@ -0,0 +1,326 @@ +import json +import hashlib +import shutil +import contextlib +import tempfile +import os +from test import test_volatility, WindowsSamples + + +class TestWindowsVolshell: + def test_windows_volshell(self, image, volatility, python): + out = test_volatility.basic_volshell_test( + image, volatility, python, globalargs=("-w",) + ) + assert out.count(b" 40 + + +class TestWindowsPslist: + def test_windows_generic_pslist(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.pslist.PsList", + image, + volatility, + python, + # Notice that this is needed to hit lru_cache when "specific" will run + globalargs=("-r", "json"), + ) + assert rc == 0 + out = out.lower() + assert out.find(b"system") != -1 + assert out.find(b"csrss.exe") != -1 + assert out.find(b"svchost.exe") != -1 + assert out.count(b"\n") > 10 + + def test_windows_specific_pslist(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.pslist.PsList", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + expected_row = { + "CreateTime": None, + "ExitTime": None, + "File output": "Disabled", + "Handles": 1140, + "ImageFileName": "System", + "Offset(V)": 2185004992, + "PID": 4, + "PPID": 0, + "SessionId": None, + "Threads": 61, + "Wow64": False, + "__children": [], + } + assert test_volatility.match_output_row(json.loads(out), expected_row) + + +class TestWindowsPsscan: + def test_windows_generic_psscan(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.psscan.PsScan", image, volatility, python + ) + assert rc == 0 + out = out.lower() + assert out.find(b"system") != -1 + assert out.find(b"csrss.exe") != -1 + assert out.find(b"svchost.exe") != -1 + assert out.count(b"\n") > 10 + + +class TestWindowsDlllist: + def test_windows_generic_dlllist(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.dlllist.DllList", image, volatility, python + ) + assert rc == 0 + out = out.lower() + assert out.count(b"\n") > 10 + + +class TestWindowsModules: + def test_windows_generic_modules(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.modules.Modules", image, volatility, python + ) + assert rc == 0 + out = out.lower() + assert out.count(b"\n") > 10 + + +class TestWindowsHivelist: + def test_windows_generic_hivelist(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.registry.hivelist.HiveList", image, volatility, python + ) + assert rc == 0 + out = out.lower() + + not_xp = out.find(b"\\systemroot\\system32\\config\\software") + if not_xp == -1: + assert ( + out.find( + b"\\device\\harddiskvolume1\\windows\\system32\\config\\software" + ) + != -1 + ) + assert out.count(b"\n") > 10 + + +class TestWindowsDumpfiles: + def test_windows_specific_dumpfiles(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + with open("./test/known_files.json") as json_file: + known_files = json.load(json_file) + + failed_chksms = 0 + file_name = os.path.basename(image) + + try: + for addr in known_files["windows_dumpfiles"][file_name]: + path = tempfile.mkdtemp() + + rc, _out, _err = test_volatility.runvol_plugin( + "windows.dumpfiles.DumpFiles", + image, + volatility, + python, + globalargs=("-o", path), + pluginargs=("--virtaddr", addr), + ) + + for file in os.listdir(path): + with open(os.path.join(path, file), "rb") as fp: + if ( + hashlib.md5(fp.read()).hexdigest() + not in known_files["windows_dumpfiles"][file_name][addr] + ): + failed_chksms += 1 + + shutil.rmtree(path) + json_file.close() + + assert failed_chksms == 0 + assert rc == 0 + except Exception as e: + json_file.close() + print("Key Error raised on " + str(e)) + assert False + + +class TestWindowsHandles: + def test_windows_generic_handles(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.handles.Handles", + image, + volatility, + python, + pluginargs=("--pid", "4"), + ) + assert rc == 0 + assert out.find(b"System Pid 4") != -1 + assert ( + out.find( + b"MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\MEMORY MANAGEMENT\\PREFETCHPARAMETERS" + ) + != -1 + ) + assert out.find(b"MACHINE\\SYSTEM\\SETUP") != -1 + assert out.count(b"\n") > 500 + + +class TestWindowsSvcscan: + def test_windows_generic_svcscan(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.svcscan.SvcScan", image, volatility, python + ) + assert rc == 0 + assert out.find(b"Microsoft ACPI Driver") != -1 + assert out.count(b"\n") > 250 + + +class TestWindowsThrdscan: + def test_windows_generic_thrdscan(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.thrdscan.ThrdScan", image, volatility, python + ) + assert rc == 0 + assert out.find(b"\t4\t8") != -1 + assert out.find(b"\t4\t12") != -1 + assert out.find(b"\t4\t16") != -1 + + +class TestWindowsPrivileges: + def test_windows_generic_privileges(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.privileges.Privs", + image, + volatility, + python, + pluginargs=("--pid", "4"), + ) + assert rc == 0 + assert out.find(b"SeCreateTokenPrivilege") != -1 + assert out.find(b"SeCreateGlobalPrivilege") != -1 + assert out.find(b"SeAssignPrimaryTokenPrivilege") != -1 + assert out.count(b"\n") > 20 + + +class TestWindowsGetsids: + def test_windows_generic_getsids(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.getsids.GetSIDs", + image, + volatility, + python, + pluginargs=("--pid", "4"), + ) + assert rc == 0 + assert out.find(b"Local System") != -1 + assert out.find(b"Administrators") != -1 + assert out.find(b"Everyone") != -1 + assert out.find(b"Authenticated Users") != -1 + + +class TestWindowsEnvars: + def test_windows_generic_envars(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.envars.Envars", image, volatility, python + ) + assert rc == 0 + assert out.find(b"PATH") != -1 + assert out.find(b"PROCESSOR_ARCHITECTURE") != -1 + assert out.find(b"USERNAME") != -1 + assert out.find(b"SystemRoot") != -1 + assert out.find(b"CommonProgramFiles") != -1 + assert out.count(b"\n") > 500 + + +class TestWindowsCallbacks: + def test_windows_generic_callbacks(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.callbacks.Callbacks", image, volatility, python + ) + assert rc == 0 + assert out.find(b"PspCreateProcessNotifyRoutine") != -1 + assert out.find(b"KeBugCheckCallbackListHead") != -1 + assert out.find(b"KeBugCheckReasonCallbackListHead") != -1 + assert out.count(b"KeBugCheckReasonCallbackListHead ") > 5 + + +class TestWindowsVadwalk: + def test_windows_generic_vadwalk(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.vadwalk.VadWalk", image, volatility, python + ) + assert rc == 0 + assert out.find(b"Vad") != -1 + assert out.find(b"VadS") != -1 + assert out.find(b"Vadl") != -1 + assert out.find(b"VadF") != -1 + assert out.find(b"0x0") != -1 + + +class TestWindowsDevicetree: + def test_windows_generic_devicetree(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.devicetree.DeviceTree", image, volatility, python + ) + assert rc == 0 + assert out.find(b"DEV") != -1 + assert out.find(b"DRV") != -1 + assert out.find(b"ATT") != -1 + assert out.find(b"FILE_DEVICE_CONTROLLER") != -1 + assert out.find(b"FILE_DEVICE_DISK") != -1 + assert out.find(b"FILE_DEVICE_DISK_FILE_SYSTEM") != -1 + + +class TestWindowsVadyarascan: + def test_windows_specific_vadyarascan_yara_rule(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + yara_rule_01 = r""" + rule fullvadyarascan + { + strings: + $s1 = "!This program cannot be run in DOS mode." + $s2 = "Qw))Pw" + $s3 = "W_wD)Pw" + $s4 = "1Xw+2Xw" + $s5 = "xd`wh``w" + $s6 = "0g`w0g`w8g`w8g`w@g`w@g`wHg`wHg`wPg`wPg`wXg`wXg`w`g`w`g`whg`whg`wpg`wpg`wxg`wxg`w" + condition: + all of them + } + """ + fd, filename = tempfile.mkstemp(suffix=".yar") + try: + with os.fdopen(fd, "w") as f: + f.write(yara_rule_01) + rc, out, _err = test_volatility.runvol_plugin( + "windows.vadyarascan.VadYaraScan", + image, + volatility, + python, + pluginargs=("--pid", "4012", "--yara-file", filename), + ) + finally: + with contextlib.suppress(FileNotFoundError): + os.remove(filename) + assert rc == 0 + assert out.count(b"\n") > 4 + + def test_windows_specific_vadyarascan_yara_string(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.vadyarascan.VadYaraScan", + image, + volatility, + python, + pluginargs=("--pid", "4012", "--yara-string", "MZ"), + ) + assert rc == 0 + assert out.count(b"\n") > 10 diff --git a/test/test_volatility.py b/test/test_volatility.py index 9cc9c3304..c376d3ccc 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -133,806 +133,8 @@ def basic_volshell_test(image, volatility, python, globalargs): return out -# WINDOWS - - -def test_windows_volshell(image, volatility, python): - out = basic_volshell_test(image, volatility, python, globalargs=["-w"]) - assert out.count(b" 40 - - -def test_windows_pslist(image, volatility, python): - rc, out, _err = runvol_plugin("windows.pslist.PsList", image, volatility, python) - out = out.lower() - assert out.find(b"system") != -1 - assert out.find(b"csrss.exe") != -1 - assert out.find(b"svchost.exe") != -1 - assert out.count(b"\n") > 10 - assert rc == 0 - - rc, out, _err = runvol_plugin( - "windows.pslist.PsList", image, volatility, python, pluginargs=["--pid", "4"] - ) - out = out.lower() - assert out.find(b"system") != -1 - assert out.count(b"\n") < 10 - assert rc == 0 - - -def test_windows_psscan(image, volatility, python): - rc, out, _err = runvol_plugin("windows.psscan.PsScan", image, volatility, python) - out = out.lower() - assert out.find(b"system") != -1 - assert out.find(b"csrss.exe") != -1 - assert out.find(b"svchost.exe") != -1 - assert out.count(b"\n") > 10 - assert rc == 0 - - -def test_windows_dlllist(image, volatility, python): - rc, out, _err = runvol_plugin("windows.dlllist.DllList", image, volatility, python) - out = out.lower() - assert out.count(b"\n") > 10 - assert rc == 0 - - -def test_windows_modules(image, volatility, python): - rc, out, _err = runvol_plugin("windows.modules.Modules", image, volatility, python) - out = out.lower() - assert out.count(b"\n") > 10 - assert rc == 0 - - -def test_windows_hivelist(image, volatility, python): - rc, out, _err = runvol_plugin( - "windows.registry.hivelist.HiveList", image, volatility, python - ) - out = out.lower() - - not_xp = out.find(b"\\systemroot\\system32\\config\\software") - if not_xp == -1: - assert ( - out.find(b"\\device\\harddiskvolume1\\windows\\system32\\config\\software") - != -1 - ) - - assert out.count(b"\n") > 10 - assert rc == 0 - - -def test_windows_dumpfiles(image, volatility, python): - - with open("./test/known_files.json") as json_file: - known_files = json.load(json_file) - - failed_chksms = 0 - file_name = os.path.basename(image) - - try: - for addr in known_files["windows_dumpfiles"][file_name]: - - path = tempfile.mkdtemp() - - rc, _out, _err = runvol_plugin( - "windows.dumpfiles.DumpFiles", - image, - volatility, - python, - globalargs=["-o", path], - pluginargs=["--virtaddr", addr], - ) - - for file in os.listdir(path): - with open(os.path.join(path, file), "rb") as fp: - if ( - hashlib.md5(fp.read()).hexdigest() - not in known_files["windows_dumpfiles"][file_name][addr] - ): - failed_chksms += 1 - - shutil.rmtree(path) - - json_file.close() - - assert failed_chksms == 0 - assert rc == 0 - except Exception as e: - json_file.close() - print("Key Error raised on " + str(e)) - assert False - - -def test_windows_handles(image, volatility, python): - rc, out, _err = runvol_plugin( - "windows.handles.Handles", image, volatility, python, pluginargs=["--pid", "4"] - ) - - assert out.find(b"System Pid 4") != -1 - assert ( - out.find( - b"MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\MEMORY MANAGEMENT\\PREFETCHPARAMETERS" - ) - != -1 - ) - assert out.find(b"MACHINE\\SYSTEM\\SETUP") != -1 - assert out.count(b"\n") > 500 - assert rc == 0 - - -def test_windows_svcscan(image, volatility, python): - rc, out, _err = runvol_plugin("windows.svcscan.SvcScan", image, volatility, python) - - assert out.find(b"Microsoft ACPI Driver") != -1 - assert out.count(b"\n") > 250 - assert rc == 0 - - -def test_windows_thrdscan(image, volatility, python): - rc, out, _err = runvol_plugin( - "windows.thrdscan.ThrdScan", image, volatility, python - ) - # find pid 4 (of system process) which starts with lowest tids - assert out.find(b"\t4\t8") != -1 - assert out.find(b"\t4\t12") != -1 - assert out.find(b"\t4\t16") != -1 - # assert out.find(b"this raieses AssertionError") != -1 - assert rc == 0 - - -def test_windows_privileges(image, volatility, python): - rc, out, _err = runvol_plugin( - "windows.privileges.Privs", image, volatility, python, pluginargs=["--pid", "4"] - ) - - assert out.find(b"SeCreateTokenPrivilege") != -1 - assert out.find(b"SeCreateGlobalPrivilege") != -1 - assert out.find(b"SeAssignPrimaryTokenPrivilege") != -1 - assert out.count(b"\n") > 20 - assert rc == 0 - - -def test_windows_getsids(image, volatility, python): - rc, out, _err = runvol_plugin( - "windows.getsids.GetSIDs", image, volatility, python, pluginargs=["--pid", "4"] - ) - - assert out.find(b"Local System") != -1 - assert out.find(b"Administrators") != -1 - assert out.find(b"Everyone") != -1 - assert out.find(b"Authenticated Users") != -1 - assert rc == 0 - - -def test_windows_envars(image, volatility, python): - rc, out, _err = runvol_plugin("windows.envars.Envars", image, volatility, python) - - assert out.find(b"PATH") != -1 - assert out.find(b"PROCESSOR_ARCHITECTURE") != -1 - assert out.find(b"USERNAME") != -1 - assert out.find(b"SystemRoot") != -1 - assert out.find(b"CommonProgramFiles") != -1 - assert out.count(b"\n") > 500 - assert rc == 0 - - -def test_windows_callbacks(image, volatility, python): - rc, out, _err = runvol_plugin( - "windows.callbacks.Callbacks", image, volatility, python - ) - - assert out.find(b"PspCreateProcessNotifyRoutine") != -1 - assert out.find(b"KeBugCheckCallbackListHead") != -1 - assert out.find(b"KeBugCheckReasonCallbackListHead") != -1 - assert out.count(b"KeBugCheckReasonCallbackListHead ") > 5 - assert rc == 0 - - -def test_windows_vadwalk(image, volatility, python): - rc, out, _err = runvol_plugin("windows.vadwalk.VadWalk", image, volatility, python) - - assert out.find(b"Vad") != -1 - assert out.find(b"VadS") != -1 - assert out.find(b"Vadl") != -1 - assert out.find(b"VadF") != -1 - assert out.find(b"0x0") != -1 - assert rc == 0 - - -def test_windows_devicetree(image, volatility, python): - rc, out, _err = runvol_plugin( - "windows.devicetree.DeviceTree", image, volatility, python - ) - - assert out.find(b"DEV") != -1 - assert out.find(b"DRV") != -1 - assert out.find(b"ATT") != -1 - assert out.find(b"FILE_DEVICE_CONTROLLER") != -1 - assert out.find(b"FILE_DEVICE_DISK") != -1 - assert out.find(b"FILE_DEVICE_DISK_FILE_SYSTEM") != -1 - assert rc == 0 - - -def test_windows_vadyarascan_yara_rule(image, volatility, python): - yara_rule_01 = r""" - rule fullvadyarascan - { - strings: - $s1 = "!This program cannot be run in DOS mode." - $s2 = "Qw))Pw" - $s3 = "W_wD)Pw" - $s4 = "1Xw+2Xw" - $s5 = "xd`wh``w" - $s6 = "0g`w0g`w8g`w8g`w@g`w@g`wHg`wHg`wPg`wPg`wXg`wXg`w`g`w`g`whg`whg`wpg`wpg`wxg`wxg`w" - condition: - all of them - } - """ - - # FIXME: When the minimum Python version includes 3.12, replace the following with: - # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... - fd, filename = tempfile.mkstemp(suffix=".yar") - try: - with os.fdopen(fd, "w") as f: - f.write(yara_rule_01) - - rc, out, _err = runvol_plugin( - "windows.vadyarascan.VadYaraScan", - image, - volatility, - python, - pluginargs=["--pid", "4012", "--yara-file", filename], - ) - finally: - with contextlib.suppress(FileNotFoundError): - os.remove(filename) - - out = out.lower() - assert out.count(b"\n") > 4 - assert rc == 0 - - -def test_windows_vadyarascan_yara_string(image, volatility, python): - rc, out, _err = runvol_plugin( - "windows.vadyarascan.VadYaraScan", - image, - volatility, - python, - pluginargs=["--pid", "4012", "--yara-string", "MZ"], - ) - out = out.lower() - - assert out.count(b"\n") > 10 - assert rc == 0 - - -# LINUX - - -def test_linux_volshell(image, volatility, python): - out = basic_volshell_test(image, volatility, python, globalargs=["-l"]) - assert out.count(b" 100 - - -def test_linux_pslist(image, volatility, python): - rc, out, _err = runvol_plugin("linux.pslist.PsList", image, volatility, python) - - assert rc == 0 - out = out.lower() - assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) - assert out.find(b"watchdog") != -1 - assert out.count(b"\n") > 10 - - -def test_linux_check_idt(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.check_idt.Check_idt", image, volatility, python - ) - - assert rc == 0 - out = out.lower() - assert out.count(b"__kernel__") >= 10 - assert out.count(b"\n") > 10 - - -def test_linux_check_syscall(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.check_syscall.Check_syscall", image, volatility, python - ) - - assert rc == 0 - out = out.lower() - assert out.find(b"sys_close") != -1 - assert out.find(b"sys_open") != -1 - assert out.count(b"\n") > 100 - - -def test_linux_lsmod(image, volatility, python): - rc, out, _err = runvol_plugin("linux.lsmod.Lsmod", image, volatility, python) - - assert rc == 0 - out = out.lower() - assert out.count(b"\n") > 10 - - -def test_linux_lsof(image, volatility, python): - rc, out, _err = runvol_plugin("linux.lsof.Lsof", image, volatility, python) - - assert rc == 0 - out = out.lower() - assert out.count(b"socket:") >= 10 - assert out.count(b"\n") > 35 - - -def test_linux_proc_maps(image, volatility, python): - rc, out, _err = runvol_plugin("linux.proc.Maps", image, volatility, python) - - assert rc == 0 - out = out.lower() - assert out.count(b"anonymous mapping") >= 10 - assert out.count(b"\n") > 100 - - -def test_linux_tty_check(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.tty_check.tty_check", image, volatility, python - ) - - assert rc == 0 - out = out.lower() - assert out.find(b"__kernel__") != -1 - assert out.count(b"\n") >= 5 - - -def test_linux_sockstat(image, volatility, python): - rc, out, _err = runvol_plugin("linux.sockstat.Sockstat", image, volatility, python) - - assert rc == 0 - assert out.count(b"AF_UNIX") >= 354 - assert out.count(b"AF_BLUETOOTH") >= 5 - assert out.count(b"AF_INET") >= 32 - assert out.count(b"AF_INET6") >= 20 - assert out.count(b"AF_PACKET") >= 1 - assert out.count(b"AF_NETLINK") >= 43 - - -def test_linux_library_list(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.library_list.LibraryList", - image, - volatility, - python, - pluginargs=["--pids", "2363"], - ) - - assert rc == 0 - assert re.search( - rb"NetworkManager\s2363\s0x7f52cdda0000\s/lib/x86_64-linux-gnu/libnss_files.so.2", - out, - ) - - assert out.count(b"\n") > 10 - - -def test_linux_pstree(image, volatility, python): - rc, out, _err = runvol_plugin("linux.pstree.PsTree", image, volatility, python) - - assert rc == 0 - out = out.lower() - assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) - assert out.count(b"\n") > 10 - - -def test_linux_pidhashtable(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.pidhashtable.PIDHashTable", image, volatility, python - ) - - assert rc == 0 - out = out.lower() - assert (out.find(b"init") != -1) or (out.find(b"systemd") != -1) - assert out.count(b"\n") > 10 - - -def test_linux_bash(image, volatility, python): - rc, out, _err = runvol_plugin("linux.bash.Bash", image, volatility, python) - - assert rc == 0 - assert out.count(b"\n") > 10 - - -def test_linux_boottime(image, volatility, python): - rc, out, _err = runvol_plugin("linux.boottime.Boottime", image, volatility, python) - - assert rc == 0 - out = out.lower() - assert out.count(b"utc") >= 1 - - -def test_linux_capabilities(image, volatility, python): - rc, out, err = runvol_plugin( - "linux.capabilities.Capabilities", - image, - volatility, - python, - globalargs=["-vvv"], - ) - - if rc != 0 and err.count(b"Unsupported kernel capabilities implementation") > 0: - # The linux-sample-1.bin kernel implementation isn't supported. - # However, we can still check that the plugin requirements are met. - return None - - assert rc == 0 - assert out.count(b"\n") > 10 - - -def test_linux_check_creds(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.check_creds.Check_creds", image, volatility, python - ) - - # linux-sample-1.bin has no processes sharing credentials. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_elfs(image, volatility, python): - rc, out, _err = runvol_plugin("linux.elfs.Elfs", image, volatility, python) - - assert rc == 0 - assert out.count(b"\n") > 10 - - -def test_linux_envars(image, volatility, python): - rc, out, _err = runvol_plugin("linux.envars.Envars", image, volatility, python) - - assert rc == 0 - assert out.count(b"\n") > 10 - - -def test_linux_kthreads(image, volatility, python): - rc, out, err = runvol_plugin( - "linux.kthreads.Kthreads", - image, - volatility, - python, - globalargs=["-vvv"], - ) - - if rc != 0 and err.count(b"Unsupported kthread implementation") > 0: - # The linux-sample-1.bin kernel implementation isn't supported. - # However, we can still check that the plugin requirements are met. - return None - - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_malfind(image, volatility, python): - rc, out, _err = runvol_plugin("linux.malfind.Malfind", image, volatility, python) - - # linux-sample-1.bin has no process memory ranges with potential injected code. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_mountinfo(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.mountinfo.MountInfo", image, volatility, python - ) - - assert rc == 0 - assert out.count(b"\n") > 10 - - -def test_linux_psaux(image, volatility, python): - rc, out, _err = runvol_plugin("linux.psaux.PsAux", image, volatility, python) - - assert rc == 0 - assert out.count(b"\n") > 50 - - -def test_linux_ptrace(image, volatility, python): - rc, out, _err = runvol_plugin("linux.ptrace.Ptrace", image, volatility, python) - - # linux-sample-1.bin has no processes being ptraced. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_vmaregexscan(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.vmaregexscan.VmaRegExScan", - image, - volatility, - python, - pluginargs=["--pid", "1", "--pattern", "\\x7fELF"], - ) - - assert rc == 0 - assert out.count(b"\n") > 10 - - -def test_linux_vmayarascan_yara_rule(image, volatility, python): - yara_rule_01 = r""" - rule fullvmayarascan - { - strings: - $s1 = "_nss_files_parse_grent" - $s2 = "/lib64/ld-linux-x86-64.so.2" - $s3 = "(bufferend - (char *) 0) % sizeof (char *) == 0" - condition: - all of them - } - """ - - # FIXME: When the minimum Python version includes 3.12, replace the following with: - # with tempfile.NamedTemporaryFile(delete_on_close=False) as fd: ... - fd, filename = tempfile.mkstemp(suffix=".yar") - try: - with os.fdopen(fd, "w") as f: - f.write(yara_rule_01) - - rc, out, _err = runvol_plugin( - "linux.vmayarascan.VmaYaraScan", - image, - volatility, - python, - pluginargs=["--pid", "8600", "--yara-file", filename], - ) - finally: - with contextlib.suppress(FileNotFoundError): - os.remove(filename) - - assert rc == 0 - assert out.count(b"\n") > 4 - - -def test_linux_vmayarascan_yara_string(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.vmayarascan.VmaYaraScan", - image, - volatility, - python, - pluginargs=["--pid", "1", "--yara-string", "ELF"], - ) - - assert rc == 0 - assert out.count(b"\n") > 10 - - -def test_linux_page_cache_files(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.pagecache.Files", - image, - volatility, - python, - pluginargs=["--find", "/etc/passwd"], - ) - - assert rc == 0 - assert out.count(b"\n") > 4 - - # inode_num inode_addr ... file_path - assert re.search( - rb"146829\s0x88001ab5c270.*?/etc/passwd", - out, - ) - - -def test_linux_page_cache_inodepages(image, volatility, python): - - inode_address = hex(0x88001AB5C270) - inode_dump_filename = f"inode_{inode_address}.dmp" - - rc, out, _err = runvol_plugin( - "linux.pagecache.InodePages", - image, - volatility, - python, - pluginargs=["--inode", inode_address], - ) - - assert rc == 0 - assert out.count(b"\n") > 4 - - # PageVAddr PagePAddr MappingAddr .. DumpSafe - assert re.search( - rb"0xea000054c5f8\s0x18389000\s0x88001ab5c3b0.*?True", - out, - ) - - try: - rc, out, _err = runvol_plugin( - "linux.pagecache.InodePages", - image, - volatility, - python, - pluginargs=["--inode", inode_address, "--dump"], - ) - - assert rc == 0 - assert out.count(b"\n") >= 4 - - assert os.path.exists(inode_dump_filename) - with open(inode_dump_filename, "rb") as fp: - inode_contents = fp.read() - assert inode_contents.count(b"\n") > 30 - assert inode_contents.count(b"root:x:0:0:root:/root:/bin/bash") > 0 - finally: - with contextlib.suppress(FileNotFoundError): - os.remove(inode_dump_filename) - - -def test_linux_check_afinfo(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.check_afinfo.Check_afinfo", image, volatility, python - ) - - # linux-sample-1.bin has no suspicious results. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_check_modules(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.check_modules.Check_modules", image, volatility, python - ) - - # linux-sample-1.bin has no suspicious results. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_ebpf_progs(image, volatility, python): - rc, out, err = runvol_plugin( - "linux.ebpf.EBPF", - image, - volatility, - python, - globalargs=["-vvv"], - ) - - if rc != 0 and err.count(b"Unsupported kernel") > 0: - # The linux-sample-1.bin kernel implementation isn't supported. - # However, we can still check that the plugin requirements are met. - return None - - assert rc == 0 - assert out.count(b"\n") > 4 - - -def test_linux_iomem(image, volatility, python): - rc, out, _err = runvol_plugin("linux.iomem.IOMem", image, volatility, python) - - assert rc == 0 - assert out.count(b"\n") > 100 - - -def test_linux_keyboard_notifiers(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.keyboard_notifiers.Keyboard_notifiers", image, volatility, python - ) - - # linux-sample-1.bin has no suspicious results for this plugin. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_kmesg(image, volatility, python): - rc, out, _err = runvol_plugin("linux.kmsg.Kmsg", image, volatility, python) - - assert rc == 0 - assert out.count(b"\n") > 100 - - -def test_linux_netfilter(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.netfilter.Netfilter", image, volatility, python - ) - - # linux-sample-1.bin has no suspicious results for this plugin. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_psscan(image, volatility, python): - rc, out, _err = runvol_plugin("linux.psscan.PsScan", image, volatility, python) - - assert rc == 0 - assert out.count(b"\n") > 100 - - -def test_linux_hidden_modules(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.hidden_modules.Hidden_modules", image, volatility, python - ) - - # linux-sample-1.bin has no hidden modules. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") >= 4 - - -def test_linux_ip_addr(image, volatility, python): - rc, out, err = runvol_plugin("linux.ip.Addr", image, volatility, python) - - assert re.search( - rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+False\s+192.168.201.161\s+24\s+global\s+UP", - out, - ) - assert re.search( - rb"2\s+eth0\s+00:0c:29:8f:ed:ca\s+False\s+fe80::20c:29ff:fe8f:edca\s+64\s+link\s+UP", - out, - ) - assert out.count(b"\n") >= 8 - assert rc == 0 - - -def test_linux_ip_link(image, volatility, python): - rc, out, err = runvol_plugin("linux.ip.Link", image, volatility, python) - - assert re.search( - rb"-\s+lo\s+00:00:00:00:00:00\s+UNKNOWN\s+16436\s+noqueue\s+0\s+LOOPBACK,LOWER_UP,UP", - out, - ) - assert re.search( - rb"-\s+eth0\s+00:0c:29:8f:ed:ca\s+UP\s+1500\s+pfifo_fast\s+1000\s+BROADCAST,LOWER_UP,MULTICAST,UP", - out, - ) - assert out.count(b"\n") >= 6 - assert rc == 0 - - -def test_linux_kallsyms(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.kallsyms.Kallsyms", - image, - volatility, - python, - pluginargs=["--modules"], - ) - # linux-sample-1.bin has no hidden modules. - # This validates that plugin requirements are met and exceptions are not raised. - assert rc == 0 - assert out.count(b"\n") > 1000 - - # Addr Type Size Exported SubSystem ModuleName SymbolName Description - # 0xffffa009eba9 t 28 False module usbcore usb_mon_register Symbol is in the text (code) section - assert re.search( - rb"0xffffa009eba9\s+t\s+28\s+False\s+module\s+usbcore\s+usb_mon_register\s+Symbol is in the text \(code\) section", - out, - ) - - -def test_linux_pscallstack(image, volatility, python): - rc, out, _err = runvol_plugin( - "linux.pscallstack.PsCallStack", - image, - volatility, - python, - pluginargs=["--pid", "1"], - ) - - assert rc == 0 - assert out.count(b"\n") > 30 - - # TID Comm Position Address Value Name Type Module - # 1 init 39 0x88001f999a40 0xffff81109039 do_select T kernel - assert re.search( - rb"1\s+init\s+39\s+0x88001f999a40.*?0xffff81109039\s+do_select\s+T\s+kernel", - out, - ) - - # MAC +# TODO: Migrate and integrate in testing (once analysis is fixed ?) def test_mac_volshell(image, volatility, python): From 32c3997560f9fce6e2c45914a54833f8da8b9e8f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 4 Mar 2025 17:04:15 +0100 Subject: [PATCH 0643/1352] update paths to os-specific testfiles --- .github/workflows/test.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index ce2722457..6fbb93572 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -43,12 +43,12 @@ jobs: - name: Testing... run: | # VolShell - pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v - pytest ./test/test_volatility.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v + pytest ./test/plugins/windows/windows.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v + pytest ./test/plugins/linux/linux.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v # Volatility - pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k "test_windows and not test_windows_volshell" -v - pytest ./test/test_volatility.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v + pytest ./test/plugins/windows/windows.py --volatility=vol.py --image-dir=./test_images -k "test_windows and not test_windows_volshell" -v + pytest ./test/plugins/linux/linux.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v - name: Clean up post-test run: | From 8b634e49e1fcee00363ea75c3a5167ea9d047c8c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 4 Mar 2025 17:25:09 +0100 Subject: [PATCH 0644/1352] ubuntu 20.04 unsupported on 01/04/2025 --- .github/workflows/test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index ce2722457..a702d8b72 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -3,7 +3,7 @@ on: [push, pull_request] jobs: build: - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 strategy: matrix: python-version: ["3.8"] From 22594847d2712329d7888d92b47f8b0f81a522c8 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 4 Mar 2025 17:36:40 +0100 Subject: [PATCH 0645/1352] ubuntu 20.04 unsupported on 01/04/2025 --- .github/workflows/black.yml | 2 +- .github/workflows/build-pypi.yml | 2 +- .github/workflows/codeql.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml index d755d9402..3df690543 100644 --- a/.github/workflows/black.yml +++ b/.github/workflows/black.yml @@ -4,7 +4,7 @@ on: [push, pull_request] jobs: lint: - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - uses: actions/checkout@v4 - uses: psf/black@stable diff --git a/.github/workflows/build-pypi.yml b/.github/workflows/build-pypi.yml index d1a63b4da..a150ef154 100644 --- a/.github/workflows/build-pypi.yml +++ b/.github/workflows/build-pypi.yml @@ -15,7 +15,7 @@ on: jobs: build: - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 strategy: matrix: python-version: ["3.8"] diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index fa9bd7ef6..e2e741a9f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -23,7 +23,7 @@ on: jobs: analyze: name: Analyze - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 permissions: actions: read contents: read From 8c1e9f05341e8f630ab513f909b17d1eb45c6b52 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 5 Mar 2025 15:12:02 +0100 Subject: [PATCH 0646/1352] change args order to improve debugging ease --- test/plugins/windows/windows.py | 2 +- test/test_volatility.py | 12 +++++++----- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 4d8bb3e54..ce05af0cd 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -56,7 +56,7 @@ class TestWindowsPslist: "Wow64": False, "__children": [], } - assert test_volatility.match_output_row(json.loads(out), expected_row) + assert test_volatility.match_output_row(expected_row, json.loads(out)) class TestWindowsPsscan: diff --git a/test/test_volatility.py b/test/test_volatility.py index c376d3ccc..632a6bcde 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -72,23 +72,25 @@ def runvolshell(img, volshell, python, volshellargs=None, globalargs=None): def match_output_row( - json_out: List[dict], expected_row: dict, exact_match: bool = False + expected_row: dict, plugin_json_out: List[dict], exact_match: bool = False ): """Search each row of a plugin's JSON output for an expected row. Each row is a dict. Args: - json_out: The plugin's output in JSON format (typically obtained through -r json and json.loads) expected_row: The expected row to be found in the output + plugin_json_out: The plugin's output in JSON format (typically obtained through -r json and json.loads) exact_match: Whether to require exactly the expected row, no more no less, or to anticipate columns' addition by checking only the expected row keys and values """ if not exact_match: - for row in json_out: - if all(item in expected_row.items() for item in row.items()): + for row in plugin_json_out: + if all( + expected_item in row.items() for expected_item in expected_row.items() + ): return True else: - for row in json_out: + for row in plugin_json_out: if expected_row == row: return True From 4d7f1ea311fc75586445fc3415eea9b1a72e4f57 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 22:33:53 +0000 Subject: [PATCH 0647/1352] Fix several bugs in IDT verification for Linux --- .../framework/plugins/linux/check_idt.py | 81 +++++++++++++------ 1 file changed, 55 insertions(+), 26 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index ffb707af5..653ecc081 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -3,7 +3,7 @@ # import logging -from typing import List +from typing import List, Optional import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.framework import interfaces, renderers, symbols @@ -20,6 +20,9 @@ class Check_idt(interfaces.plugins.PluginInterface): _required_framework_version = (2, 0, 0) + # 2.0.0 - Add versioning at all, add `get_idt_type` + _version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ @@ -41,7 +44,42 @@ class Check_idt(interfaces.plugins.PluginInterface): ), ] + @staticmethod + def get_idt_type(context, vmlinux_name) -> Optional[str]: + """ + Determines the IDT type for this symbol table or returns None + + The original version ended clauses with an `else` leading to bad fall through + of returning a type that did not exist in the symbol table. + + Future updates should not leave fall through cases to avoid this repeating. + """ + + vmlinux = context.modules[vmlinux_name] + + is_32bit = not symbols.symbol_table_is_64bit(context, vmlinux.symbol_table_name) + + # These are in a specific order. Only append to the lists going forward + # or ask Andrew to run tests before merging. + if is_32bit: + idt_types = ["gate_struct", "desc_struct", "gate_struct32"] + else: + idt_types = ["gate_struct64", "gate_struct", "idt_desc"] + + for idt_type in idt_types: + if vmlinux.has_type(idt_type): + return idt_type + + return None + def _generator(self): + idt_type = self.get_idt_type(self.context, self.config["kernel"]) + if not idt_type: + vollog.error( + "Unable to determine the data structure type for IDT entries. Please file a bug on the GitHub tracker with your kernel version." + ) + return + vmlinux = self.context.modules[self.config["kernel"]] modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name) @@ -50,30 +88,15 @@ class Check_idt(interfaces.plugins.PluginInterface): self.context, vmlinux.name, modules ) - is_32bit = not symbols.symbol_table_is_64bit( - self.context, vmlinux.symbol_table_name - ) - idt_table_size = 256 - address_mask = self.context.layers[vmlinux.layer_name].address_mask + kernel_layer = self.context.layers[vmlinux.layer_name] + + address_mask = kernel_layer.address_mask # hw handlers + system call check_idxs = list(range(20)) + [128] - if is_32bit: - if vmlinux.has_type("gate_struct"): - idt_type = "gate_struct" - else: - idt_type = "desc_struct" - else: - if vmlinux.has_type("gate_struct64"): - idt_type = "gate_struct64" - elif vmlinux.has_type("gate_struct"): - idt_type = "gate_struct" - else: - idt_type = "idt_desc" - addrs = vmlinux.object_from_symbol("idt_table") table = vmlinux.object( @@ -87,15 +110,16 @@ class Check_idt(interfaces.plugins.PluginInterface): for i in check_idxs: ent = table[i] - if not ent: + if not ent or not kernel_layer.is_valid(ent.vol.offset): continue - if hasattr(ent, "Address"): - idt_addr = ent.Address + if hasattr(ent, "a"): + idt_addr = (ent.b & 0xFFFF0000) | (ent.a & 0x0000FFFF) else: low = ent.offset_low middle = ent.offset_middle + # offset_high is for 64bit systems if hasattr(ent, "offset_high"): high = ent.offset_high else: @@ -105,11 +129,16 @@ class Check_idt(interfaces.plugins.PluginInterface): idt_addr = idt_addr & address_mask - module_name, symbol_name = ( - linux_utilities_modules.Modules.lookup_module_address( - self.context, vmlinux.name, handlers, idt_addr + # 0 means unintialized/unused, not a rootkit + if idt_addr == 0: + module_name = renderers.NotAvailableValue() + symbol_name = renderers.NotAvailableValue() + else: + module_name, symbol_name = ( + linux_utilities_modules.Modules.lookup_module_address( + self.context, vmlinux.name, handlers, idt_addr + ) ) - ) yield ( 0, From 6036cbd3e0250aa98c29f6af469b88738224cee4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 22:42:07 +0000 Subject: [PATCH 0648/1352] Correctly use decode with replace to avoid backtraces on partially smeared strings --- volatility3/framework/plugins/linux/envars.py | 4 +++- volatility3/framework/plugins/linux/psaux.py | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index cc43c4130..0687caa9f 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -95,7 +95,9 @@ class Envars(plugins.PluginInterface): envar_data = envar_data.rstrip(b"\x00") for envar_pair in envar_data.split(b"\x00"): try: - env_key, env_value = envar_pair.decode().split("=", 1) + env_key, env_value = envar_pair.decode( + encoding="utf8", errors="replace" + ).split("=", 1) except ValueError: # Some legitimate programs, like 'avahi-daemon', avoid reallocating the args # and instead exploit the fact that the environment variables area is contiguous diff --git a/volatility3/framework/plugins/linux/psaux.py b/volatility3/framework/plugins/linux/psaux.py index a544c9d67..1a118dba6 100644 --- a/volatility3/framework/plugins/linux/psaux.py +++ b/volatility3/framework/plugins/linux/psaux.py @@ -78,7 +78,7 @@ class PsAux(plugins.PluginInterface): return renderers.UnreadableValue() # the arguments are null byte terminated, replace the nulls with spaces - s = argv.decode().split("\x00") + s = argv.decode(encoding="utf8", errors="replace").split("\x00") args = " ".join(s) else: # kernel thread From e5b0c8453210282895f859fc6474e0a70d01056a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:05:36 +0000 Subject: [PATCH 0649/1352] Prevent backtraces in netfilter due to smear --- .../framework/plugins/linux/netfilter.py | 29 +++++++++++++++---- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index c12c99d1e..9c8c9feb0 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -6,7 +6,7 @@ from abc import ABC, abstractmethod import logging import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from typing import Iterator, List, Tuple +from typing import Iterator, List, Tuple, Optional from volatility3 import framework from volatility3.framework import ( constants, @@ -245,7 +245,9 @@ class AbstractNetfilter(ABC): for hook_idx, hook_name in enumerate(proto.hooks): yield proto_idx, proto.name, hook_idx, hook_name - def build_nf_hook_ops_array(self, nf_hook_entries): + def build_nf_hook_ops_array( + self, nf_hook_entries + ) -> Optional[interfaces.objects.ObjectInterface]: """Function helper to build the nf_hook_ops array when it is not part of the struct 'nf_hook_entries' definition. @@ -260,16 +262,27 @@ class AbstractNetfilter(ABC): } """ nf_hook_entry_size = self.vmlinux.get_type("nf_hook_entry").size + + try: + num_hook_entries = nf_hook_entries.num_hook_entries + except exceptions.InvalidAddressException: + return None + orig_ops_addr = ( - nf_hook_entries.hooks.vol.offset - + nf_hook_entry_size * nf_hook_entries.num_hook_entries + nf_hook_entries.hooks.vol.offset + nf_hook_entry_size * num_hook_entries ) + + if not self.vmlinux._context.layers[self.vmlinux.layer_name].is_valid( + orig_ops_addr + ): + return None + orig_ops = self._context.object( object_type=self.get_symbol_fullname("array"), offset=orig_ops_addr, subtype=self.vmlinux.get_type("pointer"), layer_name=self.layer_name, - count=nf_hook_entries.num_hook_entries, + count=num_hook_entries, ) return orig_ops @@ -515,6 +528,9 @@ class NetfilterImp_4_14_to_4_16(AbstractNetfilter): nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries) + if not nf_hook_ops_ptr_arr: + return + for nf_hook_ops_ptr in nf_hook_ops_ptr_arr: nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name) yield nf_hook_ops @@ -695,6 +711,9 @@ class NetfilterNetDevImp_4_14_to_latest(AbstractNetfilterNetDev): nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries) + if not nf_hook_ops_ptr_arr: + return + for nf_hook_ops_ptr in nf_hook_ops_ptr_arr: nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name) yield nf_hook_ops From 86ef99f57a76763c3e35b99fb950a5ab2193f0a3 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:10:27 +0000 Subject: [PATCH 0650/1352] Properly decode values from ELF files even with partial smear --- volatility3/framework/symbols/linux/extensions/elf.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index 89a421402..f2bfa89bd 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -446,7 +446,7 @@ class elf_linkmap(objects.StructType): idx = buf.find(b"\x00") if idx != -1: buf = buf[:idx] - return buf.decode() + return buf.decode("utf-8", errors="ignore") class_types = { From bfab5bfd235b5d5e308b945e3fa339de2c297fed Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:11:37 +0000 Subject: [PATCH 0651/1352] Properly decode values from ELF files even with partial smear --- volatility3/framework/symbols/linux/extensions/elf.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index f2bfa89bd..7105a05ea 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -340,7 +340,7 @@ class elf_sym(objects.StructType): if idx != -1: name_bytes = name_bytes[:idx] - return name_bytes.decode("utf-8", errors="ignore") + return name_bytes.decode("utf-8", errors="replace") class elf_phdr(objects.StructType): @@ -446,7 +446,7 @@ class elf_linkmap(objects.StructType): idx = buf.find(b"\x00") if idx != -1: buf = buf[:idx] - return buf.decode("utf-8", errors="ignore") + return buf.decode("utf-8", errors="replace") class_types = { From 86fa9d855698711910786a2d62ab153eb991fe88 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:15:14 +0000 Subject: [PATCH 0652/1352] Ensure slot address is valid inside of array --- volatility3/framework/symbols/linux/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 5f6a66860..8c2288c13 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -702,7 +702,11 @@ class IDStorage(ABC): node = self.nodep_to_node(nodep) node_slots = node.slots for off in range(self.CHUNK_SIZE): - slot = node_slots[off] + try: + slot = node_slots[off] + except exceptions.InvalidAddressException: + continue + if slot == 0: continue From 3141a741ebd3b7fe921fcd29e21be402eecd96be Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:21:21 +0000 Subject: [PATCH 0653/1352] Gracefully terminate the plugin when the keyboard notifier list head is paged out --- volatility3/framework/plugins/linux/keyboard_notifiers.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index 8577de848..726280cbe 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -61,6 +61,10 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) + if not self.context.layers[vmlinux.layer_name].is_valid(knl_addr.vol.offset): + vollog.error("The head of the keyboard notifier list is paged out.") + return + knl = vmlinux.object( object_type="atomic_notifier_head", offset=knl_addr.vol.offset, From 56d7398fe50c3a0d4eca99fb24bbb530c1f66168 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:25:52 +0000 Subject: [PATCH 0654/1352] Prevent backtraces when the node head is smeared --- volatility3/framework/symbols/linux/__init__.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 5f6a66860..6e8a44db1 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -669,7 +669,7 @@ class IDStorage(ABC): raise NotImplementedError @abstractmethod - def get_head_node(self, tree) -> int: + def get_head_node(self, tree) -> Optional[int]: """Returns a pointer to the tree's head""" raise NotImplementedError @@ -763,8 +763,11 @@ class XArray(IDStorage): node = self.nodep_to_node(nodep) return (node.shift // self.CHUNK_SHIFT) + 1 - def get_head_node(self, tree) -> int: - return tree.xa_head + def get_head_node(self, tree) -> Optional[int]: + try: + return tree.xa_head + except exceptions.InvalidAddressException: + return None def node_is_internal(self, nodep) -> bool: return (nodep & self.XARRAY_TAG_MASK) == self.XARRAY_TAG_INTERNAL @@ -872,8 +875,11 @@ class RadixTree(IDStorage): return height - def get_head_node(self, tree) -> int: - return tree.rnode + def get_head_node(self, tree) -> Optional[int]: + try: + return tree.rnode + except exceptions.InvalidAddressException: + return None def node_is_internal(self, nodep) -> bool: return (nodep & self.RADIX_TREE_INTERNAL_NODE) != 0 From 437c611cb9a01e24323fbcb225b757280334c5aa Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 5 Mar 2025 23:45:38 +0000 Subject: [PATCH 0655/1352] Avoid smear in module enumeration paths --- volatility3/framework/plugins/linux/check_modules.py | 6 +++++- .../framework/symbols/linux/utilities/tainting.py | 10 ++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 0ed638d9c..23da29680 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -65,7 +65,11 @@ class Check_modules(plugins.PluginInterface): mod = mod_kobj.mod - name = utility.pointer_to_string(kobj.name, 32) + try: + name = utility.pointer_to_string(kobj.name, 32) + except exceptions.InvalidAddressException: + continue + if kobj.name and kobj.reference_count() > 2: ret[name] = mod diff --git a/volatility3/framework/symbols/linux/utilities/tainting.py b/volatility3/framework/symbols/linux/utilities/tainting.py index 2360401d5..cb81ab1a3 100644 --- a/volatility3/framework/symbols/linux/utilities/tainting.py +++ b/volatility3/framework/symbols/linux/utilities/tainting.py @@ -93,8 +93,14 @@ class Tainting(interfaces.configuration.VersionableInterface): ): if is_module and not taint_flag.module: continue - c_true = chr(taint_flag.c_true) - c_false = chr(taint_flag.c_false) + + try: + c_true = chr(taint_flag.c_true) + c_false = chr(taint_flag.c_false) + except ValueError: + # thrown when the c_true or c_false values are out of range + continue + if taints & (1 << taint_bit): taints_string += c_true elif c_false != " ": From b92247fe32e8c4a2340683c5934465c70b6d8cf4 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 3 Sep 2024 18:56:03 -0500 Subject: [PATCH 0656/1352] Windows: Adds windows GUI vtypes --- .../windows/gui/gui-win10-10586-x64.json | 18787 +++++++++++++++ .../windows/gui/gui-win10-15063-x64.json | 18787 +++++++++++++++ .../windows/gui/gui-win10-16299-x64.json | 18787 +++++++++++++++ .../windows/gui/gui-win10-17134-x64.json | 18830 ++++++++++++++++ .../windows/gui/gui-win10-17763-x64.json | 18830 ++++++++++++++++ .../windows/gui/gui-win10-18362-x64.json | 18830 ++++++++++++++++ .../windows/gui/gui-win10-19041-x64.json | 18830 ++++++++++++++++ .../windows/gui/gui-win10-19577-x64.json | 18830 ++++++++++++++++ .../symbols/windows/gui/gui-win7sp0-x64.json | 18683 +++++++++++++++ .../symbols/windows/gui/gui-win7sp1-x64.json | 18680 +++++++++++++++ .../symbols/windows/gui/gui-win8-x64.json | 18743 +++++++++++++++ 11 files changed, 206617 insertions(+) create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json create mode 100644 volatility3/framework/symbols/windows/gui/gui-win8-x64.json diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json new file mode 100644 index 000000000..5f280725c --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json @@ -0,0 +1,18787 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 656 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 440 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 784 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 784 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 216 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 160 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json new file mode 100644 index 000000000..26e7356b9 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json @@ -0,0 +1,18787 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 792 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 656 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 440 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 776 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json new file mode 100644 index 000000000..bde774987 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json @@ -0,0 +1,18787 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 880 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 712 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 464 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 784 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json new file mode 100644 index 000000000..cd5ca7169 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json @@ -0,0 +1,18830 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 880 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 728 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 464 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 824 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json new file mode 100644 index 000000000..00d3f61f3 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json @@ -0,0 +1,18830 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 896 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 480 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 824 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json new file mode 100644 index 000000000..dc458970e --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json @@ -0,0 +1,18830 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 904 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 480 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 824 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json new file mode 100644 index 000000000..09f518451 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json @@ -0,0 +1,18830 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 896 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 480 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 832 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json new file mode 100644 index 000000000..5c9f4d814 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json @@ -0,0 +1,18830 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 904 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 480 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 832 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json b/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json new file mode 100644 index 000000000..6c2e7dd17 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json @@ -0,0 +1,18683 @@ +{ + "symbols": {}, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + }, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 552 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 384 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 344 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 608 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 408 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 736 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 344 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "bType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 216 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json b/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json new file mode 100644 index 000000000..76e3d8100 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json @@ -0,0 +1,18680 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 552 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 384 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 344 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 608 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 408 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 736 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 344 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_180f": { + "fields": { + "Data": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "bType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fAssigned": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 216 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/gui/gui-win8-x64.json b/volatility3/framework/symbols/windows/gui/gui-win8-x64.json new file mode 100644 index 000000000..3f3193e35 --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win8-x64.json @@ -0,0 +1,18743 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 552 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 736 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 640 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 408 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 384 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 344 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "f32" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 216 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 160 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} From 319edbb486a9be534364fdb6157e28512f618c3a Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 4 Sep 2024 11:38:38 -0500 Subject: [PATCH 0657/1352] Windows: Adds windows OS version checks --- .../framework/symbols/windows/versions.py | 53 ++++++++++++++++++- 1 file changed, 51 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py index 495655681..6b5b9846a 100644 --- a/volatility3/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -1,7 +1,7 @@ import logging -from typing import Callable, Tuple, List, Optional +from typing import Callable, List, Optional, Tuple -from volatility3.framework import interfaces, constants, exceptions +from volatility3.framework import constants, exceptions, interfaces vollog = logging.getLogger(__name__) @@ -187,6 +187,22 @@ is_win10_16299_or_later = OsDistinguisher( ], ) +is_win10_17134_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 17134), + fallback_checks=[ + ("_EPROCESS", "ProcessFirstResume", True), + ("_EPROCESS", "HighMemoryPriority", True), + ], +) + +is_win10_10586_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 10586), + fallback_checks=[ + ("_EPROCESS", "SecurityDomain", False), + ("_EPROCESS", "ImageFilePointer", False), + ], +) + is_win10_17763_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 17763), fallback_checks=[ @@ -218,6 +234,14 @@ is_win10_19041_or_later = OsDistinguisher( ], ) +is_win10_19577_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 19577), + fallback_checks=[ + ("_EPROCESS", "PaeTop", False), + ("_EPROCESS", "IdealProcessorAssignmentBlock", True), + ], +) + is_win10_25398_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 25398), fallback_checks=[ @@ -235,6 +259,31 @@ is_windows_8_or_later = OsDistinguisher( version_check=lambda x: x >= (6, 2), fallback_checks=[("_HANDLE_TABLE", "HandleCount", False)], ) + +is_windows_7_sp0 = OsDistinguisher( + version_check=lambda x: x == (6, 1, 7600), + fallback_checks=[ + ("_EPROCESS", "VdmObjects", True), + ("_EPROCESS", "UmsScheduledThreads", False), + # Dropped after vista + ("_EPROCESS", "QuotaUsage", False), + # Added win8 + ("_EPROCESS", "WnfContext", False), + ], +) + +is_windows_7_sp1 = OsDistinguisher( + version_check=lambda x: x == (6, 1, 7601), + fallback_checks=[ + ("_EPROCESS", "VdmObjects", False), + ("_EPROCESS", "UmsScheduledThreads", True), + # Dropped after vista + ("_EPROCESS", "QuotaUsage", False), + # Added win8 + ("_EPROCESS", "WnfContext", False), + ], +) + # Technically, this is win7 or less is_windows_7 = OsDistinguisher( version_check=lambda x: x == (6, 1), From 59919dc1daa43e912f13a16cc8b12c0b3e66ae25 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 4 Sep 2024 11:38:56 -0500 Subject: [PATCH 0658/1352] Windows: Adds GUI plugin --- volatility3/framework/plugins/windows/gui.py | 114 +++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100644 volatility3/framework/plugins/windows/gui.py diff --git a/volatility3/framework/plugins/windows/gui.py b/volatility3/framework/plugins/windows/gui.py new file mode 100644 index 000000000..1cce5b7f3 --- /dev/null +++ b/volatility3/framework/plugins/windows/gui.py @@ -0,0 +1,114 @@ +# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import os +from itertools import count +from typing import List, Tuple + +from volatility3.framework import interfaces, renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions + +# from volatility3.plugins.windows import pslist, vadinfo, modules + +vollog = logging.getLogger(__name__) + + +class WinGUI(interfaces.plugins.PluginInterface): + """Parses information about Windows GUI Objects""" + + _required_framework_version = (2, 0, 0) + + # These checks must be completed from newest -> oldest OS version. + _win_version_file_map: List[Tuple[versions.OsDistinguisher, str]] = [ + (versions.is_win10_19577_or_later, "gui-win10-19577-x64"), + (versions.is_win10_19041_or_later, "gui-win10-19041-x64"), + (versions.is_win10_18362_or_later, "gui-win10-18362-x64"), + (versions.is_win10_17763_or_later, "gui-win10-17763-x64"), + (versions.is_win10_17134_or_later, "gui-win10-17134-x64"), + (versions.is_win10_16299_or_later, "gui-win10-16299-x64"), + (versions.is_win10_15063_or_later, "gui-win10-15063-x64"), + (versions.is_win10_10586_or_later, "gui-win10-10586-x64"), + (versions.is_windows_8_or_later, "gui-win8-x64"), + (versions.is_windows_7_sp1, "gui-win7sp1-x64"), + (versions.is_windows_7_sp0, "gui-win7sp0-x64"), + ] + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + ] + + @staticmethod + def create_gui_table( + context: interfaces.context.ContextInterface, + symbol_table: str, + config_path: str, + ) -> str: + """Creates a symbol table for windows GUI types + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + symbol_table: The name of an existing symbol table containing the kernel symbols + config_path: The configuration path within the context of the symbol table to create + + Returns: + The name of the constructed GUI table + """ + native_types = context.symbol_space[symbol_table].natives + + if not symbols.symbol_table_is_64bit(context, symbol_table): + raise NotImplementedError( + "This plugin only supports x64 versions of Windows" + ) + + table_mapping = {"nt_symbols": symbol_table} + + try: + symbol_filename = next( + filename + for version_check, filename in WinGUI._win_version_file_map + if version_check(context=context, symbol_table=symbol_table) + ) + except StopIteration: + raise NotImplementedError("This version of Windows is not supported!") + + vollog.debug(f"Using GUI table {symbol_filename}") + + return intermed.IntermediateSymbolTable.create( + context, + config_path, + os.path.join("windows", "gui"), + symbol_filename, + native_types=native_types, + table_mapping=table_mapping, + ) + + def _generator(self): + kernel = self.context.modules[self.config["kernel"]] + + gui_table = self.create_gui_table( + self.context, kernel.symbol_table_name, self.config_path + ) + + c = count() + for _ in range(10): + yield ( + 0, + (next(c), tuple()), + ) + + def run(self): + return renderers.TreeGrid( + [], + self._generator(), + ) From 5cbc07887c2a26fd58b3866fb76adfa72019ab7b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 14:33:29 -0600 Subject: [PATCH 0659/1352] Windows PsList: Add method for listing procs from kernel This adds a new classmethod, `list_processes_from_kernel`, updates the `list_processes` method signature to use only the kernel module name and the context instead of splitting information about the kernel between the layer_name and symbol_table_name paramters, and does a major version number increase on the plugin. Also updates the documentation to reflect pslist method signature change. Co-authored-by: Andrew Case --- doc/source/simple-plugin.rst | 8 +++--- .../framework/plugins/windows/pslist.py | 26 ++++++++++++------- 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index 07d9e1467..a6916a027 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -198,7 +198,6 @@ that will be output as part of the :py:class:`~volatility3.framework.interfaces. def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get('pid', None)) - kernel = self.context.modules[self.config['kernel']] return renderers.TreeGrid( [ @@ -211,9 +210,8 @@ that will be output as part of the :py:class:`~volatility3.framework.interfaces. ], self._generator( pslist.PsList.list_processes( - self.context, - kernel.layer_name, - kernel.symbol_table_name, + context=self.context, + kernel_module_name=self.config['kernel'], filter_func = filter_func ) ) @@ -235,7 +233,7 @@ the :py:class:`~volatility3.plugins.windows.pslist.PsList` plugin. That plugin so that other plugins can call it. As such, it takes all the necessary parameters rather than accessing them from a configuration. Since it must be portable code, it takes a context, as well as the layer name, symbol table and optionally a filter. In this instance we unconditionally -pass it the values from the configuration for the layer and symbol table from the kernel module object, constructed from +pass it the value from the configuration for the kernel module name, constructed from the ``kernel`` configuration requirement. This will generate a list of :py:class:`~volatility3.framework.symbols.windows.extensions.EPROCESS` objects, as provided by the :py:class:`~volatility.plugins.windows.pslist.PsList` plugin, and is not covered here but is used as an example for how to share code across plugins diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 3d3f12869..7909945a1 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -22,7 +22,9 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + + # 3.0.0 - changed signature for `list_processes` + _version = (3, 0, 0) PHYSICAL_DEFAULT = False @classmethod @@ -206,32 +208,37 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def list_processes( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, filter_func: Callable[ [interfaces.objects.ObjectInterface], bool ] = lambda _: False, ) -> Iterator["extensions.EPROCESS"]: - """Lists all the processes in the primary layer that are in the pid + """Lists all the processes in the given layer that are in the pid config option. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + layer_iname: The name of the layer on which to operate + symbol_table_name: The name of the table containing the kernel symbols filter_func: A function which takes an EPROCESS object and returns True if the process should be ignored/filtered Returns: The list of EPROCESS objects from the `layer_name` layer's PsActiveProcessHead list after filtering """ + kernel = context.modules[kernel_module_name] + # We only use the object factory to demonstrate how to use one - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + kvo = context.layers[kernel.layer_name].config.get( + "kernel_virtual_offset", None + ) if not kvo: raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.module( + kernel.symbol_table_name, layer_name=kernel.layer_name, offset=kvo + ) ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address list_entry = ntkrnlmp.object(object_type="_LIST_ENTRY", offset=ps_aph_offset) @@ -273,8 +280,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): for proc in self.list_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=self.create_pid_filter(self.config.get("pid", None)), ): if not self.config.get("physical", self.PHYSICAL_DEFAULT): From 2f016d7403519ed86913cd437e6fdd7cdb96f69c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 14:27:39 -0600 Subject: [PATCH 0660/1352] Windows Modules/Modscan: Clean up APIs This cleans up the APIs for some methods in the modscan/modules plugins that currently take separate symbol_table_name and layer_name parameters, when it really makes more sense to just pass in the context and the kernel module name. It also updates the pslist plugin requirement version, and uses the updated method signatures. Co-authored-by: Andrew Case --- .../framework/plugins/windows/modscan.py | 21 ++-- .../framework/plugins/windows/modules.py | 106 +++++++++++++----- 2 files changed, 88 insertions(+), 39 deletions(-) diff --git a/volatility3/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py index fc45e6913..76c30ac9c 100644 --- a/volatility3/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -15,7 +15,9 @@ class ModScan(modules.Modules): """Scans for modules present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + + # 3.0.0 changed the signature of enumeration methods (scan_modules) + _version = (3, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -33,7 +35,7 @@ class ModScan(modules.Modules): name="poolscanner", component=poolscanner.PoolScanner, version=(1, 0, 0) ), requirements.VersionRequirement( - name="modules", component=modules.Modules, version=(2, 0, 0) + name="modules", component=modules.Modules, version=(3, 0, 0) ), requirements.BooleanRequirement( name="dump", @@ -61,26 +63,25 @@ class ModScan(modules.Modules): def scan_modules( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for modules using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols - + kernel_module_name: Name of the module for the kernel Returns: - A list of Driver objects as found from the `layer_name` layer based on Driver pool signatures + A list of kernel module objects as found from the primary (kernel) layer based on module pool signatures """ + kernel = context.modules[kernel_module_name] + constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"MmLd"] + kernel.symbol_table_name, [b"MmLd"] ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, kernel.layer_name, kernel.symbol_table_name, constraints ): _constraint, mem_object, _header = result yield mem_object diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 44a67f472..c4f6af4bc 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import Generator, Iterable, List, Optional +from typing import Generator, Iterable, List, Optional, Dict from volatility3.framework import symbols, constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -18,7 +18,9 @@ class Modules(interfaces.plugins.PluginInterface): """Lists the loaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (2, 1, 0) + + # 3.0.0 - changed signature of get_session_layers, added get_session_layers_map + _version = (3, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -33,7 +35,7 @@ class Modules(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.BooleanRequirement( name="dump", @@ -76,8 +78,6 @@ class Modules(interfaces.plugins.PluginInterface): return file_output def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - pe_table_name = None session_layers = None @@ -92,13 +92,12 @@ class Modules(interfaces.plugins.PluginInterface): session_layers = list( self.get_session_layers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ) ) - for mod in self._enumeration_method( - self.context, kernel.layer_name, kernel.symbol_table_name - ): + for mod in self._enumeration_method(self.context, self.config["kernel"]): if self.config["base"] and self.config["base"] != mod.DllBase: continue @@ -163,11 +162,10 @@ class Modules(interfaces.plugins.PluginInterface): return kernel_space_start & layer.address_mask @classmethod - def get_session_layers( + def _do_get_session_layers( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, pids: Optional[List[int]] = None, ) -> Generator[str, None, None]: """Build a cache of possible virtual layers, in priority starting with @@ -176,20 +174,20 @@ class Modules(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel pids: A list of process identifiers to include exclusively or None for no filter Returns: - A list of session layer names + A generator of session layer names """ seen_ids: List[interfaces.objects.ObjectInterface] = [] filter_func = pslist.PsList.create_pid_filter(pids or []) + kernel = context.modules[kernel_module_name] + for proc in pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table, + context, + kernel_module_name, filter_func=filter_func, ): proc_id = "Unknown" @@ -201,8 +199,8 @@ class Modules(interfaces.plugins.PluginInterface): # not all processes have a valid session pointer. try: session_space = context.object( - symbol_table + constants.BANG + "_MM_SESSION_SPACE", - layer_name=layer_name, + kernel.symbol_table_name + constants.BANG + "_MM_SESSION_SPACE", + layer_name=kernel.layer_name, offset=proc.Session, ) session_id = session_space.SessionId @@ -218,8 +216,10 @@ class Modules(interfaces.plugins.PluginInterface): # create an unsigned long at that offset and use that # instead. session_id = context.object( - layer_name=layer_name, - object_type=symbol_table + constants.BANG + "unsigned long", + layer_name=kernel.layer_name, + object_type=kernel.symbol_table_name + + constants.BANG + + "unsigned long", offset=proc.Session + 8, ) @@ -235,8 +235,53 @@ class Modules(interfaces.plugins.PluginInterface): # save the layer if we haven't seen the session yet seen_ids.append(session_id) + yield session_id, proc_layer_name + + @classmethod + def get_session_layers( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + pids: Optional[List[int]] = None, + ) -> Generator[str, None, None]: + """ + Args: + context: The context to retrieve required elements (layers, symbol tables) from + kernel_module_name: The name of the module for the kernel + pids: A list of process identifiers to include exclusively or None for no filter + + Yields the names of the unique memory layers that map sessions + """ + for _session_id, proc_layer_name in cls._do_get_session_layers( + context, kernel_module_name, pids + ): yield proc_layer_name + @classmethod + def get_session_layers_map( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + pids: Optional[List[int]] = None, + ) -> Dict[int, str]: + """ + Args: + context: The context to retrieve required elements (layers, symbol tables) from + kernel_module_name: The name of the module for the kernel + pids: A list of process identifiers to include exclusively or None for no filter + + Wraps `_do_get_session_layers` to produce a dictionary where each key is a session_id + and the value is the name of the layer for that session + """ + sessions: Dict[int, str] = {} + + for session_id, proc_layer_name in cls._do_get_session_layers( + context, kernel_module_name, pids + ): + sessions[session_id] = proc_layer_name + + return sessions + @classmethod def find_session_layer( cls, @@ -268,26 +313,29 @@ class Modules(interfaces.plugins.PluginInterface): def list_modules( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Lists all the modules in the primary layer. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols - + kernel_module_name: The name of the module for the kernel Returns: A list of Modules as retrieved from PsLoadedModuleList """ - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) + kernel = context.modules[kernel_module_name] + + kvo = context.layers[kernel.layer_name].config.get( + "kernel_virtual_offset", None + ) if not kvo: raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.module( + kernel.symbol_table_name, layer_name=kernel.layer_name, offset=kvo + ) try: # use this type if its available (starting with windows 10) From 9239742b6fac559faf56d5ff6760ede66645136a Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 11:42:54 -0600 Subject: [PATCH 0661/1352] Windows SSDT: Simplify `build_module_collection` signature This simplifies the `build_module_collection` signature to take a single `kernel_module_name` parameter instead of `layer_name` and `symbol_table_name` parameters, both of which would only ever belong to the kernel anyway. This will prevent future confusion for consumers of this method. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/ssdt.py | 26 +++++++++---------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index d6ec11286..4e4773ffa 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -19,7 +19,9 @@ class SSDT(plugins.PluginInterface): """Lists the system call table.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + + # 2.0.0 - changed the signature of `build_module_collection` + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -38,23 +40,23 @@ class SSDT(plugins.PluginInterface): def build_module_collection( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> contexts.ModuleCollection: """Builds a collection of modules. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: Name of the module for the kernel Returns: A Module collection of available modules based on `Modules.list_modules` """ - mods = modules.Modules.list_modules(context, layer_name, symbol_table) + mods = modules.Modules.list_modules(context, kernel_module_name) context_modules = [] + kernel = context.modules[kernel_module_name] + for mod in mods: try: module_name_with_ext = mod.BaseDllName.get_string() @@ -64,17 +66,13 @@ class SSDT(plugins.PluginInterface): module_name = os.path.splitext(module_name_with_ext)[0] - symbol_table_name = None - if module_name in constants.windows.KERNEL_MODULE_NAMES: - symbol_table_name = symbol_table - context_module = contexts.SizedModule.create( context=context, module_name=module_name, - layer_name=layer_name, + layer_name=kernel.layer_name, offset=mod.DllBase, size=mod.SizeOfImage, - symbol_table_name=symbol_table_name, + symbol_table_name=kernel.symbol_table_name, ) context_modules.append(context_module) @@ -84,9 +82,9 @@ class SSDT(plugins.PluginInterface): def _generator(self) -> Iterator[Tuple[int, Tuple[int, int, Any, Any]]]: kernel = self.context.modules[self.config["kernel"]] - layer_name = kernel.layer_name collection = self.build_module_collection( - self.context, layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ) ntkrnlmp = kernel From 5cc0ea967ff33b26d2031fc8d9d84b069beda6f6 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 13:41:28 -0600 Subject: [PATCH 0662/1352] Windows SSDT: Updates plugin consumers Updates all plugins that use the `ssdt` module with correct parameters and updated version requirement values. --- volatility3/framework/plugins/windows/callbacks.py | 4 ++-- volatility3/framework/plugins/windows/driverirp.py | 6 ++---- .../framework/plugins/windows/drivermodule.py | 6 ++---- .../plugins/windows/orphan_kernel_threads.py | 10 ++-------- .../plugins/windows/registry/getcellroutine.py | 6 ++---- volatility3/framework/plugins/windows/timers.py | 13 ++++++++----- 6 files changed, 18 insertions(+), 27 deletions(-) diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 7bb90863d..035ed9091 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -39,7 +39,7 @@ class Callbacks(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) @@ -691,7 +691,7 @@ class Callbacks(interfaces.plugins.PluginInterface): ) collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) callback_methods = ( diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index a1959453a..413ea782f 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -59,7 +59,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) @@ -70,10 +70,8 @@ class DriverIrp(interfaces.plugins.PluginInterface): ] def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) kernel_space_start = modules.Modules.get_kernel_space_start( diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index db1255637..c6547aae0 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -26,7 +26,7 @@ class DriverModule(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) @@ -42,10 +42,8 @@ class DriverModule(interfaces.plugins.PluginInterface): A common rootkit technique is to register drivers from modules that are hidden, which allows us to detect the disconnect between a malicious driver and its hidden module. """ - kernel = self.context.modules[self.config["kernel"]] - collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) kernel_space_start = modules.Modules.get_kernel_space_start( diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 18e087553..98e5781ae 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -35,7 +35,7 @@ class Threads(thrdscan.ThrdScan): name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="modules", plugin=modules.Modules, version=(2, 1, 0) @@ -57,13 +57,7 @@ class Threads(thrdscan.ThrdScan): Returns: A generator of thread objects of orphaned threads """ - module = context.modules[module_name] - layer_name = module.layer_name - symbol_table_name = module.symbol_table_name - - collection = ssdt.SSDT.build_module_collection( - context, layer_name, symbol_table_name - ) + collection = ssdt.SSDT.build_module_collection(context, module_name) kernel_space_start = modules.Modules.get_kernel_space_start( context, module_name diff --git a/volatility3/framework/plugins/windows/registry/getcellroutine.py b/volatility3/framework/plugins/windows/registry/getcellroutine.py index 200a45a82..22374e205 100644 --- a/volatility3/framework/plugins/windows/registry/getcellroutine.py +++ b/volatility3/framework/plugins/windows/registry/getcellroutine.py @@ -31,15 +31,13 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), ] def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) # walk each hive and validate that the GetCellRoutine handler diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index cd8101a95..4bf574143 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -35,7 +35,7 @@ class Timers(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(1, 0, 0) + name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( name="kpcrs", plugin=kpcrs.KPCRs, version=(1, 0, 0) @@ -122,15 +122,18 @@ class Timers(interfaces.plugins.PluginInterface): def _generator(self) -> Iterator[Tuple]: kernel = self.context.modules[self.config["kernel"]] - layer_name = kernel.layer_name - symbol_table = kernel.symbol_table_name collection = ssdt.SSDT.build_module_collection( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ) + # FIXME - the list_timers API is gross. Fix after GUI merge for timer in self.list_timers( - self.context, self.config["kernel"], layer_name, symbol_table + self.context, + self.config["kernel"], + kernel.layer_name, + kernel.symbol_table_name, ): if not timer.valid_type(): continue From 6092e3ee0aae07f8019b6f6abad6b5190d6e5f84 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:10:22 -0600 Subject: [PATCH 0663/1352] Windows HiveList: Update list_hives method signature Co-authored-by: Andrew Case --- .../plugins/windows/registry/hivelist.py | 25 +++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index 36be35a68..60ac0445e 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -41,9 +41,11 @@ class HiveGenerator: class HiveList(interfaces.plugins.PluginInterface): """Lists the registry hives present in a particular memory image.""" - _version = (1, 0, 1) _required_framework_version = (2, 0, 0) + # 2.0.0 - changed the signature of list_hives + _version = (2, 0, 0) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ @@ -95,8 +97,7 @@ class HiveList(interfaces.plugins.PluginInterface): self.list_hives( self.context, self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.config["kernel"], hive_offsets=[hive_object.vol.offset], ) ) @@ -137,8 +138,7 @@ class HiveList(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, base_config_path: str, - layer_name: str, - symbol_table: str, + kernel_module_name: str, filter_string: Optional[str] = None, hive_offsets: Optional[List[int]] = None, ) -> Iterator[registry.RegistryHive]: @@ -148,20 +148,24 @@ class HiveList(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from base_config_path: The configuration path for any settings required by the new table - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel filter_string: An optional string which must be present in the hive name if specified offset: An optional offset to specify a specific hive to iterate over (takes precedence over filter_string) Yields: A registry hive layer name """ + kernel = context.modules[kernel_module_name] + if hive_offsets is None: try: hive_offsets = [ hive.vol.offset for hive in cls.list_hive_objects( - context, layer_name, symbol_table, filter_string + context, + kernel.layer_name, + kernel.symbol_table_name, + filter_string, ) ] except ImportError: @@ -178,8 +182,9 @@ class HiveList(interfaces.plugins.PluginInterface): context=context, base_config_path=base_config_path, hive_offset=hive_offset, - base_layer=layer_name, - nt_symbols=symbol_table, + base_layer=kernel.layer_name, + nt_symbols=kernel.symbol_table_name, + kernel_module_name=kernel_module_name, ) try: From 3a7e61b2855f4f6452008ae9ee3a5a4eeeeb1a37 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:25:06 -0600 Subject: [PATCH 0664/1352] Windows Hivelist: Update dependents This updates all plugins that depend on windows.hivelist.HiveList to use the updated method signature, and bumps their dependency version accordingly. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/cachedump.py | 6 ++---- volatility3/framework/plugins/windows/envars.py | 10 ++++------ .../framework/plugins/windows/getservicesids.py | 10 ++++------ volatility3/framework/plugins/windows/getsids.py | 10 ++++------ volatility3/framework/plugins/windows/hashdump.py | 6 ++---- volatility3/framework/plugins/windows/lsadump.py | 6 ++---- .../plugins/windows/registry/getcellroutine.py | 7 ++----- .../framework/plugins/windows/registry/printkey.py | 10 ++-------- .../framework/plugins/windows/registry/userassist.py | 10 ++++------ volatility3/plugins/windows/registry/certificates.py | 9 +++------ 10 files changed, 29 insertions(+), 55 deletions(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index f4f2e061e..5f5862e36 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -33,7 +33,7 @@ class Cachedump(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.PluginRequirement( name="lsadump", plugin=lsadump.Lsadump, version=(1, 0, 0) @@ -169,13 +169,11 @@ class Cachedump(interfaces.plugins.PluginInterface): offset = self.config.get("offset", None) syshive = sechive = None - kernel = self.context.modules[self.config["kernel"]] for hive in hivelist.HiveList.list_hives( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 61414778d..6ea95b33e 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -43,7 +43,7 @@ class Envars(interfaces.plugins.PluginInterface): name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -58,13 +58,11 @@ class Envars(interfaces.plugins.PluginInterface): """ values = [] - kernel = self.context.modules[self.config["kernel"]] for hive in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config_path, + self.config["kernel"], hive_offsets=None, ): ## The global variables diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 207d0e2ad..c222d55b1 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -69,18 +69,16 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] def _generator(self): - kernel = self.context.modules[self.config["kernel"]] # Get the system hive for hive in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config_path, + self.config["kernel"], filter_string="machine\\system", hive_offsets=None, ): diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index a75bbe7ea..53be50ba8 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -87,7 +87,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -101,14 +101,12 @@ class GetSIDs(interfaces.plugins.PluginInterface): key = "Microsoft\\Windows NT\\CurrentVersion\\ProfileList" val = "ProfileImagePath" - kernel = self.context.modules[self.config["kernel"]] sids = {} for hive in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config_path, + self.config["kernel"], filter_string="config\\software", hive_offsets=None, ): diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 1fea3d49d..5fdfd549f 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -32,7 +32,7 @@ class Hashdump(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -593,12 +593,10 @@ class Hashdump(interfaces.plugins.PluginInterface): offset = self.config.get("offset", None) syshive = None samhive = None - kernel = self.context.modules[self.config["kernel"]] for hive in hivelist.HiveList.list_hives( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 50f4da30d..eb83352e0 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -36,7 +36,7 @@ class Lsadump(interfaces.plugins.PluginInterface): name="hashdump", component=hashdump.Hashdump, version=(1, 1, 0) ), requirements.VersionRequirement( - name="hivelist", component=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -209,13 +209,11 @@ class Lsadump(interfaces.plugins.PluginInterface): def run(self): offset = self.config.get("offset", None) syshive = sechive = None - kernel = self.context.modules[self.config["kernel"]] for hive in hivelist.HiveList.list_hives( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/registry/getcellroutine.py b/volatility3/framework/plugins/windows/registry/getcellroutine.py index 22374e205..724ed1c9d 100644 --- a/volatility3/framework/plugins/windows/registry/getcellroutine.py +++ b/volatility3/framework/plugins/windows/registry/getcellroutine.py @@ -28,7 +28,7 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.PluginRequirement( name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) @@ -43,10 +43,7 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): # walk each hive and validate that the GetCellRoutine handler # is inside of the kernel (ntoskrnl) for hive_object in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, self.config_path, self.config["kernel"] ): hive = hive_object.hive diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index ed926805b..c14fcf507 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -31,7 +31,7 @@ class PrintKey(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.IntRequirement( name="offset", description="Hive Offset", default=None, optional=True @@ -240,8 +240,6 @@ class PrintKey(interfaces.plugins.PluginInterface): def _registry_walker( self, - layer_name: str, - symbol_table: str, hive_offsets: Optional[List[int]] = None, key: Optional[str] = None, recurse: bool = False, @@ -249,8 +247,7 @@ class PrintKey(interfaces.plugins.PluginInterface): for hive in hivelist.HiveList.list_hives( self.context, self.config_path, - layer_name=layer_name, - symbol_table=symbol_table, + self.config["kernel"], hive_offsets=hive_offsets, ): try: @@ -292,7 +289,6 @@ class PrintKey(interfaces.plugins.PluginInterface): def run(self): offset = self.config.get("offset", None) - kernel = self.context.modules[self.config["kernel"]] return TreeGrid( columns=[ @@ -305,8 +301,6 @@ class PrintKey(interfaces.plugins.PluginInterface): ("Volatile", bool), ], generator=self._registry_walker( - kernel.layer_name, - kernel.symbol_table_name, hive_offsets=None if offset is None else [offset], key=self.config.get("key", None), recurse=self.config.get("recurse", None), diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 87016553a..0e5d3c90c 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -54,7 +54,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac name="offset", description="Hive Offset", default=None, optional=True ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -295,7 +295,6 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac hive_offsets = None if self.config.get("offset", None) is not None: hive_offsets = [self.config.get("offset", None)] - kernel = self.context.modules[self.config["kernel"]] self._reg_table_name = intermed.IntermediateSymbolTable.create( self.context, self._config_path, "windows", "registry" @@ -303,10 +302,9 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac # get all the user hive offsets or use the one specified for hive in hivelist.HiveList.list_hives( - context=self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config_path, + self.config["kernel"], filter_string="ntuser.dat", hive_offsets=hive_offsets, ): diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index a83badb90..3cbeb3e7c 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -25,7 +25,7 @@ class Certificates(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.PluginRequirement( name="printkey", plugin=printkey.PrintKey, version=(1, 0, 0) @@ -69,13 +69,10 @@ class Certificates(interfaces.plugins.PluginInterface): return None def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: - kernel = self.context.modules[self.config["kernel"]] - for hive in hivelist.HiveList.list_hives( self.context, - base_config_path=self.config_path, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.config_path, + self.config["kernel"], ): for top_key in [ "Microsoft\\SystemCertificates", From be8b7580dd7eff5f47eec0921859ed2f538ff2b2 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:26:50 -0600 Subject: [PATCH 0665/1352] Windows Amcache: Update dependency and change method signature This updates the Windows Amcache plugin to use the latest changes in Windows HiveList. It requires a major version bump of its own due to a breaking method signature change, and is therefore in its own commit. Co-authored-by: Andrew Case --- .../framework/plugins/windows/amcache.py | 23 +++++++++---------- 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 46a742233..2ce1ead02 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -218,7 +218,9 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Extract information on executed applications from the AmCache.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + + # 2.0.0 - changed the signature of get_amcache_hive + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -230,7 +232,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -252,17 +254,14 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): cls, context: interfaces.context.ContextInterface, config_path: str, - kernel: interfaces.context.ModuleInterface, + kernel_module_name: str, ) -> Optional[registry.RegistryHive]: """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located.""" return next( hivelist.HiveList.list_hives( - context=context, - base_config_path=interfaces.configuration.path_join( - config_path, "hivelist" - ), - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + context, + interfaces.configuration.path_join(config_path, "hivelist"), + kernel_module_name, filter_string="amcache", ), None, @@ -523,8 +522,6 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) def _generator(self) -> Iterator[Tuple[int, _AmcacheEntry]]: - kernel = self.context.modules[self.config["kernel"]] - def indented( entry_gen: Iterable[_AmcacheEntry], indent: int = 0 ) -> Iterator[Tuple[int, _AmcacheEntry]]: @@ -533,7 +530,9 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Building the dictionary ahead of time is much better for performance # vs looking up each service's DLL individually. - amcache = self.get_amcache_hive(self.context, self.config_path, kernel) + amcache = self.get_amcache_hive( + self.context, self.config_path, self.config["kernel"] + ) if amcache is None: return From 5ed31d3133c6365ecfae7bb3ab8519576dad539d Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:08:25 -0600 Subject: [PATCH 0666/1352] Windows PoolScan: Adds method This updates the poolscanner plugin with an additional method, `generate_pool_scan_extended`, and does the corresponding minor version bump. Co-authored-by: Andrew Case --- .../framework/plugins/windows/poolscanner.py | 80 +++++++++++++++---- 1 file changed, 64 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 5cbb2ffc8..7446768c7 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -79,6 +79,7 @@ class PoolHeaderScanner(interfaces.layers.ScannerInterface): offset=offset - self._header_offset, absolute=True, ) + constraint = self._constraint_lookup[pattern] try: # Size check @@ -128,7 +129,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 1, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -331,11 +332,12 @@ class PoolScanner(plugins.PluginInterface): return [constraint for constraint in builtins if constraint.tag in tags_filter] @classmethod - def generate_pool_scan( + def generate_pool_scan_extended( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_layer_name: str, + kernel_symbol_table: str, + object_symbol_table: str, constraints: List[PoolConstraint], ) -> Generator[ Tuple[ @@ -347,49 +349,60 @@ class PoolScanner(plugins.PluginInterface): None, ]: """ + The extended version of `generate_pool_scan` to support pool scanning for objects outside of the kernel (ntoskrnl). + This requires the symbol table of the object being scanned for. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_layer_name: The name of the base kernel layer + kernel_symbol_table_name: The name of the table containing the kernel symbols + object_symbol_table_name: The name of the symbol table for the object being scanned for constraints: List of pool constraints used to limit the scan results - Returns: Iterable of tuples, containing the constraint that matched, the object from memory, the object header used to determine the object """ # get the object type map type_map = handles.Handles.get_type_map( - context=context, layer_name=layer_name, symbol_table=symbol_table + context=context, + layer_name=kernel_layer_name, + symbol_table=kernel_symbol_table, ) cookie = handles.Handles.find_cookie( - context=context, layer_name=layer_name, symbol_table=symbol_table + context=context, + layer_name=kernel_layer_name, + symbol_table=kernel_symbol_table, ) - is_windows_10 = versions.is_windows_10(context, symbol_table) - is_windows_8_or_later = versions.is_windows_8_or_later(context, symbol_table) + is_windows_10 = versions.is_windows_10(context, kernel_symbol_table) + is_windows_8_or_later = versions.is_windows_8_or_later( + context, kernel_symbol_table + ) # start off with the primary virtual layer - scan_layer = layer_name + scan_layer = kernel_layer_name # switch to a non-virtual layer if necessary if not is_windows_10: scan_layer = context.layers[scan_layer].config["memory_layer"] - if symbols.symbol_table_is_64bit(context, symbol_table): + if symbols.symbol_table_is_64bit(context, kernel_symbol_table): alignment = 0x10 else: alignment = 8 + # scan in the main kernel layer for the object(s) for constraint, header in cls.pool_scan( - context, scan_layer, symbol_table, constraints, alignment=alignment + context, scan_layer, object_symbol_table, constraints, alignment=alignment ): + + # construct the object in its own layer, using its own types mem_objects = header.get_object( constraint=constraint, use_top_down=is_windows_8_or_later, - native_layer_name=layer_name, - kernel_symbol_table=symbol_table, + native_layer_name=kernel_layer_name, + kernel_symbol_table=kernel_symbol_table, ) for mem_object in mem_objects: @@ -398,6 +411,7 @@ class PoolScanner(plugins.PluginInterface): constants.LOGLEVEL_VVV, f"Cannot create an instance of {constraint.type_name}", ) + continue if constraint.object_type is not None and not constraint.skip_type_test: @@ -418,6 +432,40 @@ class PoolScanner(plugins.PluginInterface): yield constraint, mem_object, header + @classmethod + def generate_pool_scan( + cls, + context: interfaces.context.ContextInterface, + layer_name: str, + symbol_table: str, + constraints: List[PoolConstraint], + ) -> Generator[ + Tuple[ + PoolConstraint, + interfaces.objects.ObjectInterface, + interfaces.objects.ObjectInterface, + ], + None, + None, + ]: + """ + The original version of `generate_pool_scan` which is sufficient for objects in the kernel (ntoskrnl), + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + layer_name: The name of the layer on which to operate + symbol_table: The name of the table containing the kernel symbols + constraints: List of pool constraints used to limit the scan results + + Returns: + Iterable of tuples, containing the constraint that matched, the object from memory, the object header used to determine the object + """ + + # repeat the symbol table to match the original `generate_pool_scan` behaviour + yield from cls.generate_pool_scan_extended( + context, layer_name, symbol_table, symbol_table, constraints + ) + @classmethod def pool_scan( cls, From de21ae4d2d0cf6091844c900bde36add2513e749 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:44:20 -0600 Subject: [PATCH 0667/1352] Windows SuspiciousThreads: Adds missing requirement, updates other This updates the threads version number to the latest (2.0.0) and adds a missing plugin requirement for thrdscan. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/suspicious_threads.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index 4bfb6baa5..f5da54da7 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -35,7 +35,10 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="threads", plugin=threads.Threads, version=(1, 0, 0) + name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) + ), + requirements.PluginRequirement( + name="threads", plugin=threads.Threads, version=(2, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) From d1abad3d872ad1e365314558f58390555a342db0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:43:04 -0600 Subject: [PATCH 0668/1352] Windows UnhookedSystemCalls: Update reqs, add breaking change This update the unhooked system calls plugin to use the latest changes from pslist, updating the requirement version numbers and bumping its own major version number due to a changed method signature. Co-authored-by: Andrew Case --- .../plugins/windows/unhooked_system_calls.py | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index 5b21225c8..b2049b97e 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -22,6 +22,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): """Looks for signs of Skeleton Key malware""" _required_framework_version = (2, 4, 0) + _version = (2, 0, 0) system_calls = { "ntdll.dll": { @@ -94,7 +95,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="pe_symbols", plugin=pe_symbols.PESymbols, version=(1, 0, 0) @@ -103,7 +104,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): def _gather_code_bytes( self, - kernel: interfaces.context.ModuleInterface, + kernel_module_name: str, found_symbols: pe_symbols.found_symbols_type, ) -> _code_bytes_type: """ @@ -115,11 +116,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): """ code_bytes: unhooked_system_calls._code_bytes_type = {} - procs = pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, - ) + procs = pslist.PsList.list_processes(self.context, kernel_module_name) for proc in procs: try: @@ -153,18 +150,15 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): return code_bytes def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]: - kernel = self.context.modules[self.config["kernel"]] - found_symbols = pe_symbols.PESymbols.addresses_for_process_symbols( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], unhooked_system_calls.system_calls, ) # code_bytes[dll_name][func_name][func_bytes] - code_bytes = self._gather_code_bytes(kernel, found_symbols) + code_bytes = self._gather_code_bytes(self.config["kernel"], found_symbols) # walk the functions that were evaluated for functions in code_bytes.values(): From 7bfbc26d679be15c2b33966f0e33c9b87dd19631 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:36:09 -0600 Subject: [PATCH 0669/1352] Windows Strings: Update pslist req and add breaking change This uses the latest changes from windows.pslist, updated the requirement version number. It also required breaking changes of its own, so the Strings version number has been given a major version bump as well. Co-authored-by: Andrew Case --- .../framework/plugins/windows/strings.py | 25 +++++++++---------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index b8dea0cdd..b5a2b7145 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -18,8 +18,11 @@ vollog = logging.getLogger(__name__) class Strings(interfaces.plugins.PluginInterface): """Reads output from the strings command and indicates which process(es) each string belongs to.""" - _version = (1, 2, 0) _required_framework_version = (2, 0, 0) + + # 2.0.0 - change signature of `generate_mapping` + _version = (2, 0, 0) + strings_pattern = re.compile(rb"^(?:\W*)([0-9]+)(?:\W*)(\w[\w\W]+)\n?") @classmethod @@ -31,7 +34,7 @@ class Strings(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -68,12 +71,10 @@ class Strings(interfaces.plugins.PluginInterface): except ValueError: vollog.error(f"Line in unrecognized format: line {count}") line = strings_fp.readline() - kernel = self.context.modules[self.config["kernel"]] revmap = self.generate_mapping( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], progress_callback=self._progress_callback, pid_list=self.config["pid"], ) @@ -122,8 +123,7 @@ class Strings(interfaces.plugins.PluginInterface): def generate_mapping( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, progress_callback: constants.ProgressCallback = None, pid_list: Optional[List[int]] = None, ) -> Dict[int, Set[Tuple[str, int]]]: @@ -132,8 +132,7 @@ class Strings(interfaces.plugins.PluginInterface): Args: context: the context for the method to run against - layer_name: the layer to map against the string lines - symbol_table: the name of the symbol table for the provided layer + kernel_module_name: the name of the module forthe kernel progress_callback: an optional callable to display progress pid_list: a lit of process IDs to consider when generating the reverse map @@ -142,7 +141,9 @@ class Strings(interfaces.plugins.PluginInterface): """ filter = pslist.PsList.create_pid_filter(pid_list) - layer = context.layers[layer_name] + kernel = context.modules[kernel_module_name] + + layer = context.layers[kernel.layer_name] reverse_map: Dict[int, Set[Tuple[str, int]]] = dict() if isinstance(layer, intel.Intel): # We don't care about errors, we just wanted chunks that map correctly @@ -160,9 +161,7 @@ class Strings(interfaces.plugins.PluginInterface): # TODO: Include kernel modules - for process in pslist.PsList.list_processes( - context, layer_name, symbol_table - ): + for process in pslist.PsList.list_processes(context, kernel_module_name): if not filter(process): proc_id = "Unknown" try: From 0b72e0fdb14e3def3798671af12a1fffb2e43d5f Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:34:58 -0600 Subject: [PATCH 0670/1352] Windows Orphan Kernel Threads: Update modules dep, add breaking change This updates the orphan kernel threads plugin to use the latest changes from the modules plugin, updating method signatures and bumping the requirement version number. This required breaking interface changes in the plugin itself, so the major version number has been bumped. Co-authored-by: Andrew Case --- .../plugins/windows/orphan_kernel_threads.py | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 98e5781ae..bae1160d6 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -16,7 +16,9 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + + # 2.0.0 - changed the signature of `list_orphan_kernel_threads` + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -38,7 +40,7 @@ class Threads(thrdscan.ThrdScan): name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 1, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] @@ -46,7 +48,7 @@ class Threads(thrdscan.ThrdScan): def list_orphan_kernel_threads( cls, context: interfaces.context.ContextInterface, - module_name: str, + kernel_module_name: str, ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Yields thread objects of kernel threads that do not map to a module @@ -57,13 +59,16 @@ class Threads(thrdscan.ThrdScan): Returns: A generator of thread objects of orphaned threads """ - collection = ssdt.SSDT.build_module_collection(context, module_name) - - kernel_space_start = modules.Modules.get_kernel_space_start( - context, module_name + collection = ssdt.SSDT.build_module_collection( + context, + kernel_module_name, ) - for thread in thrdscan.ThrdScan.scan_threads(context, module_name): + kernel_space_start = modules.Modules.get_kernel_space_start( + context, kernel_module_name + ) + + for thread in thrdscan.ThrdScan.scan_threads(context, kernel_module_name): # We don't want smeared or terminated threads # So we access the owning process (which could also be terminated or smeared) # Plus check the start address holding page From 6a6fd29d05fb9550ea5e932ce6f2719a40c5e003 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:24:20 -0600 Subject: [PATCH 0671/1352] Windows svclist: Update svcscan dependency This updates the svclist plugin with breaking changes to its public methods in order to update calls to the svcscan methods. Both requirement and plugin version numbers have been updated accordingly here. Co-authored-by: Andrew Case --- .../framework/plugins/windows/svclist.py | 28 ++++++++++--------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index 8a64084c5..00782c543 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -19,7 +19,9 @@ class SvcList(svcscan.SvcScan): """Lists services contained with the services.exe doubly linked list of services""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + + # 2.0.0 - service_list signature changed + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -30,7 +32,7 @@ class SvcList(svcscan.SvcScan): # Since we're calling the plugin, make sure we have the plugin's requirements return [ requirements.PluginRequirement( - name="svcscan", plugin=svcscan.SvcScan, version=(3, 0, 0) + name="svcscan", plugin=svcscan.SvcScan, version=(4, 0, 0) ), requirements.ModuleRequirement( name="kernel", @@ -60,16 +62,17 @@ class SvcList(svcscan.SvcScan): def service_list( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, service_table_name: str, service_binary_dll_map, filter_func, ): + kernel = context.modules[kernel_module_name] + if not symbols.symbol_table_is_64bit( - context, symbol_table + context, kernel.symbol_table_name ) or not versions.is_win10_15063_or_later( - context=context, symbol_table=symbol_table + context=context, symbol_table=kernel.symbol_table_name ): vollog.warning( "This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples" @@ -77,20 +80,19 @@ class SvcList(svcscan.SvcScan): return for proc in pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table, + context, + kernel_module_name, filter_func=filter_func, ): try: - layer_name = proc.add_process_layer() + proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException: vollog.warning( f"Unable to access memory of services.exe running with PID: {proc.UniqueProcessId}" ) continue - layer = context.layers[layer_name] + proc_layer = context.layers[proc_layer_name] exe_range = cls._get_exe_range(proc) if not exe_range: @@ -99,7 +101,7 @@ class SvcList(svcscan.SvcScan): ) continue - for offset in layer.scan( + for offset in proc_layer.scan( context=context, scanner=scanners.BytesScanner(needle=b"Sc27"), sections=exe_range, @@ -108,6 +110,6 @@ class SvcList(svcscan.SvcScan): context, service_table_name, service_binary_dll_map, - layer_name, + proc_layer_name, offset, ) From cf9261727b011c4c317ec0fb6e50912c253703b6 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:22:59 -0600 Subject: [PATCH 0672/1352] Windows SvcScan: Update reqs, add breaking change This updates the windows SvcScan plugin with the latest changes from hivelist/pslist, fixing up method calls and bumping requirement version numbers. In order to use the new method signatures, breaking changes were required to the svscan public methods, so a major version bump has been added. Co-authored-by: Andrew Case --- .../framework/plugins/windows/svcscan.py | 63 +++++++++---------- 1 file changed, 30 insertions(+), 33 deletions(-) diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 6645fa6a3..602e7fbd5 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -4,7 +4,7 @@ import logging import os -from typing import Dict, List, NamedTuple, Optional, Tuple, Union, cast +from typing import Dict, List, NamedTuple, Optional, Tuple, Union, cast, Callable from volatility3.framework import ( constants, @@ -35,7 +35,7 @@ class SvcScan(interfaces.plugins.PluginInterface): """Scans for windows services.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 2) + _version = (4, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -51,13 +51,13 @@ class SvcScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -106,7 +106,7 @@ class SvcScan(interfaces.plugins.PluginInterface): @staticmethod def _create_service_table( context: interfaces.context.ContextInterface, - symbol_table: str, + symbol_table_name: str, config_path: str, ) -> str: """Constructs a symbol table containing the symbols for services @@ -120,15 +120,15 @@ class SvcScan(interfaces.plugins.PluginInterface): Returns: A symbol table containing the symbols necessary for services """ - native_types = context.symbol_space[symbol_table].natives - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) + native_types = context.symbol_space[symbol_table_name].natives + is_64bit = symbols.symbol_table_is_64bit(context, symbol_table_name) try: symbol_filename = next( filename for version_check, for_64bit, filename in SvcScan._win_version_file_map if is_64bit == for_64bit - and version_check(context=context, symbol_table=symbol_table) + and version_check(context=context, symbol_table=symbol_table_name) ) except StopIteration: raise NotImplementedError("This version of Windows is not supported!") @@ -144,15 +144,13 @@ class SvcScan(interfaces.plugins.PluginInterface): @staticmethod def _get_service_key( - context, config_path: str, layer_name: str, symbol_table: str + context, config_path: str, kernel_module_name: str ) -> Optional[objects.StructType]: + for hive in hivelist.HiveList.list_hives( - context=context, - base_config_path=interfaces.configuration.path_join( - config_path, "hivelist" - ), - layer_name=layer_name, - symbol_table=symbol_table, + context, + interfaces.configuration.path_join(config_path, "hivelist"), + kernel_module_name, filter_string="machine\\system", ): # Get ControlSet\Services. @@ -278,18 +276,19 @@ class SvcScan(interfaces.plugins.PluginInterface): def service_scan( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, service_table_name: str, service_binary_dll_map, filter_func, ): + kernel = context.modules[kernel_module_name] + relative_tag_offset = context.symbol_space.get_type( service_table_name + constants.BANG + "_SERVICE_RECORD" ).relative_child_offset("Tag") is_vista_or_later = versions.is_vista_or_later( - context=context, symbol_table=symbol_table + context=context, symbol_table=kernel.symbol_table_name ) if is_vista_or_later: @@ -300,9 +299,8 @@ class SvcScan(interfaces.plugins.PluginInterface): seen = [] for task in pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table, + context, + kernel_module_name, filter_func=filter_func, ): proc_id = "Unknown" @@ -315,7 +313,7 @@ class SvcScan(interfaces.plugins.PluginInterface): ) continue - layer = context.layers[proc_layer_name] + process_layer = context.layers[proc_layer_name] # get process sections for scanning sections = [] @@ -324,7 +322,7 @@ class SvcScan(interfaces.plugins.PluginInterface): if vad.get_size(): sections.append((base, vad.get_size())) - for offset in layer.scan( + for offset in process_layer.scan( context=context, scanner=scanners.BytesScanner(needle=service_tag), sections=sections, @@ -360,18 +358,20 @@ class SvcScan(interfaces.plugins.PluginInterface): yield service_record @classmethod - def get_prereq_info(cls, context, config_path, layer_name: str, symbol_table: str): + def get_prereq_info( + cls, context, config_path: str, kernel_module_name: str + ) -> Tuple[str, Dict, Callable]: """ Data structures and information needed to analyze service information """ + kernel = context.modules[kernel_module_name] + service_table_name = cls._create_service_table( - context, symbol_table, config_path + context, kernel.symbol_table_name, config_path ) - services_key = cls._get_service_key( - context, config_path, layer_name, symbol_table - ) + services_key = cls._get_service_key(context, config_path, kernel_module_name) service_binary_dll_map = ( cls._get_service_binary_map(services_key) @@ -384,16 +384,13 @@ class SvcScan(interfaces.plugins.PluginInterface): return service_table_name, service_binary_dll_map, filter_func def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - service_table_name, service_binary_dll_map, filter_func = self.get_prereq_info( - self.context, self.config_path, kernel.layer_name, kernel.symbol_table_name + self.context, self.config_path, self.config["kernel"] ) for record in self._enumeration_method( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], service_table_name, service_binary_dll_map, filter_func, From a566c10da790e81b1a14a593cd5ed0427e8f3a12 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:41:33 -0600 Subject: [PATCH 0673/1352] Windows SvcDiff: Update reqs, adds breaking change This updates the svcdiff plugin to use the latest changes from svclist and svcscan, updating the requirement version numbers, and giving itself a major version bump due to a changed method signature. Co-authored-by: Andrew Case --- .../framework/plugins/windows/svcdiff.py | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py index 84d06a695..ca9bcfb75 100644 --- a/volatility3/framework/plugins/windows/svcdiff.py +++ b/volatility3/framework/plugins/windows/svcdiff.py @@ -26,6 +26,8 @@ class SvcDiff(svcscan.SvcScan): _required_framework_version = (2, 4, 0) + _version = (2, 0, 0) + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._enumeration_method = self.service_diff @@ -40,10 +42,10 @@ class SvcDiff(svcscan.SvcScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="svclist", component=svclist.SvcList, version=(1, 0, 0) + name="svclist", component=svclist.SvcList, version=(2, 0, 0) ), requirements.VersionRequirement( - name="svcscan", component=svcscan.SvcScan, version=(3, 0, 0) + name="svcscan", component=svcscan.SvcScan, version=(4, 0, 0) ), ] @@ -51,8 +53,7 @@ class SvcDiff(svcscan.SvcScan): def service_diff( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, service_table_name: str, service_binary_dll_map, filter_func, @@ -61,10 +62,12 @@ class SvcDiff(svcscan.SvcScan): On Windows 10 version 15063+ 64bit Windows memory samples, walk the services list and scan for services then report differences """ + kernel = context.modules[kernel_module_name] + if not symbols.symbol_table_is_64bit( - context, symbol_table + context, kernel.symbol_table_name ) or not versions.is_win10_15063_or_later( - context=context, symbol_table=symbol_table + context=context, symbol_table=kernel.symbol_table_name ): vollog.warning( "This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples" @@ -78,8 +81,7 @@ class SvcDiff(svcscan.SvcScan): # collect unique service names from scanning for service in svcscan.SvcScan.service_scan( context, - layer_name, - symbol_table, + kernel_module_name, service_table_name, service_binary_dll_map, filter_func, @@ -90,8 +92,7 @@ class SvcDiff(svcscan.SvcScan): # collect services from listing walking for service in svclist.SvcList.service_list( context, - layer_name, - symbol_table, + kernel_module_name, service_table_name, service_binary_dll_map, filter_func, From 57c6afd0fc64c972c9f516b06fb14344c587c456 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:20:31 -0600 Subject: [PATCH 0674/1352] Windows Netstat: Update modules req, adds breaking change This updates the netstat plugin to use the new method signature in the modules plugin; however, this requires a breaking change of its own which is done here as well. The major version is bumped accordingly; this plugin has no dependents that require updates at this time. Co-authored-by: Andrew Case --- .../framework/plugins/windows/netstat.py | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 902be5fc8..5b5b56ae3 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -21,7 +21,9 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Traverses network tracking structures present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + + # 2.0.0 changed the signature of `get_tcpip_module` + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -35,7 +37,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): name="netscan", component=netscan.NetScan, version=(1, 0, 0) ), requirements.VersionRequirement( - name="modules", component=modules.Modules, version=(2, 0, 0) + name="modules", component=modules.Modules, version=(3, 0, 0) ), requirements.VersionRequirement( name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) @@ -234,20 +236,18 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def get_tcpip_module( cls, context: interfaces.context.ContextInterface, - layer_name: str, - nt_symbols: str, + kernel_module_name: str, ) -> Optional[interfaces.objects.ObjectInterface]: """Uses `windows.modules` to find tcpip.sys in memory. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - nt_symbols: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel Returns: The constructed tcpip.sys module object. """ - for mod in modules.Modules.list_modules(context, layer_name, nt_symbols): + for mod in modules.Modules.list_modules(context, kernel_module_name): if mod.BaseDllName.get_string() == "tcpip.sys": vollog.debug(f"Found tcpip.sys image base @ 0x{mod.DllBase:x}") return mod @@ -630,9 +630,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): self.context, kernel.layer_name, kernel.symbol_table_name, self.config_path ) - tcpip_module = self.get_tcpip_module( - self.context, kernel.layer_name, kernel.symbol_table_name - ) + tcpip_module = self.get_tcpip_module(self.context, self.config["kernel"]) if not tcpip_module: vollog.error("Unable to locate symbols for the memory image's tcpip module") @@ -647,6 +645,11 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) except exceptions.VolatilityException: vollog.error("Unable to locate symbols for the memory image's tcpip module") + return + + if not tcpip_symbol_table: + vollog.error("Unable to reconstruct symbol table for tcpip.sys") + return for netw_obj in self.list_sockets( self.context, From f703da197b365083aee770d40255e1d722619da8 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:19:13 -0600 Subject: [PATCH 0675/1352] Windows Extensions: Fix traceback when accessing peb.Ldr This fixes a simple InvalidAddressException traceback by just catching the exception on the member access and continuing. Co-authored-by: Andrew Case --- .../framework/symbols/windows/extensions/__init__.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index fd9e2f415..e852de0da 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -874,6 +874,12 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): for peb in pebs: sym_table = self.get_symbol_table_name() + # Fixes #1636 + try: + peb.Ldr + except exceptions.InvalidAddressException: + continue + if peb.Ldr.vol.type_name.split(constants.BANG)[-1] == ("unsigned long"): sym_table = self.set_types(peb) From ae6ced58884282fda77c7511e7870712a73300d2 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:14:09 -0600 Subject: [PATCH 0676/1352] Windows ScheduledTasks: update hivelist dep, breaking change This updates the ScheduledTasks plugin with an updated hivelist requirement version number, changes the corresponding method call, and does a major version bump of its own due to a changed parameter name. Co-authored-by: Andrew Case --- .../plugins/windows/scheduled_tasks.py | 21 ++++++++----------- 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 31aaec4f0..c989bb9be 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -1103,7 +1103,7 @@ class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInte information about triggers, actions, run times, and creation times.""" _required_framework_version = (2, 11, 0) - _version = (1, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -1115,7 +1115,7 @@ information about triggers, actions, run times, and creation times.""" architectures=["Intel33", "Intel64"], ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), ] @@ -1135,17 +1135,14 @@ information about triggers, actions, run times, and creation times.""" cls, context: interfaces.context.ContextInterface, config_path: str, - kernel: interfaces.context.ModuleInterface, + kernel_module_name: str, ) -> Optional[registry.RegistryHive]: """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located.""" return next( hivelist.HiveList.list_hives( - context=context, - base_config_path=interfaces.configuration.path_join( - config_path, "hivelist" - ), - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + context, + interfaces.configuration.path_join(config_path, "hivelist"), + kernel_module_name, filter_string="SOFTWARE", ), None, @@ -1356,11 +1353,11 @@ information about triggers, actions, run times, and creation times.""" ) def _generator(self) -> Iterator[Tuple[int, _ScheduledTaskEntry]]: - kernel = self.context.modules[self.config["kernel"]] - # Building the dictionary ahead of time is much better for performance # vs looking up each service's DLL individually. - software_hive = self.get_software_hive(self.context, self.config_path, kernel) + software_hive = self.get_software_hive( + self.context, self.config_path, self.config["kernel"] + ) if software_hive is None: vollog.warning("Failed to get SOFTWARE hive") return From 886faec4741cc75f12412da602412968ea056641 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:12:39 -0600 Subject: [PATCH 0677/1352] Windows Shimcachemem: Updates req's, new major version This updates the ShimcacheMem plugins with the version bumps on the modules and pslist requirements, updates the corresponding method calls, and does a major version bump of its own due to a required breaking method signature change. Co-authored-by: Andrew Case --- .../framework/plugins/windows/shimcachemem.py | 111 +++++++++--------- 1 file changed, 55 insertions(+), 56 deletions(-) diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 1e1024656..46045087f 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -65,13 +65,13 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) ), requirements.VersionRequirement( - name="modules", component=modules.Modules, version=(2, 0, 0) + name="modules", component=modules.Modules, version=(3, 0, 0) ), ] @@ -79,7 +79,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf def create_shimcache_table( cls, context: interfaces.context.ContextInterface, - symbol_table: str, + symbol_table_name: str, config_path: str, ) -> str: """Creates a shimcache symbol table @@ -92,16 +92,16 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf Returns: The name of the constructed shimcache table """ - native_types = context.symbol_space[symbol_table].natives - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) - table_mapping = {"nt_symbols": symbol_table} + native_types = context.symbol_space[symbol_table_name].natives + is_64bit = symbols.symbol_table_is_64bit(context, symbol_table_name) + table_mapping = {"nt_symbols": symbol_table_name} try: symbol_filename = next( filename for version_check, for_64bit, filename in ShimcacheMem._win_version_file_map if is_64bit == for_64bit - and version_check(context=context, symbol_table=symbol_table) + and version_check(context=context, symbol_table=symbol_table_name) ) except StopIteration: raise NotImplementedError("This version of Windows is not supported!") @@ -122,8 +122,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf def find_shimcache_win_xp( cls, context: interfaces.context.ContextInterface, - layer_name: str, - kernel_symbol_table: str, + kernel_module_name: str, shimcache_symbol_table: str, ) -> Iterator[shimcache.SHIM_CACHE_ENTRY]: """Attempts to find the shimcache in a Windows XP memory image @@ -142,9 +141,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf seen = set() - for process in pslist.PsList.list_processes( - context, layer_name, kernel_symbol_table - ): + for process in pslist.PsList.list_processes(context, kernel_module_name): pid = process.UniqueProcessId vollog.debug("checking process %d", pid) for vad in vadinfo.VadInfo.list_vads( @@ -219,8 +216,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf cls, context: interfaces.context.ContextInterface, config_path: str, - kernel_layer_name: str, - nt_symbol_table: str, + kernel_module_name: str, shimcache_symbol_table: str, ) -> Iterator[shimcache.SHIM_CACHE_ENTRY]: """Implements the algorithm to search for the shim cache on Windows 2000 @@ -239,31 +235,33 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf :param shimcache_symbol_table: The name of a symbol table containing the hand-crafted shimcache symbols """ + kernel = context.modules[kernel_module_name] + data_sec = cls.get_module_section_range( context, config_path, - kernel_layer_name, - nt_symbol_table, + kernel_module_name, cls.NT_KRNL_MODS, ".data", ) mod_page = cls.get_module_section_range( context, config_path, - kernel_layer_name, - nt_symbol_table, + kernel_module_name, cls.NT_KRNL_MODS, "PAGE", ) # We require both in order to accurately handle AVL table if not (data_sec and mod_page): - return None + return data_sec_offset, data_sec_size = data_sec mod_page_offset, mod_page_size = mod_page - addr_size = 8 if symbols.symbol_table_is_64bit(context, nt_symbol_table) else 4 + addr_size = ( + 8 if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) else 4 + ) shim_head = None for offset in range( @@ -272,8 +270,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf shim_head = cls.try_get_shim_head_at_offset( context, shimcache_symbol_table, - nt_symbol_table, - kernel_layer_name, + kernel_module_name, mod_page_offset, mod_page_offset + mod_page_size, offset, @@ -293,9 +290,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf def try_get_shim_head_at_offset( cls, context: interfaces.context.ContextInterface, - symbol_table: str, - kernel_symbol_table: str, - layer_name: str, + shimcache_symbol_table: str, + kernel_module_name: str, mod_page_start: int, mod_page_end: int, offset: int, @@ -307,9 +303,14 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf If a number of validity checks are passed, this method will return the `SHIM_CACHE_HEAD` object. Otherwise, `None` is returned. """ + + kernel = context.modules[kernel_module_name] + # Check RTL_AVL_TABLE at offset rtl_avl_table = context.object( - symbol_table + constants.BANG + "_RTL_AVL_TABLE", layer_name, offset + shimcache_symbol_table + constants.BANG + "_RTL_AVL_TABLE", + kernel.layer_name, + offset, ) if not rtl_avl_table.is_valid(mod_page_start, mod_page_end): return None @@ -317,11 +318,11 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf vollog.debug(f"Candidate RTL_AVL_TABLE found at offset {offset:#x}") ersrc_size = context.symbol_space.get_type( - kernel_symbol_table + constants.BANG + "_ERESOURCE" + kernel.symbol_table_name + constants.BANG + "_ERESOURCE" ).size ersrc_alignment = ( 0x20 - if symbols.symbol_table_is_64bit(context, kernel_symbol_table) + if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) else 0x10 # 0x20 if context.symbol_space.get_type("pointer").size == 8 else 0x10 ) @@ -334,8 +335,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf vollog.debug(f"Constructing ERESOURCE at {eresource_offset:#x}") eresource = context.object( - kernel_symbol_table + constants.BANG + "_ERESOURCE", - layer_name, + kernel.symbol_table_name + constants.BANG + "_ERESOURCE", + kernel.layer_name, eresource_offset, ) if not eresource.is_valid(): @@ -344,12 +345,12 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf shim_head_offset = offset + rtl_avl_table.vol.size - if not context.layers[layer_name].is_valid(shim_head_offset): + if not context.layers[kernel.layer_name].is_valid(shim_head_offset): return None shim_head = context.object( - symbol_table + constants.BANG + "SHIM_CACHE_ENTRY", - layer_name, + shimcache_symbol_table + constants.BANG + "SHIM_CACHE_ENTRY", + kernel.layer_name, shim_head_offset, ) @@ -365,8 +366,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf cls, context: interfaces.context.ContextInterface, config_path: str, - kernel_layer_name: str, - nt_symbol_table: str, + kernel_module_name: str, shimcache_symbol_table: str, ) -> Iterator[shimcache.SHIM_CACHE_ENTRY]: """Attempts to locate and yield shimcache entries from a Windows 8 or later memory image. @@ -376,10 +376,11 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf :param kernel_symbol_table: The name of an existing symbol table containing the kernel symbols :param shimcache_symbol_table: The name of a symbol table containing the hand-crafted shimcache symbols """ + kernel = context.modules[kernel_module_name] is_8_1_or_later = versions.is_windows_8_1_or_later( - context, nt_symbol_table - ) or versions.is_win10(context, nt_symbol_table) + context, kernel.symbol_table_name + ) or versions.is_win10(context, kernel.symbol_table_name) module_names = ["ahcache.sys"] if is_8_1_or_later else cls.NT_KRNL_MODS vollog.debug(f"Searching for modules {module_names}") @@ -387,16 +388,14 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf data_sec = cls.get_module_section_range( context, config_path, - kernel_layer_name, - nt_symbol_table, + kernel_module_name, module_names, ".data", ) mod_page = cls.get_module_section_range( context, config_path, - kernel_layer_name, - nt_symbol_table, + kernel_module_name, module_names, "PAGE", ) @@ -419,12 +418,16 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf for offset in range( data_sec_offset, data_sec_offset + data_sec_size, - 8 if symbols.symbol_table_is_64bit(context, nt_symbol_table) else 4, + ( + 8 + if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + else 4 + ), ): vollog.debug(f"Building shim handle pointer at {offset:#x}") shim_handle = context.object( object_type=shimcache_symbol_table + constants.BANG + "pointer", - layer_name=kernel_layer_name, + layer_name=kernel.layer_name, subtype=handle_type, offset=offset, ) @@ -445,7 +448,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf # On Windows 8 x64, the first cache contains the shim cache. # On Windows 8 x86, 8.1 x86/x64, and 10, the second cache contains the shim cache. if ( - not symbols.symbol_table_is_64bit(context, nt_symbol_table) + not symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) and not is_8_1_or_later ): valid_head = shim_heads[1] @@ -474,8 +477,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf entries = self.find_shimcache_win_8_or_later( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], shimcache_table_name, ) @@ -488,8 +490,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf entries = self.find_shimcache_win_2k3_to_7( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], shimcache_table_name, ) @@ -499,8 +500,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf vollog.info("Finding shimcache entries for WinXP") entries = self.find_shimcache_win_xp( self._context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], shimcache_table_name, ) else: @@ -547,8 +547,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf cls, context: interfaces.context.ContextInterface, config_path: str, - layer_name: str, - symbol_table: str, + kernel_module_name: str, module_list: List[str], section_name: str, ) -> Optional[Tuple[int, int]]: @@ -566,14 +565,14 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf try: krnl_mod = next( module - for module in modules.Modules.list_modules( - context, layer_name, symbol_table - ) + for module in modules.Modules.list_modules(context, kernel_module_name) if module.BaseDllName.String in module_list ) except StopIteration: return None + kernel = context.modules[kernel_module_name] + pe_table_name = intermed.IntermediateSymbolTable.create( context, interfaces.configuration.path_join(config_path, "pe"), @@ -585,7 +584,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf # code taken from Win32KBase._section_chunks (win32_core.py) dos_header = context.object( pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", - layer_name, + kernel.layer_name, offset=krnl_mod.DllBase, ) From 73baf67d27526492a7896297898fe0a5a0a20b87 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:11:15 -0600 Subject: [PATCH 0678/1352] Windows Indirect Syscalls: Remove unneeded pslist dep PsList is not actually used in this plugin, and has therefore been removed. Co-authored-by: Andrew Case --- .../framework/plugins/windows/indirect_system_calls.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index dac0f9c4a..c241a9b67 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -9,7 +9,7 @@ from typing import List, Optional from volatility3.framework import interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.plugins import yarascan -from volatility3.plugins.windows import pslist, direct_system_calls +from volatility3.plugins.windows import direct_system_calls vollog = logging.getLogger(__name__) @@ -43,9 +43,6 @@ class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) - ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) ), From 13550aef3fc313f87f9d9c8a3aff3aaf09ae964c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:10:25 -0600 Subject: [PATCH 0679/1352] Windows Modules: Update dependents This updates the ssdt, truecrypt, drivermodule, driverirp, and verinfo plugins to use the new method signatures from the Modules plugin, and updates the requirement version numbers as well. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/driverirp.py | 2 +- volatility3/framework/plugins/windows/drivermodule.py | 2 +- volatility3/framework/plugins/windows/ssdt.py | 2 +- volatility3/framework/plugins/windows/truecrypt.py | 4 ++-- volatility3/framework/plugins/windows/verinfo.py | 8 +++----- 5 files changed, 8 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 413ea782f..2fc699e79 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -65,7 +65,7 @@ class DriverIrp(interfaces.plugins.PluginInterface): name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 1, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index c6547aae0..9b4c78ae8 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -32,7 +32,7 @@ class DriverModule(interfaces.plugins.PluginInterface): name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 1, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index 4e4773ffa..471dc9e18 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -32,7 +32,7 @@ class SSDT(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 0, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/truecrypt.py b/volatility3/framework/plugins/windows/truecrypt.py index 7fd26cb4e..158fc995d 100644 --- a/volatility3/framework/plugins/windows/truecrypt.py +++ b/volatility3/framework/plugins/windows/truecrypt.py @@ -33,7 +33,7 @@ class Passphrase(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="modules", component=modules.Modules, version=(2, 0, 0) + name="modules", component=modules.Modules, version=(3, 0, 0) ), requirements.IntRequirement( name="min-length", @@ -121,7 +121,7 @@ class Passphrase(interfaces.plugins.PluginInterface): def _generator(self): kernel = self.context.modules[self.config["kernel"]] mods: Iterable[ObjectInterface] = modules.Modules.list_modules( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) truecrypt_module_base = next( mod.DllBase diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 4930789d2..26bc5e63c 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -46,7 +46,7 @@ class VerInfo(interfaces.plugins.PluginInterface): name="pslist", plugin=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(2, 0, 0) + name="modules", plugin=modules.Modules, version=(3, 0, 0) ), requirements.BooleanRequirement( name="extensive", @@ -259,13 +259,11 @@ class VerInfo(interfaces.plugins.PluginInterface): self.context, kernel.layer_name, kernel.symbol_table_name ) - mods = modules.Modules.list_modules( - self.context, kernel.layer_name, kernel.symbol_table_name - ) + mods = modules.Modules.list_modules(self.context, self.config["kernel"]) # populate the session layers for kernel modules session_layers = modules.Modules.get_session_layers( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ) return renderers.TreeGrid( From e3ce4bc8471b753f093ae1a50154a8ed138a595c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:02:21 -0600 Subject: [PATCH 0680/1352] Windows PESymbols: Updates requirements, changes interface This updates the PESymbols plugin to use the latest changes from pslist and modules. This required breaking interface changes of its own (altered method signatures) and so receives its own major version bump. Dependents of PESymbols that _don't_ require any breaking changes have their method calls and version requirement numbers updated here as well. Co-authored-by: Andrew Case --- .../plugins/windows/debugregisters.py | 4 +- .../framework/plugins/windows/pe_symbols.py | 49 ++++++++----------- .../plugins/windows/skeleton_key_check.py | 2 +- .../plugins/windows/unhooked_system_calls.py | 2 +- 4 files changed, 24 insertions(+), 33 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index d4375685a..876b7fdc5 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -41,7 +41,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): name="threads", component=threads.Threads, version=(1, 0, 0) ), requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(1, 0, 0) + name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) ), ] @@ -140,7 +140,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): # this lookup takes a while, so only perform if we need to if not proc_modules: proc_modules = pe_symbols.PESymbols.get_process_modules( - self.context, kernel.layer_name, kernel.symbol_table_name, None + self.context, self.config["kernel"], None ) path_and_symbol = partial( pe_symbols.PESymbols.path_and_symbol_for_address, diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 04fa44adf..555010ac9 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -244,7 +244,8 @@ class PESymbols(interfaces.plugins.PluginInterface): _required_framework_version = (2, 7, 0) - _version = (1, 1, 0) + # 2.0.0 - changed signature of get_kernel_modules, get_all_vads_with_file_paths, addresses_for_process_symbols, get_process_modules + _version = (2, 0, 0) # used for special handling of the kernel PDB file. See later notes os_module_name = "ntoskrnl.exe" @@ -259,10 +260,10 @@ class PESymbols(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="modules", component=modules.Modules, version=(2, 0, 0) + name="modules", component=modules.Modules, version=(3, 0, 0) ), requirements.VersionRequirement( name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) @@ -297,7 +298,7 @@ class PESymbols(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, pe_table_name: str, - layer_name: str, + process_layer_name: str, base_address: int, ) -> Optional[pefile.PE]: """ @@ -305,7 +306,7 @@ class PESymbols(interfaces.plugins.PluginInterface): Args: pe_table_name: name of the pe types table - layer_name: name of the process layer + process_layer_name: name of the process layer base_address: base address of the module Returns: @@ -317,7 +318,7 @@ class PESymbols(interfaces.plugins.PluginInterface): dos_header = context.object( pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", offset=base_address, - layer_name=layer_name, + layer_name=process_layer_name, ) for offset, data in dos_header.reconstruct(): @@ -388,8 +389,7 @@ class PESymbols(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, config_path: str, - layer_name: str, - symbol_table_name: str, + kernel_module_name: str, symbols: filter_modules_type, ) -> found_symbols_type: """ @@ -405,7 +405,7 @@ class PESymbols(interfaces.plugins.PluginInterface): found_symbols_type: The dictionary of symbols that were resolved """ collected_modules = PESymbols.get_process_modules( - context, layer_name, symbol_table_name, symbols + context, kernel_module_name, symbols ) found_symbols, missing_symbols = PESymbols.find_symbols( @@ -483,12 +483,12 @@ class PESymbols(interfaces.plugins.PluginInterface): instance for it """ - layer_name = module_info[0] + process_layer_name = module_info[0] module_start = module_info[1] # we need a valid PE with an export table pe_module = PESymbols.get_pefile_obj( - context, pe_table_name, layer_name, module_start + context, pe_table_name, process_layer_name, module_start ) if not pe_module: return None @@ -500,7 +500,7 @@ class PESymbols(interfaces.plugins.PluginInterface): return None return ExportSymbolFinder( - layer_name, + process_layer_name, mod_name.lower(), module_start, pe_module.DIRECTORY_ENTRY_EXPORT.symbols, @@ -783,8 +783,7 @@ class PESymbols(interfaces.plugins.PluginInterface): def get_kernel_modules( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, filter_modules: Optional[filter_modules_type], ) -> collected_modules_type: """ @@ -804,7 +803,7 @@ class PESymbols(interfaces.plugins.PluginInterface): filter_modules_check = None session_layers = list( - modules.Modules.get_session_layers(context, layer_name, symbol_table) + modules.Modules.get_session_layers(context, kernel_module_name) ) # special handling for the kernel @@ -813,7 +812,7 @@ class PESymbols(interfaces.plugins.PluginInterface): ) for index, mod in enumerate( - modules.Modules.list_modules(context, layer_name, symbol_table) + modules.Modules.list_modules(context, kernel_module_name) ): try: mod_name = str(mod.BaseDllName.get_string().lower()) @@ -906,8 +905,7 @@ class PESymbols(interfaces.plugins.PluginInterface): def get_all_vads_with_file_paths( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table_name: str, + kernel_module_name: str, ) -> Generator[ Tuple[interfaces.objects.ObjectInterface, str, ranges_type], None, @@ -919,11 +917,7 @@ class PESymbols(interfaces.plugins.PluginInterface): Args: Generator[Tuple[interfaces.objects.ObjectInterface, str, ranges_type]]: Yields tuple of process objects, layers, and VADs mapping files """ - procs = pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table_name, - ) + procs = pslist.PsList.list_processes(context, kernel_module_name) for proc in procs: try: @@ -939,8 +933,7 @@ class PESymbols(interfaces.plugins.PluginInterface): def get_process_modules( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, filter_modules: Optional[filter_modules_type], ) -> collected_modules_type: """ @@ -960,7 +953,7 @@ class PESymbols(interfaces.plugins.PluginInterface): filter_modules_check = None for _proc, proc_layer_name, vads in PESymbols.get_all_vads_with_file_paths( - context, layer_name, symbol_table + context, kernel_module_name ): for vad_start, vad_size, filepath in vads: filename = PESymbols.filename_for_path(filepath) @@ -977,8 +970,6 @@ class PESymbols(interfaces.plugins.PluginInterface): return proc_modules def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]: - kernel = self.context.modules[self.config["kernel"]] - if self.config["symbols"]: filter_module = { self.config["module"].lower(): { @@ -1003,7 +994,7 @@ class PESymbols(interfaces.plugins.PluginInterface): module_resolver = self.get_process_modules collected_modules = module_resolver( - self.context, kernel.layer_name, kernel.symbol_table_name, filter_module + self.context, self.config["kernel"], filter_module ) found_symbols, _missing_symbols = PESymbols.find_symbols( diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index ce5bb41f4..5b50c9438 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -61,7 +61,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) ), requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(1, 1, 0) + name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index b2049b97e..c941ff768 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -98,7 +98,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( - name="pe_symbols", plugin=pe_symbols.PESymbols, version=(1, 0, 0) + name="pe_symbols", plugin=pe_symbols.PESymbols, version=(2, 0, 0) ), ] From d69b231f16173681199521365cdfaed11ed59282 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:44:49 -0600 Subject: [PATCH 0681/1352] Windows Suspended Threads: Updates pe_symbols req This bumps the requirement version number for pe_symbols, and uses the latest method signature. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/suspended_threads.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index cec51ed37..1ecdf0c51 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -33,7 +33,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(2, 0, 0) ), requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(1, 0, 0) + name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) ), requirements.VersionRequirement( name="threads", component=threads.Threads, version=(1, 0, 0) @@ -96,7 +96,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): # will not have suspended threads if not proc_modules: proc_modules = pe_symbols.PESymbols.get_process_modules( - self.context, kernel.layer_name, kernel.symbol_table_name, None + self.context, self.config["kernel"], None ) path_and_symbol = functools.partial( From 23cd3090459d5c953b18c1912b0d1902806fc4cc Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:53:46 -0600 Subject: [PATCH 0682/1352] Windows Threads: Change list_process_threads signature This updates the windows.threads plugin with a method signature change: `module_name` is now `kernel_module_name` for clarity. Co-authored-by: Andrew Case --- .../framework/plugins/windows/threads.py | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index f962a3fed..806caaa52 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 1) + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -59,16 +59,18 @@ class Threads(thrdscan.ThrdScan): @classmethod def list_process_threads( - cls, context: interfaces.context.ContextInterface, module_name: str + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Runs through all processes and lists threads for each process""" - module = context.modules[module_name] - layer_name = module.layer_name - symbol_table_name = module.symbol_table_name + module = context.modules[kernel_module_name] + + filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None)) for proc in pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table_name, + context, + kernel_module_name, + filter_func=filter_func, ): yield from cls.list_threads(module, proc) From d0f70f67b8ca6a1535230a9ec9b9c7930468ae5d Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:56:30 -0600 Subject: [PATCH 0683/1352] Windows Threads: Update dependents This updates the debugregisters and suspended threads plugins' threads requirement with the latest major version bump. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/debugregisters.py | 4 ++-- volatility3/framework/plugins/windows/suspended_threads.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 876b7fdc5..5dbeb9ff4 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -37,8 +37,8 @@ class DebugRegisters(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(2, 0, 0) ), - requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(1, 0, 0) + requirements.PluginRequirement( + name="threads", plugin=threads.Threads, version=(2, 0, 0) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 1ecdf0c51..2a14bd795 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -36,7 +36,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(1, 0, 0) + name="threads", component=threads.Threads, version=(2, 0, 0) ), ] From f06c87cb39121122c6c7a0af7fa87f9cf812a943 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:36:05 -0600 Subject: [PATCH 0684/1352] Windows Consoles: Update hivelist dep and change method signature This updates the windows.consoles.Consoles plugin to use the updated hivelist method signature, changing one of its own method signatures as required and doing a major version bump of its own. Plugins that depend on consoles also have their method calls changed, and their dependency versions bumped. Co-authored-by: Andrew Case --- .../framework/plugins/windows/cmdscan.py | 5 ++--- .../framework/plugins/windows/consoles.py | 19 +++++++++---------- 2 files changed, 11 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index 0cd0addb2..051ca8db0 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -39,7 +39,7 @@ class CmdScan(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="consoles", plugin=consoles.Consoles, version=(1, 0, 0) + name="consoles", plugin=consoles.Consoles, version=(2, 0, 0) ), requirements.BooleanRequirement( name="no_registry", @@ -288,8 +288,7 @@ class CmdScan(interfaces.plugins.PluginInterface): max_history, _ = consoles.Consoles.get_console_settings_from_registry( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], max_history, [], ) diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 63bb3e9b9..99eb81e5b 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -29,7 +29,9 @@ class Consoles(interfaces.plugins.PluginInterface): """Looks for Windows console buffers""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + + # 2.0.0 - change the signature of `get_console_settings_from_registry` + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -47,7 +49,7 @@ class Consoles(interfaces.plugins.PluginInterface): name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) ), requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(1, 0, 0) + name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.BooleanRequirement( name="no_registry", @@ -795,8 +797,7 @@ class Consoles(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, config_path: str, - kernel_layer_name: str, - kernel_symbol_table_name: str, + kernel_module_name: str, max_history: Set[int], max_buffers: Set[int], ) -> Tuple[Set[int], Set[int]]: @@ -823,10 +824,9 @@ class Consoles(interfaces.plugins.PluginInterface): ) for hive in hivelist.HiveList.list_hives( - context=context, - base_config_path=config_path, - layer_name=kernel_layer_name, - symbol_table=kernel_symbol_table_name, + context, + config_path, + kernel_module_name, hive_offsets=None, ): try: @@ -861,8 +861,7 @@ class Consoles(interfaces.plugins.PluginInterface): max_history, max_buffers = self.get_console_settings_from_registry( self.context, self.config_path, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], max_history, max_buffers, ) From b6ec262deb344d335bd7fa44584edcded84b775c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:08:48 -0600 Subject: [PATCH 0685/1352] Windows PsList: Update dependents This updates all dependents on windows.pslist.PsList that could be updated without breaking interface changes of their own to use the latest windows.pslist.PsList plugin version with a simplified method signature Co-authored-by: Andrew Case --- volatility3/cli/volshell/windows.py | 8 ++----- volatility3/framework/layers/registry.py | 2 +- .../framework/plugins/windows/cmdline.py | 17 +++++++------ .../framework/plugins/windows/cmdscan.py | 9 +++---- .../framework/plugins/windows/consoles.py | 9 +++---- .../plugins/windows/debugregisters.py | 8 ++----- .../plugins/windows/direct_system_calls.py | 24 ++++++++++--------- .../framework/plugins/windows/dlllist.py | 14 ++++------- .../framework/plugins/windows/dumpfiles.py | 6 ++--- .../framework/plugins/windows/envars.py | 8 +++---- .../framework/plugins/windows/getsids.py | 8 +++---- .../framework/plugins/windows/handles.py | 7 +++--- .../plugins/windows/hollowprocesses.py | 8 +++---- volatility3/framework/plugins/windows/iat.py | 9 +++---- .../framework/plugins/windows/joblinks.py | 6 +++-- .../framework/plugins/windows/ldrmodules.py | 8 +++---- .../framework/plugins/windows/malfind.py | 8 +++---- .../framework/plugins/windows/memmap.py | 8 +++---- .../framework/plugins/windows/privileges.py | 8 +++---- .../plugins/windows/processghosting.py | 8 +++---- .../framework/plugins/windows/psscan.py | 2 +- .../framework/plugins/windows/pstree.py | 6 ++--- .../framework/plugins/windows/psxview.py | 15 +++++------- .../framework/plugins/windows/sessions.py | 6 ++--- .../plugins/windows/skeleton_key_check.py | 9 +++---- .../plugins/windows/suspended_threads.py | 8 ++----- .../plugins/windows/suspicious_threads.py | 8 ++++--- .../framework/plugins/windows/vadinfo.py | 9 +++---- .../framework/plugins/windows/vadregexscan.py | 6 ++--- .../framework/plugins/windows/vadwalk.py | 8 +++---- .../framework/plugins/windows/vadyarascan.py | 9 +++---- .../framework/plugins/windows/verinfo.py | 8 ++----- 32 files changed, 106 insertions(+), 171 deletions(-) diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index 9b89a8b81..cf8fd400d 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -18,7 +18,7 @@ class Volshell(generic.Volshell): return [ requirements.ModuleRequirement(name="kernel", description="Windows kernel"), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.IntRequirement( name="pid", description="Process ID", optional=True @@ -38,11 +38,7 @@ class Volshell(generic.Volshell): def list_processes(self): """Returns a list of EPROCESS objects from the primary layer""" # We always use the main kernel memory and associated symbols - return list( - pslist.PsList.list_processes( - self.context, self.current_layer, self.current_symbol_table - ) - ) + return list(pslist.PsList.list_processes(self.context, self.config["kernel"])) def get_process(self, pid=None, virtaddr=None, physaddr=None): """Returns the _EPROCESS object that matches the pid. If a physical or a virtual address is provided, construct the _EPROCESS object at said address. Only one parameter is allowed. diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 21e1a938e..6d96a76a1 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -66,7 +66,7 @@ class RegistryHive(linear.LinearlyMappedLayer): # Win10 17063 introduced the Registry process to map most hives. Check # if it exists and update RegistryHive._base_layer for proc in pslist.PsList.list_processes( - self.context, self.config["base_layer"], self.config["nt_symbols"] + self.context, self.config["kernel_module_name"] ): proc_name = proc.ImageFileName.cast( "string", max_length=proc.ImageFileName.vol.count, errors="replace" diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index bad333a4c..dbfac35bf 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List +from typing import List, Optional from volatility3.framework import constants, exceptions, renderers, interfaces from volatility3.framework.configuration import requirements @@ -28,7 +28,7 @@ class CmdLine(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -41,7 +41,7 @@ class CmdLine(interfaces.plugins.PluginInterface): @classmethod def get_cmdline( cls, context: interfaces.context.ContextInterface, kernel_table_name: str, proc - ): + ) -> Optional[str]: """Extracts the cmdline from PEB Args: @@ -54,15 +54,16 @@ class CmdLine(interfaces.plugins.PluginInterface): """ proc_layer_name = proc.add_process_layer() + if not proc_layer_name: + return None peb = context.object( kernel_table_name + constants.BANG + "_PEB", layer_name=proc_layer_name, offset=proc.Peb, ) - result_text = peb.ProcessParameters.CommandLine.get_string() - return result_text + return peb.ProcessParameters.CommandLine.get_string() def _generator(self, procs): kernel = self.context.modules[self.config["kernel"]] @@ -99,16 +100,14 @@ class CmdLine(interfaces.plugins.PluginInterface): yield (0, (proc.UniqueProcessId, process_name, result_text)) def run(self): - kernel = self.context.modules[self.config["kernel"]] filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) return renderers.TreeGrid( [("PID", int), ("Process", str), ("Args", str)], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index 051ca8db0..fd0dd76b9 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -36,7 +36,7 @@ class CmdScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="consoles", plugin=consoles.Consoles, version=(2, 0, 0) @@ -359,8 +359,6 @@ class CmdScan(interfaces.plugins.PluginInterface): return process_name != "conhost.exe" def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( [ ("PID", int), @@ -372,9 +370,8 @@ class CmdScan(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=self._conhost_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 99eb81e5b..a4003956f 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -43,7 +43,7 @@ class Consoles(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) @@ -932,8 +932,6 @@ class Consoles(interfaces.plugins.PluginInterface): return process_name.lower() != "conhost.exe" def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( [ ("PID", int), @@ -945,9 +943,8 @@ class Consoles(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=self._conhost_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 5dbeb9ff4..394c30e25 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -35,7 +35,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="threads", plugin=threads.Threads, version=(2, 0, 0) @@ -117,11 +117,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): proc_modules = None - procs = pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, - ) + procs = pslist.PsList.list_processes(self.context, self.config["kernel"]) for proc in procs: for thread in threads.Threads.list_threads(kernel, proc): diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index af626f511..eaf35e842 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -53,7 +53,9 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): """Detects the Direct System Call technique used to bypass EDRs""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 1) + + # 2.0.0 - changes signature of `get_tasks_to_scan` + _version = (2, 0, 0) # DLLs that are expected to host system call invocations valid_syscall_handlers = ("ntdll.dll", "win32u.dll") @@ -90,7 +92,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) @@ -334,8 +336,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): def get_tasks_to_scan( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table_name: str, + kernel_module_name: str, ) -> Generator[ Tuple[interfaces.objects.ObjectInterface, str, str, str], None, None ]: @@ -350,12 +351,15 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): # gather active processes filter_func = pslist.PsList.create_active_process_filter() - is_32bit_arch = not symbols.symbol_table_is_64bit(context, symbol_table_name) + kernel = context.modules[kernel_module_name] + + is_32bit_arch = not symbols.symbol_table_is_64bit( + context, kernel.symbol_table_name + ) for proc in pslist.PsList.list_processes( - context=context, - layer_name=layer_name, - symbol_table=symbol_table_name, + context, + kernel_module_name, filter_func=filter_func, ): proc_name = utility.array_to_string(proc.ImageFileName) @@ -426,10 +430,8 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): ) return - kernel = self.context.modules[self.config["kernel"]] - for proc, proc_name, proc_layer_name, architecture in self.get_tasks_to_scan( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, self.config["kernel"] ): proc_layer = self.context.layers[proc_layer_name] diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 1dafb6bf5..e7ff81f69 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -34,7 +34,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(1, 1, 0) @@ -191,13 +191,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) def generate_timeline(self): - kernel = self.context.modules[self.config["kernel"]] for row in self._generator( - pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, - ) + pslist.PsList.list_processes(self.context, self.config["kernel"]) ): _depth, row_data = row if not isinstance(row_data[6], datetime.datetime): @@ -222,9 +217,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) else: procs = pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index 42f245800..74a328f78 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -68,7 +68,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="handles", component=handles.Handles, version=(2, 0, 0) @@ -352,7 +352,6 @@ class DumpFiles(interfaces.plugins.PluginInterface): offsets = list() # a list of processes matching the pid filter. all files for these process(es) will be dumped. procs = list() - kernel = self.context.modules[self.config["kernel"]] if self.config["filter"] and ( self.config["virtaddr"] or self.config["physaddr"] @@ -373,8 +372,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): ) procs = pslist.PsList.list_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 6ea95b33e..f390c09d5 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -40,7 +40,7 @@ class Envars(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) @@ -214,7 +214,6 @@ class Envars(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -226,9 +225,8 @@ class Envars(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 53be50ba8..ba1820a30 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -84,7 +84,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) @@ -215,15 +215,13 @@ class GetSIDs(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [("PID", int), ("Process", str), ("SID", str), ("Name", str)], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 8887859f9..d9e97c1b5 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -36,7 +36,7 @@ class Handles(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(1, 1, 0) @@ -393,9 +393,8 @@ class Handles(interfaces.plugins.PluginInterface): ) else: procs = pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/hollowprocesses.py b/volatility3/framework/plugins/windows/hollowprocesses.py index 30d4b602c..7990cb112 100644 --- a/volatility3/framework/plugins/windows/hollowprocesses.py +++ b/volatility3/framework/plugins/windows/hollowprocesses.py @@ -48,7 +48,7 @@ class HollowProcesses(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -205,7 +205,6 @@ class HollowProcesses(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -215,9 +214,8 @@ class HollowProcesses(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index 3bf7f57ed..0fe39e685 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -28,7 +28,7 @@ class IAT(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -126,8 +126,6 @@ class IAT(interfaces.plugins.PluginInterface): continue def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( [ ("PID", int), @@ -139,9 +137,8 @@ class IAT(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=pslist.PsList.create_pid_filter( self.config.get("pid", None) ), diff --git a/volatility3/framework/plugins/windows/joblinks.py b/volatility3/framework/plugins/windows/joblinks.py index d84c133c0..f6a59d7d1 100644 --- a/volatility3/framework/plugins/windows/joblinks.py +++ b/volatility3/framework/plugins/windows/joblinks.py @@ -36,16 +36,18 @@ class JobLinks(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), ] def _generator(self) -> Iterator[Tuple]: kernel = self.context.modules[self.config["kernel"]] + memory = self.context.layers[kernel.layer_name] for proc in pslist.PsList.list_processes( - self.context, kernel.layer_name, kernel.symbol_table_name + self.context, + self.config["kernel"], ): try: if not self.config["physical"]: diff --git a/volatility3/framework/plugins/windows/ldrmodules.py b/volatility3/framework/plugins/windows/ldrmodules.py index a888f22e1..e1eb14599 100644 --- a/volatility3/framework/plugins/windows/ldrmodules.py +++ b/volatility3/framework/plugins/windows/ldrmodules.py @@ -29,7 +29,7 @@ class LdrModules(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -107,7 +107,6 @@ class LdrModules(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -121,9 +120,8 @@ class LdrModules(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 14362776b..9d79be9dd 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -41,7 +41,7 @@ class Malfind(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -238,7 +238,6 @@ class Malfind(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -257,9 +256,8 @@ class Malfind(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index 62ab3c510..790c37aab 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -28,7 +28,7 @@ class Memmap(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.IntRequirement( name="pid", @@ -97,7 +97,6 @@ class Memmap(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter([self.config.get("pid", None)]) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -109,9 +108,8 @@ class Memmap(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index 7b4d00205..a0282e8c8 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -61,7 +61,7 @@ class Privs(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), ] @@ -107,7 +107,6 @@ class Privs(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -120,9 +119,8 @@ class Privs(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index 50f02c926..b94adee47 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -29,7 +29,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), ] @@ -83,7 +83,6 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_active_process_filter() - kernel = self.context.modules[self.config["kernel"]] return renderers.TreeGrid( [ @@ -95,9 +94,8 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 81e5fb792..a19423029 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -34,7 +34,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="info", component=info.Info, version=(1, 0, 0) diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 4f3fe0455..d0cea43ff 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -40,7 +40,7 @@ class PsTree(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -84,9 +84,7 @@ class PsTree(interfaces.plugins.PluginInterface): """Generates the Tree of processes.""" kernel = self.context.modules[self.config["kernel"]] - for proc in pslist.PsList.list_processes( - self.context, kernel.layer_name, kernel.symbol_table_name - ): + for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]): if not self.config.get("physical", pslist.PsList.PHYSICAL_DEFAULT): offset = proc.vol.offset else: diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index aa379bdc5..f7df979a8 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -53,7 +53,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="info", component=info.Info, version=(1, 0, 0) ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(1, 0, 0) @@ -181,23 +181,20 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter def _generator(self): kernel = self.context.modules[self.config["kernel"]] - layer_name = kernel.layer_name - symbol_table = kernel.symbol_table_name - kdbg_list_processes = list( - pslist.PsList.list_processes( - context=self.context, layer_name=layer_name, symbol_table=symbol_table - ) + pslist.PsList.list_processes(self.context, self.config["kernel"]) ) # get processes from each source processes: Dict[str, Dict[int, extensions.EPROCESS]] = {} processes["pslist"] = self._check_pslist(kdbg_list_processes) - processes["psscan"] = self._check_psscan(layer_name, symbol_table) + processes["psscan"] = self._check_psscan( + kernel.layer_name, kernel.symbol_table_name + ) processes["thrdscan"] = self._check_thrdscan() processes["csrss"] = self._check_csrss_handles( - kdbg_list_processes, layer_name, symbol_table + kdbg_list_processes, kernel.layer_name, kernel.symbol_table_name ) # Unique set of all offsets from all sources diff --git a/volatility3/framework/plugins/windows/sessions.py b/volatility3/framework/plugins/windows/sessions.py index d766b40ea..99a3cf335 100644 --- a/volatility3/framework/plugins/windows/sessions.py +++ b/volatility3/framework/plugins/windows/sessions.py @@ -28,7 +28,7 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -39,7 +39,6 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) ] def _generator(self): - kernel = self.context.modules[self.config["kernel"]] filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) # Collect all the values as we will want to group them later @@ -47,8 +46,7 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) for proc in pslist.PsList.list_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=filter_func, ): session_id = proc.get_session_id() diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index 5b50c9438..b57683f04 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -52,7 +52,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -660,8 +660,6 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): return process_name != "lsass.exe" def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( [ ("PID", int), @@ -672,9 +670,8 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=self._lsass_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 2a14bd795..2c3d584df 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -30,7 +30,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) @@ -61,11 +61,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): proc_modules = None # walk the threads of each process checking for suspended threads - for proc in pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, - ): + for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]): for thread in threads.Threads.list_threads(kernel, proc): try: # we only care if the thread is suspended diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index f5da54da7..938c6a940 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -37,6 +37,9 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + ), requirements.PluginRequirement( name="threads", plugin=threads.Threads, version=(2, 0, 0) ), @@ -135,9 +138,8 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for proc in pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ): ranges = self._get_ranges(kernel, all_ranges, proc) diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 35bf54d98..46afcaca8 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -64,7 +64,7 @@ class VadInfo(interfaces.plugins.PluginInterface): optional=True, ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.BooleanRequirement( name="dump", @@ -273,8 +273,6 @@ class VadInfo(interfaces.plugins.PluginInterface): ) def run(self) -> renderers.TreeGrid: - kernel = self.context.modules[self.config["kernel"]] - filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) return renderers.TreeGrid( @@ -294,9 +292,8 @@ class VadInfo(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 0d35cd658..0d9b6a72e 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -33,7 +33,7 @@ class VadRegExScan(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -111,11 +111,9 @@ class VadRegExScan(plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - kernel = self.context.modules[self.config["kernel"]] procs = pslist.PsList.list_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=filter_func, ) return renderers.TreeGrid( diff --git a/volatility3/framework/plugins/windows/vadwalk.py b/volatility3/framework/plugins/windows/vadwalk.py index 930388b3a..0d6a8b245 100644 --- a/volatility3/framework/plugins/windows/vadwalk.py +++ b/volatility3/framework/plugins/windows/vadwalk.py @@ -29,7 +29,7 @@ class VadWalk(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="vadinfo", plugin=vadinfo.VadInfo, version=(2, 0, 0) @@ -67,7 +67,6 @@ class VadWalk(interfaces.plugins.PluginInterface): ) def run(self) -> renderers.TreeGrid: - kernel = self.context.modules[self.config["kernel"]] filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) return renderers.TreeGrid( @@ -84,9 +83,8 @@ class VadWalk(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 0749ea547..2dd2dec26 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -30,7 +30,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) @@ -53,8 +53,6 @@ class VadYaraScan(interfaces.plugins.PluginInterface): return yarascan_requirements + vadyarascan_requirements def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - rules = yarascan.YaraScan.process_yara_options(dict(self.config)) filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) @@ -62,9 +60,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface): sanity_check = 1024 * 1024 * 1024 # 1 GB for task in pslist.PsList.list_processes( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + self.context, + self.config["kernel"], filter_func=filter_func, ): layer_name = task.add_process_layer() diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 26bc5e63c..63a0d9ece 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -43,7 +43,7 @@ class VerInfo(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(2, 0, 0) + name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( name="modules", plugin=modules.Modules, version=(3, 0, 0) @@ -253,11 +253,7 @@ class VerInfo(interfaces.plugins.PluginInterface): ) def run(self): - kernel = self.context.modules[self.config["kernel"]] - - procs = pslist.PsList.list_processes( - self.context, kernel.layer_name, kernel.symbol_table_name - ) + procs = pslist.PsList.list_processes(self.context, self.config["kernel"]) mods = modules.Modules.list_modules(self.context, self.config["kernel"]) From 3ec0e4c43f667db069b8205bb12207a5f0298ccf Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:33:32 -0600 Subject: [PATCH 0686/1352] Windows PEDump: Update PsList dep and change method signature This updates PEDump to use the latest version of PsList, updates the dependency version number, changes one of it's own method signatures to facilitate the pslist change, and does a major bump of its own version number. Co-authored-by: Andrew Case --- .../framework/plugins/windows/pedump.py | 35 ++++++++++++++----- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 5107cb48b..5f2a1d737 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -3,7 +3,7 @@ # import logging import ntpath -from typing import List, Type, Optional +from typing import List, Type, Optional, Iterator, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -18,7 +18,9 @@ class PEDump(interfaces.plugins.PluginInterface): """Allows extracting PE Files from a specific address in a specific address space""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + + # 2.0.0 - changed the signature of `dump_kernel_pe_at_base` + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -30,7 +32,10 @@ class PEDump(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(2, 0, 0) + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", @@ -145,10 +150,18 @@ class PEDump(interfaces.plugins.PluginInterface): ) @classmethod - def dump_kernel_pe_at_base(cls, context, kernel, pe_table_name, open_method, base): - session_layers = modules.Modules.get_session_layers( - context, kernel.layer_name, kernel.symbol_table_name - ) + def dump_kernel_pe_at_base( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + pe_table_name: str, + open_method: Type[interfaces.plugins.FileHandlerInterface], + base: int, + ) -> Iterator[Tuple[int, str, str]]: + """ + Extracts a PE file from kernel memory at the given base address + """ + session_layers = modules.Modules.get_session_layers(context, kernel_module_name) session_layer_name = modules.Modules.find_session_layer( context, session_layers, base @@ -183,7 +196,7 @@ class PEDump(interfaces.plugins.PluginInterface): for proc in pslist.PsList.list_processes( context=context, layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + symbol_table_name=kernel.symbol_table_name, filter_func=filter_func, ): pid = proc.UniqueProcessId @@ -224,7 +237,11 @@ class PEDump(interfaces.plugins.PluginInterface): if self.config["kernel_module"]: pe_files = self.dump_kernel_pe_at_base( - self.context, kernel, pe_table_name, self.open, self.config["base"] + self.context, + self.config["kernel"], + pe_table_name, + self.open, + self.config["base"], ) else: filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) From 0f05128230a90ff7eecca23812ddcfcb3a037751 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 15:49:01 -0600 Subject: [PATCH 0687/1352] Windows PEDump: Update dependents This updates all plugins that both depend on PEDump and won't require breaking changes of their own. They now call the updated method signature, and have their pedump requirement version bumped appropriately. Co-authored-by: Andrew Case --- volatility3/framework/plugins/windows/dlllist.py | 2 +- volatility3/framework/plugins/windows/modscan.py | 2 +- volatility3/framework/plugins/windows/modules.py | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index e7ff81f69..b609b4fc3 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -40,7 +40,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): name="psscan", component=psscan.PsScan, version=(1, 1, 0) ), requirements.VersionRequirement( - name="pedump", component=pedump.PEDump, version=(1, 0, 0) + name="pedump", component=pedump.PEDump, version=(2, 0, 0) ), requirements.VersionRequirement( name="info", component=info.Info, version=(1, 0, 0) diff --git a/volatility3/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py index 76c30ac9c..ab1383ddf 100644 --- a/volatility3/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -55,7 +55,7 @@ class ModScan(modules.Modules): default=None, ), requirements.VersionRequirement( - name="pedump", component=pedump.PEDump, version=(1, 0, 0) + name="pedump", component=pedump.PEDump, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index c4f6af4bc..4872135a9 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -37,6 +37,9 @@ class Modules(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="pedump", component=pedump.PEDump, version=(2, 0, 0) + ), requirements.BooleanRequirement( name="dump", description="Extract listed modules", @@ -54,9 +57,6 @@ class Modules(interfaces.plugins.PluginInterface): optional=True, default=None, ), - requirements.VersionRequirement( - name="pedump", component=pedump.PEDump, version=(1, 0, 0) - ), ] def dump_module(self, session_layers, pe_table_name, mod): From 844a24f02d9f4536ade421c425f303256b7b11af Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 25 Feb 2025 13:00:27 -0600 Subject: [PATCH 0688/1352] Windows Scheduled Tasks: Prevent backtraces This fixes an `AttributeError` that can crop up when the actionset's context is `None`. --- volatility3/framework/plugins/windows/scheduled_tasks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index c989bb9be..67b88d8fc 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -1345,7 +1345,7 @@ information about triggers, actions, run times, and creation times.""" args, ( action_set.context - if action_set is not None + if (action_set is not None and action_set.context is not None) else renderers.NotAvailableValue() ), working_directory, From 76e459b62e56eb8fe7312bfc7b356352c81bb8c4 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 25 Feb 2025 13:47:11 -0600 Subject: [PATCH 0689/1352] Windows Versions: Sort version checks for readability --- .../framework/symbols/windows/versions.py | 52 +++++++++---------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py index 6b5b9846a..77872e063 100644 --- a/volatility3/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -88,24 +88,6 @@ class OsDistinguisher: return True -is_windows_8_1_or_later = OsDistinguisher( - version_check=lambda x: x >= (6, 3), - fallback_checks=[("_KPRCB", "PendingTickFlags", True)], -) - -is_vista_or_later = OsDistinguisher( - version_check=lambda x: x >= (6, 0), - fallback_checks=[("KdCopyDataBlock", None, True)], -) - -is_win10 = OsDistinguisher( - version_check=lambda x: (10, 0) <= x, - fallback_checks=[ - ("ObHeaderCookie", None, True), - ("_HANDLE_TABLE", "HandleCount", False), - ], -) - is_windows_xp = OsDistinguisher( version_check=lambda x: (5, 1) <= x < (5, 2), fallback_checks=[ @@ -149,6 +131,32 @@ is_2003 = OsDistinguisher( ], ) +is_vista_or_later = OsDistinguisher( + version_check=lambda x: x >= (6, 0), + fallback_checks=[("KdCopyDataBlock", None, True)], +) + +is_windows_8_1_or_later = OsDistinguisher( + version_check=lambda x: x >= (6, 3), + fallback_checks=[("_KPRCB", "PendingTickFlags", True)], +) + +is_win10 = OsDistinguisher( + version_check=lambda x: (10, 0) <= x, + fallback_checks=[ + ("ObHeaderCookie", None, True), + ("_HANDLE_TABLE", "HandleCount", False), + ], +) + +is_win10_10586_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 10586), + fallback_checks=[ + ("_EPROCESS", "SecurityDomain", False), + ("_EPROCESS", "ImageFilePointer", False), + ], +) + is_win10_up_to_15063 = OsDistinguisher( version_check=lambda x: (10, 0) <= x < (10, 0, 15063), fallback_checks=[ @@ -195,14 +203,6 @@ is_win10_17134_or_later = OsDistinguisher( ], ) -is_win10_10586_or_later = OsDistinguisher( - version_check=lambda x: x >= (10, 0, 10586), - fallback_checks=[ - ("_EPROCESS", "SecurityDomain", False), - ("_EPROCESS", "ImageFilePointer", False), - ], -) - is_win10_17763_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 17763), fallback_checks=[ From ced90567543830649d8b03842e581a6dc562fd54 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 25 Feb 2025 14:04:24 -0600 Subject: [PATCH 0690/1352] Windows Versions: Add version check for win10 17735 or later --- .../windows/gui/gui-win10-17735-x64.json | 18830 ++++++++++++++++ .../framework/symbols/windows/versions.py | 8 + 2 files changed, 18838 insertions(+) create mode 100644 volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json new file mode 100644 index 000000000..b4c615cff --- /dev/null +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json @@ -0,0 +1,18830 @@ +{ + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 880 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 464 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 824 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + } +} diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py index 77872e063..b00892cbc 100644 --- a/volatility3/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -203,6 +203,14 @@ is_win10_17134_or_later = OsDistinguisher( ], ) +is_win10_17735_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 17735), + fallback_checks=[ + ("_EPROCESS", "VmProcessorHost", True), + ("_EPROCESS", "VdmObjects", False), + ], +) + is_win10_17763_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 17763), fallback_checks=[ From 885bf187e259b0c3875bb14e046198561e235754 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 25 Feb 2025 00:33:16 +0000 Subject: [PATCH 0691/1352] Windows DeskScan: Update pool extension This updates the Windows pool extension with a new get_name() method, and changes the method signature for another. We'll need to figure out if there is a good way to version extension classes. Deskscan requires this in order to use get_name with an alternate (non-kernel) symbol table. --- .../symbols/windows/extensions/pool.py | 37 +++++++++++++++++-- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index ff65acdeb..5427e3773 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -95,7 +95,7 @@ class POOL_HEADER(objects.StructType): optional_headers, lengths_of_optional_headers, ) = self._calculate_optional_header_lengths( - self._context, symbol_table_name + self._context, kernel_symbol_table ) padding_available = ( None @@ -326,12 +326,18 @@ class ExecutiveObject(interfaces.objects.ObjectInterface): """This is used as a "mixin" that provides all kernel executive objects with a means of finding their own object header.""" - def get_object_header(self) -> "OBJECT_HEADER": + def get_object_header( + self, symbol_table_name: Optional[str] = None + ) -> "OBJECT_HEADER": if constants.BANG not in self.vol.type_name: raise ValueError( f"Invalid symbol table name syntax (no {constants.BANG} found)" ) - symbol_table_name = self.vol.type_name.split(constants.BANG)[0] + + # caller provided symbol table allows for scanning for objects from any module + if not symbol_table_name: + symbol_table_name = self.vol.type_name.split(constants.BANG)[0] + body_offset = self._context.symbol_space.get_type( symbol_table_name + constants.BANG + "_OBJECT_HEADER" ).relative_child_offset("Body") @@ -342,6 +348,12 @@ class ExecutiveObject(interfaces.objects.ObjectInterface): native_layer_name=self.vol.native_layer_name, ) + def get_name(self, symbol_table_name: Optional[str] = None) -> Optional[str]: + try: + return self.get_object_header(symbol_table_name).get_name() + except exceptions.InvalidAddressException: + return None + class OBJECT_HEADER(objects.StructType): """A class for the headers for executive kernel objects, which contains @@ -450,3 +462,22 @@ class OBJECT_HEADER(objects.StructType): absolute=True, ) return header + + def get_name(self) -> Optional[str]: + """ + Attempts to get the name of the object + Sanity checks size members to avoid FPs + Returns None if any issues detected + """ + try: + name_info = self.NameInfo.Name + if ( + name_info.Length == 0 + or name_info.MaximumLength == 0 + or name_info.Length > name_info.MaximumLength + ): + return None + + return name_info.String + except (ValueError, exceptions.InvalidAddressException): + return None From dad5a75aaaeb2594ec8b0f3625cb5c07ba049589 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 27 Feb 2025 15:29:56 -0600 Subject: [PATCH 0692/1352] Windows GUI Plugins: Adds three plugins This adds the windowstations, desktops, and deskscan plugins, and removes the gui.py plugin file that was stubbed out in the introductory work for the effort. It also adds a new method to the poolscanner class, but does not bump the poolscanner version number since there is already a major version number bump going into this PR. Co-authored-by: Andrew Case --- .../framework/plugins/windows/deskscan.py | 81 ++++++ .../framework/plugins/windows/desktops.py | 91 +++++++ volatility3/framework/plugins/windows/gui.py | 114 --------- .../framework/plugins/windows/poolscanner.py | 30 +++ .../plugins/windows/windowstations.py | 234 ++++++++++++++++++ .../symbols/windows/extensions/gui.py | 127 ++++++++++ 6 files changed, 563 insertions(+), 114 deletions(-) create mode 100644 volatility3/framework/plugins/windows/deskscan.py create mode 100644 volatility3/framework/plugins/windows/desktops.py delete mode 100644 volatility3/framework/plugins/windows/gui.py create mode 100644 volatility3/framework/plugins/windows/windowstations.py create mode 100644 volatility3/framework/symbols/windows/extensions/gui.py diff --git a/volatility3/framework/plugins/windows/deskscan.py b/volatility3/framework/plugins/windows/deskscan.py new file mode 100644 index 000000000..baba3d8a0 --- /dev/null +++ b/volatility3/framework/plugins/windows/deskscan.py @@ -0,0 +1,81 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List, Iterable, Tuple + +from volatility3.framework import interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import desktops, windowstations + +vollog = logging.getLogger(__name__) + + +class DeskScan(desktops.Desktops): + """Scans for the Desktop instances of each Window Station""" + + _required_framework_version = (2, 0, 0) + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self.implementation = self.scan_desktops + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.PluginRequirement( + name="desktops", plugin=desktops.Desktops, version=(1, 0, 0) + ), + requirements.PluginRequirement( + name="windowstations", + plugin=windowstations.WindowStations, + version=(1, 0, 0), + ), + ] + + @classmethod + def scan_desktops( + cls, + context: interfaces.context.ContextInterface, + config_path: str, + kernel_module_name: str, + ) -> Iterable[Tuple[int, str, int, str, str, int]]: + """ + Yields the information about each desktop and desktop thread needed for analysis + + The tuple yielded includes the: + Virtual address of the desktop + The window station name + The session id + Desktop name + Process name + Process ID (PID) + """ + kernel = context.modules[kernel_module_name] + + for desktop in windowstations.WindowStations.scan_gui_object( + context, config_path, kernel_module_name, b"Desk", "tagDESKTOP" + ): + desktop_name = desktop.get_name(kernel.symbol_table_name) + if not desktop_name: + continue + + winsta = desktop.get_window_station() + if not winsta: + continue + + winsta_name, session_id = winsta.get_info(kernel.symbol_table_name) + if not winsta_name or session_id is None: + continue + + for _thread, process_name, process_pid in desktop.get_threads(): + yield format_hints.Hex( + desktop.vol.offset + ), winsta_name, session_id, desktop_name, process_name, process_pid diff --git a/volatility3/framework/plugins/windows/desktops.py b/volatility3/framework/plugins/windows/desktops.py new file mode 100644 index 000000000..1085ff36d --- /dev/null +++ b/volatility3/framework/plugins/windows/desktops.py @@ -0,0 +1,91 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List, Iterable + +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import windowstations + +vollog = logging.getLogger(__name__) + + +class Desktops(interfaces.plugins.PluginInterface): + """Enumerates the Desktop instances of each Window Station""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self.implementation = self.list_desktops + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.PluginRequirement( + name="windowstations", + plugin=windowstations.WindowStations, + version=(1, 0, 0), + ), + ] + + @classmethod + def list_desktops( + cls, + context: interfaces.context.ContextInterface, + config_path: str, + kernel_module_name: str, + ) -> Iterable[interfaces.objects.ObjectInterface]: + """ + Uses `scan_window_stations` to find each window station + For each found, enumerates its desktops followed by the + threads of each desktop. + """ + kernel = context.modules[kernel_module_name] + + for ( + winsta, + station_name, + session_id, + ) in windowstations.WindowStations.scan_window_stations( + context, config_path, kernel_module_name + ): + # for each window station, walk its list of desktops + for desktop, desktop_name in winsta.desktops(kernel.symbol_table_name): + # for each desktop, walk its threads + for _thread, process_name, process_pid in desktop.get_threads(): + yield format_hints.Hex( + desktop.vol.offset + ), station_name, session_id, desktop_name, process_name, process_pid + + def _generator(self): + kernel_name = self.config["kernel"] + + # call the implementation for finding desktops + # yield the information, which will include the owning window station and process + for desktop_info in self.implementation( + self.context, self.config_path, kernel_name + ): + yield 0, desktop_info + + def run(self): + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Window Station", str), + ("Session", int), + ("Desktop", str), + ("Process", str), + ("PID", int), + ], + self._generator(), + ) diff --git a/volatility3/framework/plugins/windows/gui.py b/volatility3/framework/plugins/windows/gui.py deleted file mode 100644 index 1cce5b7f3..000000000 --- a/volatility3/framework/plugins/windows/gui.py +++ /dev/null @@ -1,114 +0,0 @@ -# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 -# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 -# -import logging -import os -from itertools import count -from typing import List, Tuple - -from volatility3.framework import interfaces, renderers, symbols -from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols import intermed -from volatility3.framework.symbols.windows import versions - -# from volatility3.plugins.windows import pslist, vadinfo, modules - -vollog = logging.getLogger(__name__) - - -class WinGUI(interfaces.plugins.PluginInterface): - """Parses information about Windows GUI Objects""" - - _required_framework_version = (2, 0, 0) - - # These checks must be completed from newest -> oldest OS version. - _win_version_file_map: List[Tuple[versions.OsDistinguisher, str]] = [ - (versions.is_win10_19577_or_later, "gui-win10-19577-x64"), - (versions.is_win10_19041_or_later, "gui-win10-19041-x64"), - (versions.is_win10_18362_or_later, "gui-win10-18362-x64"), - (versions.is_win10_17763_or_later, "gui-win10-17763-x64"), - (versions.is_win10_17134_or_later, "gui-win10-17134-x64"), - (versions.is_win10_16299_or_later, "gui-win10-16299-x64"), - (versions.is_win10_15063_or_later, "gui-win10-15063-x64"), - (versions.is_win10_10586_or_later, "gui-win10-10586-x64"), - (versions.is_windows_8_or_later, "gui-win8-x64"), - (versions.is_windows_7_sp1, "gui-win7sp1-x64"), - (versions.is_windows_7_sp0, "gui-win7sp0-x64"), - ] - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - # Since we're calling the plugin, make sure we have the plugin's requirements - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - ] - - @staticmethod - def create_gui_table( - context: interfaces.context.ContextInterface, - symbol_table: str, - config_path: str, - ) -> str: - """Creates a symbol table for windows GUI types - - Args: - context: The context to retrieve required elements (layers, symbol tables) from - symbol_table: The name of an existing symbol table containing the kernel symbols - config_path: The configuration path within the context of the symbol table to create - - Returns: - The name of the constructed GUI table - """ - native_types = context.symbol_space[symbol_table].natives - - if not symbols.symbol_table_is_64bit(context, symbol_table): - raise NotImplementedError( - "This plugin only supports x64 versions of Windows" - ) - - table_mapping = {"nt_symbols": symbol_table} - - try: - symbol_filename = next( - filename - for version_check, filename in WinGUI._win_version_file_map - if version_check(context=context, symbol_table=symbol_table) - ) - except StopIteration: - raise NotImplementedError("This version of Windows is not supported!") - - vollog.debug(f"Using GUI table {symbol_filename}") - - return intermed.IntermediateSymbolTable.create( - context, - config_path, - os.path.join("windows", "gui"), - symbol_filename, - native_types=native_types, - table_mapping=table_mapping, - ) - - def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - - gui_table = self.create_gui_table( - self.context, kernel.symbol_table_name, self.config_path - ) - - c = count() - for _ in range(10): - yield ( - 0, - (next(c), tuple()), - ) - - def run(self): - return renderers.TreeGrid( - [], - self._generator(), - ) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 7446768c7..75de8bb95 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -182,6 +182,36 @@ class PoolScanner(plugins.PluginInterface): ), ) + @staticmethod + def gui_poolscanner_constraints( + gui_table: str, tags_filter: Optional[List[bytes]] = None + ) -> List[PoolConstraint]: + """ + Constraints for objects managed by the GUI subsystem (win32k*.sys) + """ + builtins = [ + PoolConstraint( + b"Wind", + type_name=gui_table + constants.BANG + "tagWINDOWSTATION", + size=(0x90, None), + page_type=PoolType.PAGED, + object_type="WindowStation", + skip_type_test=True, + ), + PoolConstraint( + b"Desk", + type_name=gui_table + constants.BANG + "tagDESKTOP", + page_type=PoolType.PAGED, + object_type="Desktop", + skip_type_test=True, + ), + ] + + if not tags_filter: + return builtins + + return [constraint for constraint in builtins if constraint.tag in tags_filter] + @classmethod def builtin_constraints( cls, symbol_table: str, tags_filter: Optional[List[bytes]] = None diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py new file mode 100644 index 000000000..cb6a52b88 --- /dev/null +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -0,0 +1,234 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import os +from typing import List, Tuple, Iterator, Generator, Dict + +from volatility3.framework import interfaces, renderers, symbols, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import versions +from volatility3.framework.symbols.windows.extensions import gui +from volatility3.plugins.windows import poolscanner, modules + +vollog = logging.getLogger(__name__) + + +class WindowStations(interfaces.plugins.PluginInterface): + """Scans for top level Windows Stations""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + # These checks must be completed from newest -> oldest OS version. + _win_version_file_map: List[Tuple[versions.OsDistinguisher, str]] = [ + (versions.is_win10_19577_or_later, "gui-win10-19577-x64"), + (versions.is_win10_19041_or_later, "gui-win10-19041-x64"), + (versions.is_win10_18362_or_later, "gui-win10-18362-x64"), + (versions.is_win10_17763_or_later, "gui-win10-17763-x64"), + (versions.is_win10_17134_or_later, "gui-win10-17134-x64"), + (versions.is_win10_16299_or_later, "gui-win10-16299-x64"), + (versions.is_win10_15063_or_later, "gui-win10-15063-x64"), + (versions.is_win10_10586_or_later, "gui-win10-10586-x64"), + (versions.is_windows_8_or_later, "gui-win8-x64"), + (versions.is_windows_7_sp1, "gui-win7sp1-x64"), + (versions.is_windows_7_sp0, "gui-win7sp0-x64"), + ] + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + ] + + @staticmethod + def create_gui_table( + context: interfaces.context.ContextInterface, + symbol_table: str, + config_path: str, + ) -> str: + """Creates a symbol table for windows GUI types + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + symbol_table: The name of an existing symbol table containing the kernel symbols + config_path: The configuration path within the context of the symbol table to create + + Returns: + The name of the constructed GUI table + """ + native_types = context.symbol_space[symbol_table].natives + + if not symbols.symbol_table_is_64bit(context, symbol_table): + raise NotImplementedError( + "This plugin only supports x64 versions of Windows" + ) + + table_mapping = {"nt_symbols": symbol_table} + + try: + symbol_filename = next( + filename + for version_check, filename in WindowStations._win_version_file_map + if version_check(context=context, symbol_table=symbol_table) + ) + except StopIteration: + raise NotImplementedError("This version of Windows is not supported!") + + vollog.debug(f"Using GUI table {symbol_filename}") + + return intermed.IntermediateSymbolTable.create( + context, + config_path, + os.path.join("windows", "gui"), + symbol_filename, + class_types=gui.class_types, + native_types=native_types, + table_mapping=table_mapping, + ) + + @classmethod + def get_session_map( + cls, + context: interfaces.context.ContextInterface, + module_name: str, + gui_table_name: str, + ) -> Dict[int, interfaces.context.ModuleInterface]: + """ + Walks each session layer and returns a dictionary that + maps session identifiers to a module in the session's layer + """ + session_map = modules.Modules.get_session_layers_map(context, module_name) + + for session_id, session_layer in session_map.items(): + session_module = context.module( + gui_table_name, layer_name=session_layer, offset=0 + ) + session_map[session_id] = session_module + + return session_map + + @classmethod + def scan_gui_object( + cls, + context: interfaces.context.ContextInterface, + config_path: str, + kernel_module_name: str, + object_tag: bytes, + object_type: str, + ) -> Generator[interfaces.objects.ObjectInterface, None, None]: + """ + An API that generically scans for GUI (win32*.sys) objects allocated in the pools (which is nearly all of them) + + This function scans within the kernel space for the tags and then uses `get_session_map` to instantiate objects + in their correct session address space. + + Args: + context: + config_path: + kernel_module_name: + object_tag: The 4 byte pool header tag to search for + object_type: The data structure of the GUI object within the pool + """ + + kernel = context.modules[kernel_module_name] + + gui_table_name = cls.create_gui_table( + context, kernel.symbol_table_name, config_path + ) + + constraints = poolscanner.PoolScanner.gui_poolscanner_constraints( + gui_table_name, [object_tag] + ) + + session_map = cls.get_session_map(context, kernel_module_name, gui_table_name) + + for result in poolscanner.PoolScanner.generate_pool_scan_extended( + context, + kernel.layer_name, + kernel.symbol_table_name, + gui_table_name, + constraints, + ): + _constraint, mem_object, _header = result + + # enforce that objects are in a valid session + # this prevents smear and also ensures future pointer + # dereferences are performed in the correct address space (layer) + try: + session_id = mem_object.get_session_id() + except exceptions.InvalidAddressException: + continue + + if session_id is not None: + session_module = session_map.get(session_id, None) + if session_module: + # create the object its own address space (per-session) + yield session_module.object( + object_type=object_type, offset=mem_object.vol.offset + ) + + @classmethod + def scan_window_stations( + cls, + context: interfaces.context.ContextInterface, + config_path: str, + kernel_module_name: str, + ) -> Iterator[Tuple["gui.tagWINDOWSTATION", str, int]]: + """ + Scans for window stations through `scan_gui_object` + Yields each window station along with its name and session_id + """ + + seen = set() + + kernel = context.modules[kernel_module_name] + + for scanned_winsta in cls.scan_gui_object( + context, config_path, kernel_module_name, b"Wind", "tagWINDOWSTATION" + ): + # walk the list of each station found through scanning + for winsta in scanned_winsta.traverse(): + if winsta.vol.offset in seen: + continue + seen.add(winsta.vol.offset) + + # stations need to have a name and be in a session + name, session_id = winsta.get_info(kernel.symbol_table_name) + if name and session_id is not None: + yield winsta, name, session_id + + def _generator(self): + """ + A wrapper around `scan_window_stations` + """ + for winsta, name, session_id in self.scan_window_stations( + self.context, self.config_path, self.config["kernel"] + ): + yield ( + 0, + ( + format_hints.Hex(winsta.vol.offset), + name, + session_id, + ), + ) + + # Volatility 2 reported whether the station is interactive or not, but I could not determine if its algorithm + # is currently valid. I also did not see where the old code paths still checked the same bit mask + def run(self): + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Name", str), + ("SessionId", int), + ], + self._generator(), + ) diff --git a/volatility3/framework/symbols/windows/extensions/gui.py b/volatility3/framework/symbols/windows/extensions/gui.py new file mode 100644 index 000000000..92693dba5 --- /dev/null +++ b/volatility3/framework/symbols/windows/extensions/gui.py @@ -0,0 +1,127 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +from typing import Optional, Tuple, Iterator + +from volatility3.framework import exceptions, constants, interfaces +from volatility3.framework import objects +from volatility3.framework.objects import utility +from volatility3.framework.symbols.windows.extensions import pool + + +class tagWINDOWSTATION(objects.StructType, pool.ExecutiveObject): + def is_valid(self) -> bool: + sid = self.get_session_id() + return sid is not None and 0 <= sid < 256 + + def get_session_id(self) -> Optional[int]: + try: + return self.dwSessionId + except exceptions.InvalidAddressException: + return None + + def traverse(self, max_stations: int = 15): + """ + Traverses the window stations referenced in the list of stations + """ + seen = set() + + # include the first window station + yield self + + while len(seen) < max_stations: + try: + winsta = self.rpwinstaNext.dereference() + except exceptions.InvalidAddressException: + break + + if winsta.vol.offset in seen: + break + + yield winsta + + seen.add(winsta.vol.offset) + + def get_info(self, kernel_symbol_table_name) -> Optional[Tuple[str, int]]: + try: + name = self.get_name(kernel_symbol_table_name) + session_id = self.get_session_id() + except exceptions.InvalidAddressException: + return None, None + + # attempt to avoid smear + if session_id is not None and session_id < 256 and name and len(name) > 1: + return name, session_id + + return None, None + + def desktops(self, symbol_table_name, max_desktops: int = 12): + seen = set() + + while len(seen) < max_desktops: + try: + desktop = self.rpdeskList.dereference() + name = desktop.get_name(symbol_table_name) + except exceptions.InvalidAddressException: + break + + if desktop.vol.offset in seen: + break + + yield desktop, name + + seen.add(desktop.vol.offset) + + +class tagDESKTOP(objects.StructType, pool.ExecutiveObject): + def is_valid(self) -> bool: + """ + Enforce a valid sid + owning window station + """ + sid = self.get_session_id() + + valid_sid = sid is not None and 0 <= sid < 256 + + if valid_sid: + return self.get_window_station() is not None + + return False + + def get_window_station(self) -> Optional["tagWINDOWSTATION"]: + try: + return self.rpwinstaParent.dereference() + except exceptions.InvalidAddressException: + return None + + def get_session_id(self) -> Optional[int]: + winsta = self.get_window_station() + if winsta: + return winsta.get_session_id() + + return None + + def get_threads( + self, + ) -> Iterator[Tuple[interfaces.objects.ObjectInterface, str, int]]: + """ + Returns the threads of each desktop along with owning process information + """ + symbol_table_name = self.vol.type_name.split(constants.BANG)[0] + + for thread in self.PtiList.to_list( + symbol_table_name + constants.BANG + "tagTHREADINFO", "PtiLink" + ): + try: + process_name = utility.array_to_string(thread.ppi.Process.ImageFileName) + process_pid = thread.ppi.Process.UniqueProcessId + except exceptions.InvalidAddressException: + continue + + yield thread, process_name, process_pid + + +class_types = { + "tagWINDOWSTATION": tagWINDOWSTATION, + "tagDESKTOP": tagDESKTOP, +} From 3750b88ba499e35f1985ea53e1b59daca13e1d3b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 25 Feb 2025 10:12:07 -0600 Subject: [PATCH 0693/1352] Windows WindowStations: Fix issue with native types --- .../plugins/windows/windowstations.py | 3 +- .../windows/gui/gui-win10-10586-x64.json | 38 +++++++++---------- .../windows/gui/gui-win10-15063-x64.json | 38 +++++++++---------- .../windows/gui/gui-win10-16299-x64.json | 38 +++++++++---------- .../windows/gui/gui-win10-17134-x64.json | 38 +++++++++---------- .../windows/gui/gui-win10-17763-x64.json | 38 +++++++++---------- .../windows/gui/gui-win10-18362-x64.json | 38 +++++++++---------- .../windows/gui/gui-win10-19041-x64.json | 38 +++++++++---------- .../windows/gui/gui-win10-19577-x64.json | 38 +++++++++---------- .../symbols/windows/gui/gui-win7sp0-x64.json | 38 +++++++++---------- .../symbols/windows/gui/gui-win7sp1-x64.json | 38 +++++++++---------- .../symbols/windows/gui/gui-win8-x64.json | 38 +++++++++---------- 12 files changed, 211 insertions(+), 210 deletions(-) diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index cb6a52b88..6dac484f5 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -64,7 +64,8 @@ class WindowStations(interfaces.plugins.PluginInterface): Returns: The name of the constructed GUI table """ - native_types = context.symbol_space[symbol_table].natives + + native_types = intermed.native.x64NativeTable if not symbols.symbol_table_is_64bit(context, symbol_table): raise NotImplementedError( diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json index 5f280725c..4533c6eba 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json @@ -4225,21 +4225,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8099,112 +8099,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json index 26e7356b9..4405d0375 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json @@ -4225,21 +4225,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8099,112 +8099,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json index bde774987..67fb6c531 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json @@ -4225,21 +4225,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8099,112 +8099,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json index cd5ca7169..d341a3fd0 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json @@ -4225,21 +4225,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8099,112 +8099,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json index 00d3f61f3..a9c2e5995 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json @@ -4225,21 +4225,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8099,112 +8099,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json index dc458970e..22f6d17b4 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json @@ -4225,21 +4225,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8099,112 +8099,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json index 09f518451..f26523a1a 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json @@ -4225,21 +4225,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8099,112 +8099,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json index 5c9f4d814..7a1a405a3 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json @@ -4225,21 +4225,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8099,112 +8099,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json b/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json index 6c2e7dd17..80de6b279 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json @@ -4812,21 +4812,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8686,112 +8686,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json b/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json index 76e3d8100..2d4b63380 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json @@ -4181,21 +4181,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8072,112 +8072,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } diff --git a/volatility3/framework/symbols/windows/gui/gui-win8-x64.json b/volatility3/framework/symbols/windows/gui/gui-win8-x64.json index 3f3193e35..ffc2bf90b 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win8-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win8-x64.json @@ -4181,21 +4181,21 @@ "Blue": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "Green": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "Red": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 } @@ -8055,112 +8055,112 @@ "_41": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 48 }, "_42": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 52 }, "_43": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 56 }, "_44": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 60 }, "_34": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 44 }, "_14": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 12 }, "_13": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 8 }, "_12": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 4 }, "_11": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 0 }, "_24": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 28 }, "_31": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 32 }, "_33": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 40 }, "_32": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 36 }, "_22": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 20 }, "_23": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 24 }, "_21": { "type": { "kind": "base", - "name": "f32" + "name": "float" }, "offset": 16 } From 06a2ebd9ff3e1a24c666c428b0a51254c31e82c8 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 18:39:43 -0600 Subject: [PATCH 0694/1352] Windows GUI Symbols: JSON Lint --- .../windows/gui/gui-win10-10586-x64.json | 37562 +++++++-------- .../windows/gui/gui-win10-15063-x64.json | 37562 +++++++-------- .../windows/gui/gui-win10-16299-x64.json | 37562 +++++++-------- .../windows/gui/gui-win10-17134-x64.json | 37648 ++++++++-------- .../windows/gui/gui-win10-17735-x64.json | 37648 ++++++++-------- .../windows/gui/gui-win10-17763-x64.json | 37648 ++++++++-------- .../windows/gui/gui-win10-18362-x64.json | 37648 ++++++++-------- .../windows/gui/gui-win10-19041-x64.json | 37648 ++++++++-------- .../windows/gui/gui-win10-19577-x64.json | 37648 ++++++++-------- .../symbols/windows/gui/gui-win7sp0-x64.json | 37362 +++++++-------- .../symbols/windows/gui/gui-win7sp1-x64.json | 37348 +++++++-------- .../symbols/windows/gui/gui-win8-x64.json | 37474 +++++++-------- 12 files changed, 225379 insertions(+), 225379 deletions(-) diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json index 4533c6eba..a542d4778 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json @@ -1,18787 +1,18787 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 656 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 440 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 784 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 784 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 216 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 160 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 656 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 440 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 784 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 784 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 216 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 32 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 160 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json index 4405d0375..7c4af02e1 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json @@ -1,18787 +1,18787 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 792 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 656 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 440 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 776 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 792 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 656 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 440 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 776 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 232 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 32 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json index 67fb6c531..1ff5fdcd9 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json @@ -1,18787 +1,18787 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 880 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 712 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 464 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 784 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 880 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 712 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 464 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 784 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 232 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 32 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json index d341a3fd0..f74c8dd5b 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json @@ -1,18830 +1,18830 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 880 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 728 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 464 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 824 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 880 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 728 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 464 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 456 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 824 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "subPointer": { - "type": { - "subtype": { - "kind": "struct", - "name": "subTagWNDType" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "directName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!String" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 232 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "subTagWNDType": { - "fields": { - "style_bitmask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - } - }, - "kind": "struct", - "size": 128 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 40 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json index b4c615cff..88e419100 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json @@ -1,18830 +1,18830 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 880 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 464 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 824 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 880 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 736 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 464 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 456 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 824 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "subPointer": { - "type": { - "subtype": { - "kind": "struct", - "name": "subTagWNDType" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "directName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!String" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 232 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "subTagWNDType": { - "fields": { - "style_bitmask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - } - }, - "kind": "struct", - "size": 128 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 40 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json index a9c2e5995..ed183f39b 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json @@ -1,18830 +1,18830 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 896 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 480 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 824 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 896 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 736 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 480 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 456 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 824 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "subPointer": { - "type": { - "subtype": { - "kind": "struct", - "name": "subTagWNDType" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "directName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!String" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 232 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "subTagWNDType": { - "fields": { - "style_bitmask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - } - }, - "kind": "struct", - "size": 128 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 40 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json index 22f6d17b4..f568eedbe 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json @@ -1,18830 +1,18830 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 904 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 480 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 824 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 904 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 736 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 480 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 456 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 824 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "subPointer": { - "type": { - "subtype": { - "kind": "struct", - "name": "subTagWNDType" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "directName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!String" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 232 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "subTagWNDType": { - "fields": { - "style_bitmask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - } - }, - "kind": "struct", - "size": 128 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 40 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json index f26523a1a..be4341cfd 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json @@ -1,18830 +1,18830 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 896 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 480 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 832 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 896 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 736 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 480 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 456 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 832 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "subPointer": { - "type": { - "subtype": { - "kind": "struct", - "name": "subTagWNDType" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "directName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!String" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 232 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "subTagWNDType": { - "fields": { - "style_bitmask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - } - }, - "kind": "struct", - "size": 128 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 40 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json index 7a1a405a3..68692dcf4 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json @@ -1,18830 +1,18830 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 656 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 904 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 736 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 480 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 456 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "inclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "request": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 18 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "next_request": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 16 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "hidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 832 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 384 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "subPointer": { + "type": { + "subtype": { + "kind": "struct", + "name": "subTagWNDType" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "directName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!String" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 232 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "subTagWNDType": { + "fields": { + "style_bitmask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + } + }, + "kind": "struct", + "size": 128 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 40 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 656 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 904 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 736 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 480 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 456 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "inclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "request": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 18 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "next_request": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 16 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "hidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 832 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 384 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "subPointer": { - "type": { - "subtype": { - "kind": "struct", - "name": "subTagWNDType" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "directName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!String" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 232 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "subTagWNDType": { - "fields": { - "style_bitmask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - } - }, - "kind": "struct", - "size": 128 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 40 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json b/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json index 80de6b279..ec81241b2 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json @@ -1,18683 +1,18683 @@ { - "symbols": {}, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - }, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 552 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 384 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 344 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 608 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 408 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 736 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 344 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "bType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 216 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 32 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 - } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - } + "symbols": {}, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 + } + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" + }, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 552 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 384 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 344 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 608 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 408 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 736 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 344 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "bType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 216 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 + } + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + } + } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json b/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json index 2d4b63380..ae844e535 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json @@ -1,18680 +1,18680 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 552 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 384 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 344 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 608 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 408 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 736 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 344 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_180f": { + "fields": { + "Data": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "bType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fAssigned": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 216 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 168 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 552 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 384 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 344 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 608 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 408 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 736 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 344 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_180f": { - "fields": { - "Data": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "bType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fAssigned": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 216 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 32 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 168 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } diff --git a/volatility3/framework/symbols/windows/gui/gui-win8-x64.json b/volatility3/framework/symbols/windows/gui/gui-win8-x64.json index ffc2bf90b..e7581413f 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win8-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win8-x64.json @@ -1,18743 +1,18743 @@ { - "symbols": {}, - "user_types": { - "HWINSTA__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 + "symbols": {}, + "user_types": { + "HWINSTA__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1153": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 59 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 9 + }, + "offset": 0 + }, + "Region": { + "type": { + "bit_position": 61, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 39 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1960": { + "fields": { + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagCLIENTTHREADINFO": { + "fields": { + "fsWakeMask": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "CTIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fsWakeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + }, + "fsWakeBitsJournal": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "fsChangeBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4 + }, + "tickLastMsgChecked": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "tagKbdNlsLayer": { + "fields": { + "OEMIdentifier": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "NumOfVkToF": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pusMouseVKey": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "NumOfMouseVKey": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pVkToF": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_FUNCTION_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "LayoutInformation": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1158": { + "fields": { + "Reserved": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 2 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + }, + "Init": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HBITMAP__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_124b": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "count": 3, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1 + }, + "InPath": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_TL": { + "fields": { + "pfnFree": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pobj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagTOUCHINPUTINFO": { + "fields": { + "dwcInputs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "TouchInput": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagTOUCHINPUT" + }, + "kind": "array" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 80 + }, + "tagTHREADINFO": { + "fields": { + "ForceLegacyResizeNCMetr": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptl": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 336 + }, + "timeLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 448 + }, + "DontJournalAttach": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fPack": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 26 + }, + "offset": 928 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 516 + }, + "psmsSent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 424 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 552 + }, + "DefaultCharset": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 512 + }, + "psmsReceiveList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 440 + }, + "sphkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 560 + }, + "No50ExStyles": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "IgnoreFaults": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pClientInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTINFO" + }, + "kind": "pointer" + }, + "offset": 400 + }, + "DDENoAsyncReg": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DealyHwndShakeChk": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "amdesk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 720 + }, + "fsChangeBitsRemoved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 704 + }, + "psmsCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 432 + }, + "NoInitFlagsOnFocus": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "StrictLLHook": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "NoShadow": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EnumHelv": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoBatching": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 736 + }, + "Winver31": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Win30AvgWidth": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "AlwaysSendSyncPaint": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "IgnoreNoDiscard": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cPaintsReady": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 480 + }, + "SubtractClips": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "apEvent": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 712 + }, + "cEnterCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 672 + }, + "OpenGLEMF": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "fThreadCleanupFinished": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "idLast": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 456 + }, + "DisableDBCSProp": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "NoEMFSpooling": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptdb": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "SpareCompatFlags2": { + "type": { + "bit_position": 33, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 31 + }, + "offset": 520 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "mlPost": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 680 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 496 + }, + "NoCustomPaperSize": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cTimersReady": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 484 + }, + "NoScrollBarCtxMenu": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hPrevHidData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 880 + }, + "NoPaddedBorder": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "DpiAware": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "MultipleBands": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 376 + }, + "AnimationOff": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "No50ExStyleBits": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ulThreadFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 928 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 472 + }, + "spklActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 360 + }, + "MoreExtraWndWords": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "NoGhost": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoHRGN1": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "ptLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 628 + }, + "GiveUpForegound": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "spDefaultImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 656 + }, + "pmsd": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MOVESIZEDATA" + }, + "kind": "pointer" + }, + "offset": 544 + }, + "HardwareMixer": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 904 + }, + "EnumTTNotDevice": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fSpecialInitialization": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ForceFusion": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "cti": { + "type": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "offset": 864 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pstrAppName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 416 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "SendMnuDblClk": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "DDENoSync": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "EditNoMouseHide": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ptLastReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 636 + }, + "hTouchInputCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HTOUCHINPUT__" + }, + "kind": "pointer" + }, + "offset": 888 + }, + "pEventQueueServer": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "cNestedStableVisRgn": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "NoDrawPatRect": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ForceTTGrapchis": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "GetDeviceCaps": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fsReserveKeys": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 708 + }, + "pq": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 352 + }, + "NoSoftCursOnMoveSize": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "hEventQueueClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 592 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "DDE": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "exitCode": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 464 + }, + "wchInjected": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 706 + }, + "CallTTDevice": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "MsShellDlg": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TransparentBltMirror": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "PtiLink": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 640 + }, + "HackWinFlags": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "cVisWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 728 + }, + "NcCalcSizeOnMove": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "KCOff": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "readyHead": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 912 + }, + "pMenuState": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 488 + }, + "UsePrintingEscape": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "hGestureInfoCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "HGESTUREINFO__" + }, + "kind": "pointer" + }, + "offset": 896 + }, + "ForceTextBand": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cWindows": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 724 + }, + "fETWReserved": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 928 + }, + "pqAttach": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 528 + }, + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "TIF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 408 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "Win31DevModeSize": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSBTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBTRACK" + }, + "kind": "pointer" + }, + "offset": 584 + }, + "spwndDefaultIme": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 648 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 520 + }, + "EditSetTextMunge": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "Random31Ux": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "fgfSwitchInProgressSetter": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 928 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 392 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "NoTimeCbProtect": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "DisableFontAssoc": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pcti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 368 + }, + "NoCharDeadKey": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "TTIgnoreRasterDupe": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "lParamHkCurrent": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 568 + }, + "qwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 520 + }, + "wParamHkCurrent": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 576 + }, + "NoWindowArrangement": { + "type": { + "bit_position": 32, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "ActiveMenus": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 384 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "psiiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 504 + }, + "IgnoreTopMost": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "TryExceptCallWndProc": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "NoDDETrackDying": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "FontSubs": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 520 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "SmoothScrolling": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 624 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "ptiSibling": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 536 + }, + "hklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "IncreaseStack": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 516 + } + }, + "kind": "struct", + "size": 936 + }, + "__unnamed_11ff": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "EaLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FileAttributes": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_CALLPROCDATA": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "pfnClientPrevious": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "wType": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "spcpdNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH": { + "fields": { + "VidPnTargetColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 48 + }, + "VidPnTargetColorBasis": { + "type": { + "kind": "enum", + "name": "VidPnTargetColorBasisEnum" + }, + "offset": 44 + }, + "ContentTransformation": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" + }, + "offset": 12 + }, + "GammaRamp": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GAMMA_RAMP" + }, + "offset": 336 + }, + "CopyProtection": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" + }, + "offset": 68 + }, + "VidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Content": { + "type": { + "kind": "enum", + "name": "ContentEnum" + }, + "offset": 64 + }, + "VisibleFromActiveTLOffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 28 + }, + "VidPnTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "VisibleFromActiveBROffset": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 36 + }, + "ImportanceOrdinal": { + "type": { + "kind": "enum", + "name": "ImportanceOrdinalEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 360 + }, + "__unnamed_1253": { + "fields": { + "PowerSequence": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_POWER_SEQUENCE" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESS_HID_TABLE": { + "fields": { + "UsagePageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 96 + }, + "fExclusiveMouseSink": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboardSink": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fAppKeys": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fCaptureMouse": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyMouse": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawKeyboard": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fNoLegacyKeyboard": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "nSinks": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fExclusiveKeyboardSink": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "spwndTargetKbd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "UsagePageList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 32 + }, + "UsageLast": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 98 + }, + "fNoHotKeys": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "pLastRequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_REQUEST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "ExclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + }, + "spwndTargetMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fRawMouse": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "fRawMouseSink": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 100 + }, + "InclusionList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1809": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "MessageCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHOOK": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "iHook": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "phkNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "offPfn": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "fLastHookHung": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 88 + }, + "nTimeout": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 7 + }, + "offset": 88 + }, + "ihmod": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "ptiHooked": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 80 + } + }, + "kind": "struct", + "size": 96 + }, + "_THROBJHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagPROCESS_HID_REQUEST": { + "fields": { + "fSinkable": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "pTLCInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_TLC_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fDevNotify": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "fExSinkable": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "ptr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "pPORequest": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHID_PAGEONLY_REQUEST" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "fExclusiveOrphaned": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 20 + }, + "spwndTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + } + }, + "kind": "struct", + "size": 40 + }, + "_KFLOATING_SAVE": { + "fields": { + "Dummy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { + "fields": { + "Rotate270": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate90": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Rotate180": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMLIST": { + "fields": { + "cMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pqmsgRead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pqmsgWriteLast": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_CONSOLE_CARET_INFO": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1807": { + "fields": { + "Affinity": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Vector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + }, + "Level": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "DEADKEY": { + "fields": { + "wchComposed": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 4 + }, + "dwBoth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uFlags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 6 + } + }, + "kind": "struct", + "size": 8 + }, + "tagPROCESSINFO": { + "fields": { + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "fHasMagContext": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 736 + }, + "hwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWINSTA__" + }, + "kind": "pointer" + }, + "offset": 608 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ptiList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 256 + }, + "pHidTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESS_HID_TABLE" + }, + "kind": "pointer" + }, + "offset": 744 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "pclsPublicList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 288 + }, + "dwhmodLibLoadedMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 340 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "hdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDESK__" + }, + "kind": "pointer" + }, + "offset": 328 + }, + "pvwplWndGCList": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 760 + }, + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "dwImeCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 696 + }, + "hMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HMONITOR__" + }, + "kind": "pointer" + }, + "offset": 624 + }, + "ptiMainThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "dwRegisteredClasses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 752 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "usi": { + "type": { + "kind": "struct", + "name": "tagUSERSTARTUPINFO" + }, + "offset": 708 + }, + "luidSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 700 + }, + "Unused": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 736 + }, + "pW32Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 688 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 320 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "bmHandleFlags": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_BITMAP" + }, + "offset": 648 + }, + "pclsPrivateList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "amwinsta": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 616 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ppiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 736 + }, + "dwHotkey": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 620 + }, + "cSysExpunge": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "rpdeskStartup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pdvList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 632 + }, + "pwpi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "ppiNextRunning": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "dwLayout": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 740 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "rpwinsta": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 600 + }, + "pCursorCache": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 664 + }, + "pClientBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 672 + }, + "ahmodLibLoaded": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 344 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 640 + }, + "dwLpkEntryPoints": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 680 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 768 + }, + "HBRUSH__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLIP": { + "fields": { + "fmt": { + "type": { + "kind": "enum", + "name": "fmtEnum" + }, + "offset": 0 + }, + "fGlobalHandle": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagUAHMENUPOPUPMETRICS": { + "fields": { + "rgcx": { + "type": { + "count": 4, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 0 + }, + "fUpdateMaxWidths": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 20 + }, + "tagSMS": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 72 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 80 + }, + "lpResultCallBack": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lRet": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 56 + }, + "psmsReceiveNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "tSent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "pvCapture": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "psmsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSMS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ptiReceiver": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ptiCallBackSender": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "dwData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 112 + }, + "__unnamed_195e": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_195c": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Alignment40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 24 + }, + "_W32THREAD": { + "fields": { + "pRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "iVisRgnUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 328 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pDevHTInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "pUMPDHeap": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pgdiBrushAttr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ulWindowSystemRendering": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "tlSpriteState": { + "type": { + "kind": "struct", + "name": "_TLSPRITESTATE" + }, + "offset": 104 + }, + "pdcoRender": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "bEnableEngUpdateDeviceSurface": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 320 + }, + "pdcoAA": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 296 + }, + "pNonRBRecursionCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "ptlW32": { + "type": { + "subtype": { + "kind": "struct", + "name": "_TL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "GdiTmpTgoList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 80 + }, + "pUMPDObjs": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pgdiDcattr": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "bIncludeSprites": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 321 + }, + "pEThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pSpriteState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "pProxyPort": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "ulDevHTInfoUniqueness": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "pdcoSrc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 312 + }, + "pUMPDObj": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pClientID": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 336 + }, + "_VK_TO_WCHAR_TABLE": { + "fields": { + "pVkToWchars": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHARS1" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cbSize": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + }, + "nModifications": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPROPLIST": { + "fields": { + "aprop": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "tagPROP" + }, + "kind": "array" + }, + "offset": 8 + }, + "iFirstFree": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cEntries": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_D3DKMDT_FREQUENCY_RANGE": { + "fields": { + "MinVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 0 + }, + "MaxVSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 8 + }, + "MaxHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 24 + }, + "MinHSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_11f8": { + "fields": { + "Apc": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KAPC" + }, + "offset": 0 + }, + "CompletionKey": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Overlay": { + "type": { + "kind": "struct", + "name": "__unnamed_11f5" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_18bf": { + "fields": { + "BaseMiddle": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "Flags1": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "Flags2": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "tagPROFILEVALUEINFO": { + "fields": { + "dwValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "uSection": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "pwszKeyName": { + "type": { + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_11f5": { + "fields": { + "Thread": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ETHREAD" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "DeviceQueueEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" + }, + "offset": 0 + }, + "CurrentStackLocation": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_STACK_LOCATION" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "DriverContext": { + "type": { + "count": 4, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 0 + }, + "AuxiliaryBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "OriginalFileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "PacketType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 80 + }, + "__unnamed_125f": { + "fields": { + "AllocatedResources": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "AllocatedResourcesTranslated": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_CM_RESOURCE_LIST" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "D3DDDI_DXGI_RGB": { + "fields": { + "Blue": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "Green": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "Red": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1219": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FsControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_125b": { + "fields": { + "State": { + "type": { + "kind": "struct", + "name": "nt_symbols!_POWER_STATE" + }, + "offset": 16 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 8 + }, + "SystemContext": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ShutdownType": { + "type": { + "kind": "enum", + "name": "ShutdownTypeEnum" + }, + "offset": 24 + }, + "SystemPowerStateContext": { + "type": { + "kind": "struct", + "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "HDC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagDISPLAYINFO": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "SpatialListHead": { + "type": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "offset": 144 + }, + "BitCountMax": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 130 + }, + "cyGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "hdcBits": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fDesktopIsRect": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "hbmGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pmdev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "cFullScreen": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 160 + }, + "cxGray": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 128 + }, + "hDevInfo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fAnyPalette": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 132 + }, + "pspbFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pMonitorPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 162 + }, + "pMonitorFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "hdcGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "hrgnScreenReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cMonitors": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "hdcScreen": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "DockThresholdMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "pdceFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 168 + }, + "tagWin32AllocStats": { + "fields": { + "dwMaxAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwMaxMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwCrtAlloc": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwCrtMem": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18c5": { + "fields": { + "DefaultBig": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "BaseMiddle": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "BaseHigh": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 8 + }, + "offset": 0 + }, + "LimitHigh": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 0 + }, + "System": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Granularity": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Dpl": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 0 + }, + "Type": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "Present": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "LongMode": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1261": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ProviderId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "BufferSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DataPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1263": { + "fields": { + "Argument4": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Argument2": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Argument3": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "Argument1": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1265": { + "fields": { + "DeviceIoControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121d" + }, + "offset": 0 + }, + "ReadWriteConfig": { + "type": { + "kind": "struct", + "name": "__unnamed_123d" + }, + "offset": 0 + }, + "Create": { + "type": { + "kind": "struct", + "name": "__unnamed_11ff" + }, + "offset": 0 + }, + "Write": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "PowerSequence": { + "type": { + "kind": "struct", + "name": "__unnamed_1253" + }, + "offset": 0 + }, + "QueryId": { + "type": { + "kind": "struct", + "name": "__unnamed_1243" + }, + "offset": 0 + }, + "SetFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1213" + }, + "offset": 0 + }, + "CreatePipe": { + "type": { + "kind": "struct", + "name": "__unnamed_1203" + }, + "offset": 0 + }, + "Power": { + "type": { + "kind": "struct", + "name": "__unnamed_125b" + }, + "offset": 0 + }, + "Read": { + "type": { + "kind": "struct", + "name": "__unnamed_1209" + }, + "offset": 0 + }, + "StartDevice": { + "type": { + "kind": "struct", + "name": "__unnamed_125f" + }, + "offset": 0 + }, + "QueryDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120d" + }, + "offset": 0 + }, + "LockControl": { + "type": { + "kind": "struct", + "name": "__unnamed_121b" + }, + "offset": 0 + }, + "QueryInterface": { + "type": { + "kind": "struct", + "name": "__unnamed_1233" + }, + "offset": 0 + }, + "Others": { + "type": { + "kind": "struct", + "name": "__unnamed_1263" + }, + "offset": 0 + }, + "FileSystemControl": { + "type": { + "kind": "struct", + "name": "__unnamed_1219" + }, + "offset": 0 + }, + "SetLock": { + "type": { + "kind": "struct", + "name": "__unnamed_123f" + }, + "offset": 0 + }, + "QueryDeviceText": { + "type": { + "kind": "struct", + "name": "__unnamed_1247" + }, + "offset": 0 + }, + "WMI": { + "type": { + "kind": "struct", + "name": "__unnamed_1261" + }, + "offset": 0 + }, + "CreateMailslot": { + "type": { + "kind": "struct", + "name": "__unnamed_1207" + }, + "offset": 0 + }, + "FilterResourceRequirements": { + "type": { + "kind": "struct", + "name": "__unnamed_123b" + }, + "offset": 0 + }, + "MountVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QueryVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1217" + }, + "offset": 0 + }, + "UsageNotification": { + "type": { + "kind": "struct", + "name": "__unnamed_124b" + }, + "offset": 0 + }, + "Scsi": { + "type": { + "kind": "struct", + "name": "__unnamed_1229" + }, + "offset": 0 + }, + "WaitWake": { + "type": { + "kind": "struct", + "name": "__unnamed_124f" + }, + "offset": 0 + }, + "QueryFile": { + "type": { + "kind": "struct", + "name": "__unnamed_1211" + }, + "offset": 0 + }, + "VerifyVolume": { + "type": { + "kind": "struct", + "name": "__unnamed_1225" + }, + "offset": 0 + }, + "QuerySecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_121f" + }, + "offset": 0 + }, + "QueryDeviceRelations": { + "type": { + "kind": "struct", + "name": "__unnamed_122d" + }, + "offset": 0 + }, + "NotifyDirectory": { + "type": { + "kind": "struct", + "name": "__unnamed_120f" + }, + "offset": 0 + }, + "SetSecurity": { + "type": { + "kind": "struct", + "name": "__unnamed_1221" + }, + "offset": 0 + }, + "DeviceCapabilities": { + "type": { + "kind": "struct", + "name": "__unnamed_1237" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1817": { + "fields": { + "Length48": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1815": { + "fields": { + "Length40": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "tagKbdLayer": { + "fields": { + "pVkToWcharTable": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VK_TO_WCHAR_TABLE" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fLocaleFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "pCharModifiers": { + "type": { + "subtype": { + "kind": "struct", + "name": "MODIFIERS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pKeyNamesExt": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pDeadKey": { + "type": { + "subtype": { + "kind": "struct", + "name": "DEADKEY" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pusVSCtoVK": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pKeyNamesDead": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pLigature": { + "type": { + "subtype": { + "kind": "struct", + "name": "_LIGATURE1" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "cbLgEntry": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 85 + }, + "pKeyNames": { + "type": { + "subtype": { + "kind": "struct", + "name": "VSC_LPWSTR" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "dwSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "nLgMax": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 84 + }, + "pVSCtoVK_E1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pVSCtoVK_E0": { + "type": { + "subtype": { + "kind": "struct", + "name": "_VSC_VK" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "bMaxVSCtoVK": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1813": { + "fields": { + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { + "fields": { + "Centered": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "AspectRatioCenteredMax": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Stretched": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Identity": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Custom": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1958": { + "fields": { + "MinBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "MaxBusNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_2DREGION": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "HRGN__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1954": { + "fields": { + "AffinityPolicy": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "PriorityPolicy": { + "type": { + "kind": "enum", + "name": "PriorityPolicyEnum" + }, + "offset": 12 + }, + "Group": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "MaximumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "TargetedProcessors": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "MinimumVector": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "_PROCMARKHEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagSIZE": { + "fields": { + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagDESKTOPVIEW": { + "fields": { + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "pdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pdvNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPVIEW" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1819": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length64": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { + "fields": { + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "PathAndTargetModeSetOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBTRACK": { + "fields": { + "spwndSBNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hTimerSB": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "cmdSB": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "xxxpfnSB": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fTrackVert": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posNew": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 84 + }, + "posOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "fCtlSB": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "rcTrack": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 32 + }, + "fTrackRecalc": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndSB": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "pxOld": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fHitOld": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "pSBCalc": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBCALC" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "nBar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 88 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_16c1": { + "fields": { + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "MaxPixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_DMA_ADAPTER": { + "fields": { + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 0 + }, + "DmaOperations": { + "type": { + "subtype": { + "kind": "struct", + "name": "_DMA_OPERATIONS" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMONITOR": { + "fields": { + "hDev": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "rcMonitorReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 28 + }, + "pMonitorNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hDevReal": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "hrgnMonitorReal": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "rcWorkReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 44 + }, + "dwMONFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cWndStack": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 74 + }, + "DockTargets": { + "type": { + "count": 7, + "subtype": { + "count": 4, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "kind": "array" + }, + "offset": 96 + }, + "Spare0": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 144 + }, + "__unnamed_180b": { + "fields": { + "Translated": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Raw": { + "type": { + "kind": "struct", + "name": "__unnamed_1809" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagRECT": { + "fields": { + "top": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "right": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "bottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "left": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_180d": { + "fields": { + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Port": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Channel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "MODIFIERS": { + "fields": { + "wMaxModBits": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + }, + "pVkToBit": { + "type": { + "subtype": { + "kind": "struct", + "name": "VK_TO_BIT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ModNumber": { + "type": { + "count": 0, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 10 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120f": { + "fields": { + "CompletionFilter": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_120d": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 16 + }, + "FileName": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { + "fields": { + "PathAndTargetModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 48 + }, + "NumPathsFromSource": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 40 + }, + "SourceMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_SOURCE_MODE" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 480 + }, + "tagMSG": { + "fields": { + "wParam": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "lParam": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 24 + }, + "pt": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 36 + }, + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "time": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "message": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 48 + }, + "tagDPISERVERINFO": { + "fields": { + "hMsgFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hCaptionFont": { + "type": { + "subtype": { + "kind": "struct", + "name": "HFONT__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "gclBorder": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cxMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "wMaxBtnSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "cyMsgFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { + "fields": { + "Blue": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 1024 + }, + "Green": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 512 + }, + "Red": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1536 + }, + "__unnamed_124f": { + "fields": { + "PowerState": { + "type": { + "kind": "enum", + "name": "PowerStateEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagWOWPROCESSINFO": { + "fields": { + "ptdbHead": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ptiScheduled": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "nRecvLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CSLockCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "nSendLock": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pEventWowExec": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "lpfnWowExitTask": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "CSOwningThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "hEventWowExecClient": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwpiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "HTOUCHINPUT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagMENU": { + "fields": { + "iItem": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCDESKHEAD" + }, + "offset": 0 + }, + "umpm": { + "type": { + "kind": "struct", + "name": "tagUAHMENUPOPUPMETRICS" + }, + "offset": 132 + }, + "cItems": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pParentMenus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "fFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "cxMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "dwContextHelpId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "cxTextAlign": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "cAlloced": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "hbrBack": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwArrowsOn": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 128 + }, + "iMaxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 124 + }, + "dwMenuData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "cyMenu": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "rgItems": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagITEM" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "cyMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + } + }, + "kind": "struct", + "size": 152 + }, + "_D3DDDI_GAMMA_RAMP_DXGI_1": { + "fields": { + "GammaCurve": { + "type": { + "count": 1025, + "subtype": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "kind": "array" + }, + "offset": 24 + }, + "Scale": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 0 + }, + "Offset": { + "type": { + "kind": "struct", + "name": "D3DDDI_DXGI_RGB" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 12324 + }, + "_MOVESIZEDATA": { + "fields": { + "fmsKbd": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "pStartMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "impy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 152 + }, + "fMoveFromMax": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapMoving": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "frcNormalCheckPtValid": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptMaxTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 96 + }, + "ptRestore": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 156 + }, + "fUsePreviewRect": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForceSizing": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fThresholdSelector": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 3 + }, + "offset": 164 + }, + "ptStartHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 208 + }, + "fDragFullWindows": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fForeground": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "dyMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 140 + }, + "fHasSoftwareCursor": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsHitPtOffScreen": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fSnapSizingTemporaryAllowed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fCheckPtForcefullyRestored": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedRight": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ulCountDragOutOfLeftRightTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 228 + }, + "Unused": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 4 + }, + "offset": 164 + }, + "dxMouse": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 136 + }, + "fStartVerticallyMaximizedRight": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcParent": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 72 + }, + "fOffScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fWindowWasSuperMaximized": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fVerticallyMaximizedLeft": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "StartCurrentHitTarget": { + "type": { + "kind": "enum", + "name": "StartCurrentHitTargetEnum" + }, + "offset": 176 + }, + "fHasPreviewRect": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fLockWindowUpdate": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcPreview": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 40 + }, + "fSnapSizing": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fIsMoveSizeLoop": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fInitSize": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcDragCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "ulCountDragOutOfTopTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 224 + }, + "rcPreviewCursor": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 56 + }, + "CurrentHitTarget": { + "type": { + "kind": "enum", + "name": "CurrentHitTargetEnum" + }, + "offset": 192 + }, + "fSnapMovingTemporaryAllowed": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "fTrackCancelled": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "ptHitWindowRelative": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 200 + }, + "ptLastTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 216 + }, + "cmd": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 144 + }, + "Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 164 + }, + "MoveRectStyle": { + "type": { + "kind": "enum", + "name": "MoveRectStyleEnum" + }, + "offset": 196 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 104 + }, + "ulCountSizeOutOfTopBottomTarget": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 232 + }, + "fStartVerticallyMaximizedLeft": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 164 + }, + "rcNormalStartCheckPt": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 120 + }, + "ptMinTrack": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 88 + }, + "rcDrag": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 8 + }, + "pMonitorCurrentHitTarget": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "impx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 148 + } + }, + "kind": "struct", + "size": 240 + }, + "_D3DDDI_RATIONAL": { + "fields": { + "Denominator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Numerator": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "VWPL": { + "fields": { + "cElem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "aElement": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "VWPLELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "fTagged": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cThreshhold": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "cPwnd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagTEXTMETRICW": { + "fields": { + "tmOverhang": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "tmPitchAndFamily": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 55 + }, + "tmStruckOut": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 54 + }, + "tmCharSet": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 56 + }, + "tmDigitizedAspectX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "tmDigitizedAspectY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "tmFirstChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 44 + }, + "tmWeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "tmDescent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "tmDefaultChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 48 + }, + "tmLastChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 46 + }, + "tmMaxCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "tmItalic": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 52 + }, + "tmUnderlined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 53 + }, + "tmInternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "tmAscent": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "tmHeight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "tmAveCharWidth": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "tmBreakChar": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 50 + }, + "tmExternalLeading": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 60 + }, + "_SCATTER_GATHER_LIST": { + "fields": { + "Elements": { + "type": { + "count": 0, + "subtype": { + "kind": "struct", + "name": "_SCATTER_GATHER_ELEMENT" + }, + "kind": "array" + }, + "offset": 16 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "NumberOfElements": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "HICON__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_HANDLEENTRY": { + "fields": { + "pOwner": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "bType": { + "type": { + "kind": "enum", + "name": "bTypeEnum" + }, + "offset": 16 + }, + "bFlags": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 17 + }, + "phead": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HEAD" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "wUniq": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + } + }, + "kind": "struct", + "size": 24 + }, + "_THRDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagSVR_INSTANCE_INFO": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_THROBJHEAD" + }, + "offset": 0 + }, + "next": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nextInThisThread": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSVR_INSTANCE_INFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "spwndEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "afCmd": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pcii": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 80 + }, + "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { + "fields": { + "RequestDiagInfo": { + "type": { + "kind": "struct", + "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" + }, + "offset": 4 + }, + "AffectedVidPnSourceId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "VidPnSerialization": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPN_SERIALIZATION" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 28 + }, + "tagPOPUPMENU": { + "fields": { + "fDroppedLeft": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fIsSysMenu": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posDropped": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fIsMenuBar": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHierarchyDropped": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDropNextPopup": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fRightButton": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ppopupmenuRoot": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "fFirstClick": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNotify": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fRtoL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSendUninit": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fAboutToHide": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndNextPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "fFlushDelayedFree": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHasMenuBar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fTrackMouseEvent": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fNoNotify": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "posSelectedItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fUseMonitorRect": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndPrevPopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "ppmDelayedFree": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "fFreed": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fSynchronous": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spmenuAlternate": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "fDestroyed": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "iDropDir": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 0 + }, + "fIsTrackPopup": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "spwndActivePopup": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "fInCancel": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fToggle": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fDelayedFree": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fHideTimer": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "fShowTimer": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "_D3DKMDT_MONITOR_SOURCE_MODE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 84 + }, + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "ColorCoeffDynamicRanges": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" + }, + "offset": 68 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 88 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 96 + }, + "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 8 + }, + "Data": { + "type": { + "count": 128, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 12 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 140 + }, + "__unnamed_127c": { + "fields": { + "Wcb": { + "type": { + "kind": "struct", + "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" + }, + "offset": 0 + }, + "ListEntry": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_D3DMATRIX": { + "fields": { + "_41": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 48 + }, + "_42": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 52 + }, + "_43": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 56 + }, + "_44": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 60 + }, + "_34": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 44 + }, + "_14": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 12 + }, + "_13": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 8 + }, + "_12": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 4 + }, + "_11": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 0 + }, + "_24": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 28 + }, + "_31": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 32 + }, + "_33": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 40 + }, + "_32": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 36 + }, + "_22": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 20 + }, + "_23": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 24 + }, + "_21": { + "type": { + "kind": "base", + "name": "float" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 64 + }, + "_LARGE_UNICODE_STRING": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumLength": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 31 + }, + "offset": 4 + }, + "bAnsi": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "_VK_VALUES_STRINGS": { + "fields": { + "fReserved": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "pszMultiNames": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagHID_TLC_INFO": { + "fields": { + "cExcludeOrphaned": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + }, + "cDevices": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "usUsage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "cExcludeRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cUsagePageRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "cDirectRequest": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { + "fields": { + "Info": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_SOURCE_MODE" + }, + "offset": 0 + }, + "TimingType": { + "type": { + "kind": "enum", + "name": "TimingTypeEnum" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 104 + }, + "tagCURSOR": { + "fields": { + "rt": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 58 + }, + "head": { + "type": { + "kind": "struct", + "name": "_PROCMARKHEAD" + }, + "offset": 0 + }, + "hbmUserAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "xHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 68 + }, + "hbmColor": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pcurNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "CURSORF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hbmMask": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bpp": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 120 + }, + "cy": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 128 + }, + "cx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "rcBounds": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 96 + }, + "atomModName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 56 + }, + "hbmAlpha": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "yHotspot": { + "type": { + "kind": "base", + "name": "short" + }, + "offset": 70 + }, + "strName": { + "type": { + "kind": "struct", + "name": "nt_symbols!_UNICODE_STRING" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 136 + }, + "_D3DKMDT_GAMMA_RAMP": { + "fields": { + "Data": { + "type": { + "kind": "struct", + "name": "__unnamed_182e" + }, + "offset": 16 + }, + "DataSize": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "HWND__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1207": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_18a1": { + "fields": { + "Text": { + "type": { + "kind": "enum", + "name": "TextEnum" + }, + "offset": 0 + }, + "Graphics": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { + "fields": { + "TargetMode": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_TARGET_MODE" + }, + "offset": 360 + }, + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 432 + }, + "HKL__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1209": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "tagDCE": { + "fields": { + "hrgnClipPublic": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pwndOrg": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pdceNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ppiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "DCX_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "hdc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ptiOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "hrgnSavedVis": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pwndRedirect": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pMonitor": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMONITOR" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pwndClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 96 + }, + "VSC_LPWSTR": { + "fields": { + "vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pwsz": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagQ": { + "fields": { + "hwndDblClk": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "timeDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "spwndFocus": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 328 + }, + "cLockCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 322 + }, + "iCursorLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 312 + }, + "ptiSysLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "caret": { + "type": { + "kind": "struct", + "name": "tagCARET" + }, + "offset": 232 + }, + "ptiMouse": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "spwndActivePrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ptMouseMove": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 128 + }, + "msgDblClk": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 100 + }, + "msgJournal": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 324 + }, + "ptiKeyboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "cThreads": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 320 + }, + "QF_flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 316 + }, + "mlInput": { + "type": { + "kind": "struct", + "name": "tagMLIST" + }, + "offset": 0 + }, + "spwndActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "codeCapture": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 96 + }, + "idSysLock": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "spcurCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 304 + }, + "ulEtwReserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 336 + }, + "ptDblClk": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 120 + }, + "xbtnDblClk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 104 + }, + "afKeyRecentDown": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "afKeyState": { + "type": { + "count": 64, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 168 + }, + "spwndCapture": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "idSysPeek": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 344 + }, + "__unnamed_1203": { + "fields": { + "ShareAccess": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 18 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "SecurityContext": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_SECURITY_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Options": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Parameters": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" + }, + "kind": "pointer" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "HGESTUREINFO__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagCLS": { + "fields": { + "spcur": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 100 + }, + "pclsClone": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "lpszClientAnsiMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pclsBase": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "atomNVClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "pclsNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "CSF_flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "lpszAnsiClassName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "spcpdFirst": { + "type": { + "subtype": { + "kind": "struct", + "name": "_CALLPROCDATA" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "lpszClientUnicodeMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "cbclsExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 96 + }, + "lpszMenuName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "spicnSm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "cWndReferenceCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 80 + }, + "hbrBackground": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "spicn": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCURSOR" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 12 + }, + "pdce": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDCE" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "rpdeskParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "atomClassName": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 160 + }, + "_PROCDESKHEAD": { + "fields": { + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pSelf": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "rpdesk": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { + "fields": { + "CommitVidPnRequestOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumCommitVidPnRequests": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "_VK_TO_FUNCTION_TABLE": { + "fields": { + "NLSFEProcType": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "NLSFEProcCurrent": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 2 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcSwitch": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 3 + }, + "NLSFEProcAlt": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 68 + }, + "NLSFEProc": { + "type": { + "count": 8, + "subtype": { + "kind": "struct", + "name": "_VK_FUNCTION_PARAM" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 132 + }, + "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { + "fields": { + "NumDescriptors": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "DescriptorSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 144 + }, + "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { + "fields": { + "NumModes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 112 + }, + "_CALLBACKWND": { + "fields": { + "hwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { + "fields": { + "PathInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH" + }, + "offset": 0 + }, + "TargetModeSet": { + "type": { + "kind": "struct", + "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" + }, + "offset": 360 + } + }, + "kind": "struct", + "size": 440 + }, + "_VK_FUNCTION_PARAM": { + "fields": { + "NLSFEProcIndex": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "NLSFEProcParam": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "tagSBCALC": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "pxStart": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "pxThumbBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 48 + }, + "cpxThumb": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 32 + }, + "pxMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "pxThumbTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "pxDownArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cpx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "pxBottom": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "pxTop": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "pxLeft": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "pxRight": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "pxUpArrow": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 36 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "HDESK__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "HIMC__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { + "fields": { + "SecondChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "FourthChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "ThirdChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "FirstChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagMENUSTATE": { + "fields": { + "cxAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 116 + }, + "pGlobalPopupMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPOPUPMENU" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "uDraggingIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "fNotifyByPos": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInCallHandleMenuMessages": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ixAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "dwLockCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "fAutoDismiss": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fIsSysMenu": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "dwAniStartTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "uButtonDownHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 64 + }, + "fIgnoreButtonUp": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptButtonDown": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 56 + }, + "fMenuStarted": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "iAniDropDir": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 5 + }, + "offset": 8 + }, + "hdcAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "fModelessMenu": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hbmAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "fInEndMenu": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 92 + }, + "vkButtonDown": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "fSetCapture": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInDoDragDrop": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fActiveNoForeground": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fMouseOffMenu": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fDragAndDrop": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fInsideMenuLoop": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "uDraggingHitArea": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 80 + }, + "fButtonDown": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptiMenuStateOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 120 + }, + "iyAni": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 112 + }, + "hdcWndAni": { + "type": { + "subtype": { + "kind": "struct", + "name": "HDC__" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "fAboutToAutoDismiss": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "mnFocus": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "uButtonDownIndex": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "fButtonAlwaysDown": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "fUnderline": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "ptMouseLast": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 12 + }, + "pmnsPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENUSTATE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "fDragging": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "cmdLast": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 144 + }, + "VK_TO_BIT": { + "fields": { + "Vk": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModBits": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + } + }, + "kind": "struct", + "size": 2 + }, + "tagWOWTHREADINFO": { + "fields": { + "pIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "idParentProcess": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "idTask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pwtiNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "idWaitObject": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 40 + }, + "__unnamed_1805": { + "fields": { + "Start": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_1211": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1213": { + "fields": { + "FileInformationClass": { + "type": { + "kind": "enum", + "name": "FileInformationClassEnum" + }, + "offset": 8 + }, + "AdvanceOnly": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 25 + }, + "ClusterCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "DeleteHandle": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReplaceIfExists": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 24 + }, + "FileObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_FILE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_1217": { + "fields": { + "FsInformationClass": { + "type": { + "kind": "enum", + "name": "FsInformationClassEnum" + }, + "offset": 8 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_123b": { + "fields": { + "IoResourceRequirementList": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_122d": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1950": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "MinimumAddress": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 8 + }, + "Alignment": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 24 + }, + "tagITEM": { + "fields": { + "fType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "ulX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "wID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwItemData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "hbmpChecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "xItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "spSubMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hbmpUnchecked": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "fState": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dxTab": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "cxBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 104 + }, + "yItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "cyItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 76 + }, + "umim": { + "type": { + "kind": "struct", + "name": "tagUAHMENUITEMMETRICS" + }, + "offset": 112 + }, + "cch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "ulWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "cyBmp": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 108 + }, + "lpstr": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "cxItem": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "hbmp": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 96 + } + }, + "kind": "struct", + "size": 144 + }, + "tagIMEINFOEX": { + "fields": { + "dwImeWinVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 84 + }, + "fSysWow64Only": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "fInitOpen": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 72 + }, + "wszImeDescription": { + "type": { + "count": 50, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 88 + }, + "fCUASLayer": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 348 + }, + "ImeInfo": { + "type": { + "kind": "struct", + "name": "tagIMEINFO" + }, + "offset": 8 + }, + "wszImeFile": { + "type": { + "count": 80, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 188 + }, + "wszUIClass": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 36 + }, + "fLoadFlag": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 76 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "dwProdVersion": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 80 + }, + "fdwInitConvMode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + } + }, + "kind": "struct", + "size": 352 + }, + "__unnamed_1962": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1958" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_1956" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_195e" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_195c" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "ConfigData": { + "type": { + "kind": "struct", + "name": "__unnamed_195a" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1960" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1954" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1950" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagMSGPPINFO": { + "fields": { + "dwIndexMsgPP": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "tagSBINFO": { + "fields": { + "WSBflags": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "Horz": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 4 + }, + "Vert": { + "type": { + "kind": "struct", + "name": "tagSBDATA" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 36 + }, + "VWPLELEMENT": { + "fields": { + "DataOrTag": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "pwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSBDATA": { + "fields": { + "posMax": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "posMin": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "page": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "pos": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 16 + }, + "_VSC_VK": { + "fields": { + "Vsc": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "Vk": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123f": { + "fields": { + "Lock": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 1 + }, + "_SCATTER_GATHER_ELEMENT": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 16 + }, + "Address": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 24 + }, + "tagWND": { + "fields": { + "spwndLastActive": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "bWS_CLIPCHILDREN": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bMaximizeButtonDown": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bUIStateActive": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_TABSTOP": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDialogWindow": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "lpfnWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bMinimizeButtonDown": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hImc": { + "type": { + "subtype": { + "kind": "struct", + "name": "HIMC__" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "style": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "bChildNoActivate": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_LAYERED": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bReserved3": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bStartPaint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bVerticallyMaximizedLeft": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bHiddenPopup": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSendEraseBackground": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin50Compat": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_CLIENTEDGE": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "fnid": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 66 + }, + "bWS_EX_TOOLWINDOW": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bDisabled": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bAnsiWindowProc": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWin40Compat": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcClient": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 128 + }, + "bAnsiCreator": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bAnyScrollButtonDown": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bSendSizeMoveMsgs": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bLinked": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bSendNCPaint": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bInternalPaint": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasClientEdge": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasPalette": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHasHorizontalScrollbar": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUIStateFocusRectHidden": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_DLGFRAME": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_MDICHILD": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasVerticalScrollbar": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved2": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bSmallIconFromWMQueryDrag": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bNoNCPaint": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused1": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasSPB": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_MINIMIZEBOX": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarVerticalTracking": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_DLGMODALFRAME": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_TRANSPARENT": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bPaintNotProcessed": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bSyncPaintPending": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "hrgnClip": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "bShellHookRegistered": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndChild": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "bUnused5": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bInDestroy": { + "type": { + "bit_position": 7, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "state": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "bWS_EX_LEFTSCROLLBAR": { + "type": { + "bit_position": 14, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bToggleTopmost": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_VSCROLL": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "ExStyle": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "bWS_HSCROLL": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUpdateDirty": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWMPaintSent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_WINDOWEDGE": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_ACCEPTFILE": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_GROUP": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "bVisible": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bVerticallyMaximizedRight": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bForceMenuDraw": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bForceNCPaint": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bOldUI": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spwndClipboardListenerNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 280 + }, + "bWS_EX_NOPADDEDBORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bNoMinmaxAnimatedRects": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "bWS_MAXIMIZEBOX": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bHasCaption": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bEraseBackground": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "spwndOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cbwndExtra": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 232 + }, + "bMakeVisibleWhenUnghosted": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused8": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bUnused9": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 52 + }, + "bForceFullNCPaintClipRgn": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_RTLREADING": { + "type": { + "bit_position": 13, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pSBInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSBINFO" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "bUnused2": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused3": { + "type": { + "bit_position": 21, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUnused4": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasMeun": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bUnused6": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bUnused7": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 2 + }, + "offset": 52 + }, + "bClipboardListener": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bScrollBarLineDownBtnDown": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedirectedForPrint": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_RIGHT": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bHasCreatestructName": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITED": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bFullScreen": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnUpdate": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "bConsoleWindow": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "ppropList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROPLIST" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "bWS_EX_TOPMOST": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bScrollBarPageDownBtnDown": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bScrollBarLineUpBtnDown": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRecievedQuerySuspendMsg": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bMaximizeMonitorRegion": { + "type": { + "bit_position": 11, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bRedrawIfHung": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_POPUP": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTEXTHELP": { + "type": { + "bit_position": 10, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "dwUserData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 256 + }, + "hMod16": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 64 + }, + "FullScreenMode": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 3 + }, + "offset": 44 + }, + "bLayeredLimbo": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_EX_NOINHERITLAYOUT": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_LAYOUTRTL": { + "type": { + "bit_position": 22, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bUIStateKbdAccelHidden": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_BORDER": { + "type": { + "bit_position": 23, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_SIZEBOX": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bDestroyed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bServerSideWindowProc": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bCaptionTextTruncated": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "rcWindow": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 112 + }, + "bEndPaintInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "hrgnNewFrame": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "bBeingActivated": { + "type": { + "bit_position": 20, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_COMPOSITEDCompositing": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWMCreateMsgProcessed": { + "type": { + "bit_position": 31, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bWS_EX_NOACTIVATE": { + "type": { + "bit_position": 27, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bWS_EX_APPWINDOW": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bCloseButtonDown": { + "type": { + "bit_position": 12, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bMaximized": { + "type": { + "bit_position": 24, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_CHILD": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "spwndParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "bWS_THICKFRAME": { + "type": { + "bit_position": 18, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bWS_EX_CONTROLPARENT": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "pcls": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLS" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "bLayeredForDWM": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bMsgBox": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bHelpButtonDown": { + "type": { + "bit_position": 15, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bHasOverlay": { + "type": { + "bit_position": 9, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bRedrawFrameIfHung": { + "type": { + "bit_position": 28, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_NOPARENTNOTIFY": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bMaximizesToMonitor": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bBottomMost": { + "type": { + "bit_position": 5, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "bReserved1": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bRedirected": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + }, + "bActiveFrame": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bReserved4": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved5": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved6": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "bReserved7": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 16 + }, + "offset": 52 + }, + "spwndPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "bLayeredInvalidate": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "state2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "bWS_CLIPSIBLINGS": { + "type": { + "bit_position": 26, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bScrollBarPageUpBtnDown": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "pTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DMATRIX" + }, + "kind": "pointer" + }, + "offset": 272 + }, + "bWin31Compat": { + "type": { + "bit_position": 8, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 44 + }, + "ExStyle2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 288 + }, + "bHIGHDPI_UNAWARE_Unused": { + "type": { + "bit_position": 6, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 288 + }, + "bWS_SYSMENU": { + "type": { + "bit_position": 19, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "hModule": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "strName": { + "type": { + "kind": "struct", + "name": "_LARGE_UNICODE_STRING" + }, + "offset": 216 + }, + "pActCtx": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_ACTIVATION_CONTEXT" + }, + "kind": "pointer" + }, + "offset": 264 + }, + "bMinimized": { + "type": { + "bit_position": 29, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 52 + }, + "bRecievedSuspendMsg": { + "type": { + "bit_position": 25, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 40 + }, + "bWS_EX_STATICEDGE": { + "type": { + "bit_position": 17, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 296 + }, + "_WM_VALUES_STRINGS": { + "fields": { + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "fInternal": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 8 + }, + "fDefined": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 9 + } + }, + "kind": "struct", + "size": 16 + }, + "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { + "fields": { + "VisibleRegionSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 8 + }, + "Stride": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "PixelFormat": { + "type": { + "kind": "enum", + "name": "PixelFormatEnum" + }, + "offset": 20 + }, + "PixelValueAccessMode": { + "type": { + "kind": "enum", + "name": "PixelValueAccessModeEnum" + }, + "offset": 28 + }, + "PrimSurfSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 0 + }, + "ColorBasis": { + "type": { + "kind": "enum", + "name": "ColorBasisEnum" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 32 + }, + "_VK_TO_WCHARS1": { + "fields": { + "Attributes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 1 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 4 + }, + "_TLSPRITESTATE": { + "fields": { + "flOriginalSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "iSpriteType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "pfnSaveScreenBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "bInsideDriverCall": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "pfnStrokePath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnTransparentBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnPaint": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnStretchBltROP": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "iType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "pfnPlgBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnCopyBits": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pState": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "iOriginalType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "pfnTextOut": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDrawStream": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStrokeAndFillPath": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnLineTo": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnStretchBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGradientFill": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnAlphaBlend": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "flSpriteSurfFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "pfnBitBlt": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + } + }, + "kind": "struct", + "size": 168 + }, + "tagUAHMENUITEMMETRICS": { + "fields": { + "rgsizeBar": { + "type": { + "count": 2, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + }, + "rgsizePopup": { + "type": { + "count": 4, + "subtype": { + "kind": "struct", + "name": "tagSIZE" + }, + "kind": "array" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "__unnamed_121b": { + "fields": { + "Length": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ByteOffset": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 16 + }, + "Key": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1229": { + "fields": { + "Srb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_SCSI_REQUEST_BLOCK" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_121f": { + "fields": { + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1225": { + "fields": { + "DeviceObject": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_OBJECT" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "Vpb": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_VPB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_HEAD": { + "fields": { + "h": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "cLockObj": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagIMEINFO": { + "fields": { + "fdwProperty": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "fdwSelectCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fdwUICaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwPrivateDataSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "fdwSCSCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "fdwSentenceCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "fdwConversionCaps": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 28 + }, + "_DXGK_DIAG_CODE_POINT_PACKET": { + "fields": { + "Header": { + "type": { + "kind": "struct", + "name": "_DXGK_DIAG_HEADER" + }, + "offset": 0 + }, + "Param3": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 60 + }, + "Param1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "CodePointType": { + "type": { + "kind": "enum", + "name": "CodePointTypeEnum" + }, + "offset": 48 + }, + "Param2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + } + }, + "kind": "struct", + "size": 64 + }, + "_D3DKMDT_VIDPN_SOURCE_MODE": { + "fields": { + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 4 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Format": { + "type": { + "kind": "struct", + "name": "__unnamed_18a1" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagW32JOB": { + "fields": { + "restrictions": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "ughCrt": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "pAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "ughMax": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 52 + }, + "pgh": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long long" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "Job": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EJOB" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "ppiTable": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "uProcessCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "uMaxProcesses": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagW32JOB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 64 + }, + "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { + "fields": { + "NumFrequencyRanges": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "FrequencyRangeSerialization": { + "type": { + "count": 1, + "subtype": { + "kind": "struct", + "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 56 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { + "fields": { + "APSTriggerBits": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "CopyProtectionType": { + "type": { + "kind": "enum", + "name": "CopyProtectionTypeEnum" + }, + "offset": 0 + }, + "CopyProtectionSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" + }, + "offset": 264 + }, + "OEMCopyProtection": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 268 + }, + "tagWINDOWSTATION": { + "fields": { + "pClipBase": { + "type": { + "subtype": { + "count": 104, + "subtype": { + "kind": "struct", + "name": "tagCLIP" + }, + "kind": "array" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "cNumClipFormats": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "luidUser": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 136 + }, + "pGlobalAtomTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "ptiClipLock": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "dwWSF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "rpdeskList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spklList": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "spwndClipOpen": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "iClipSerialNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + }, + "pTerm": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTERMINAL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "rpwinstaNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndClipboardListener": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "spwndClipViewer": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "iClipSequenceNumber": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "ptiDrawingClipboard": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "spwndClipOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "psidUser": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "luidEndSession": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LUID" + }, + "offset": 128 + } + }, + "kind": "struct", + "size": 152 + }, + "tagDESKTOPINFO": { + "fields": { + "spwndProgman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 192 + }, + "pvwplMessagePPHandler": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 224 + }, + "pvDesktopLimit": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "fComposited": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndGestureEngine": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "pvDesktopBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwndShell": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "ppiShellProcess": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagPROCESSINFO" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pvwplShellHook": { + "type": { + "subtype": { + "kind": "struct", + "name": "VWPL" + }, + "kind": "pointer" + }, + "offset": 200 + }, + "fIsDwmDesktop": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 232 + }, + "spwndTaskman": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "aphkStart": { + "type": { + "count": 16, + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 32 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cntMBox": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 208 + }, + "spwndBkGnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 176 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 240 + }, + "tagMBSTRING": { + "fields": { + "szName": { + "type": { + "count": 15, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 0 + }, + "uID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "uStr": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 36 + } + }, + "kind": "struct", + "size": 40 + }, + "_D3DKMDT_VIDPN_TARGET_MODE": { + "fields": { + "VideoSignalInfo": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" + }, + "offset": 8 + }, + "Id": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Preference": { + "type": { + "kind": "enum", + "name": "PreferenceEnum" + }, + "offset": 64 + } + }, + "kind": "struct", + "size": 72 + }, + "_DMM_VIDPNSET_SERIALIZATION": { + "fields": { + "VidPnOffset": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4 + }, + "NumVidPns": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagKBDFILE": { + "fields": { + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "awchDllName": { + "type": { + "count": 32, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 56 + }, + "pKbdTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdLayer" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pkfNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pKbdNlsTbl": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKbdNlsLayer" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "hBase": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_11e4": { + "fields": { + "UserApcContext": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "UserApcRoutine": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "IssuingProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_W32PROCESS": { + "fields": { + "GDIPushLock": { + "type": { + "kind": "struct", + "name": "nt_symbols!_EX_PUSH_LOCK" + }, + "offset": 80 + }, + "DxProcess": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 248 + }, + "pBrushAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "Process": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_EPROCESS" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "GDIHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "RefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "StartCursorHideTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "InputIdleEvent": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "W32PF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "GDIHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "NextStart": { + "type": { + "subtype": { + "kind": "struct", + "name": "_W32PROCESS" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "hSecureGdiSharedHandleTable": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 240 + }, + "UserHandleCountPeak": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 72 + }, + "GDIW32PIDLockedBitmaps": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 224 + }, + "UserHandleCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 68 + }, + "W32Pid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "GDIEngUserMemAllocTable": { + "type": { + "kind": "struct", + "name": "nt_symbols!_RTL_AVL_TABLE" + }, + "offset": 88 + }, + "pDCAttrList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "GDIBrushAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 208 + }, + "GDIDcAttrFreeList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 192 + } + }, + "kind": "struct", + "size": 256 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { + "fields": { + "Scaling": { + "type": { + "kind": "enum", + "name": "ScalingEnum" + }, + "offset": 0 + }, + "RotationSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" + }, + "offset": 12 + }, + "Rotation": { + "type": { + "kind": "enum", + "name": "RotationEnum" + }, + "offset": 8 + }, + "ScalingSupport": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSERVERINFO": { + "fields": { + "uiShellMsg": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 912 + }, + "cbHandleTable": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 848 + }, + "atomSysClass": { + "type": { + "count": 25, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 852 + }, + "dtScroll": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2800 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2952 + }, + "atomIconSmProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1356 + }, + "argbSystemUnmatched": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2268 + }, + "dwTagCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4632 + }, + "ucWheelScrollLines": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2812 + }, + "ptCursorReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2784 + }, + "ucWheelScrollChars": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2816 + }, + "acOemToAnsi": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1364 + }, + "cySysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2832 + }, + "atomFrostedWindowProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1362 + }, + "mpFnid_serverCBWndProc": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned short" + }, + "kind": "array" + }, + "offset": 328 + }, + "PUSIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4476 + }, + "BitCount": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4468 + }, + "argbSystem": { + "type": { + "count": 31, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 2392 + }, + "dtLBSearch": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2804 + }, + "dtCaretBlink": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2808 + }, + "dwInstalledEventHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 1876 + }, + "apfnClientA": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 392 + }, + "cxSysFontChar": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2828 + }, + "hbrGray": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "offset": 2768 + }, + "ahbrSystem": { + "type": { + "count": 31, + "subtype": { + "subtype": { + "kind": "struct", + "name": "HBRUSH__" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 2520 + }, + "dwDefaultHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 908 + }, + "wMaxRightOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2824 + }, + "dwSRVIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "oembmi": { + "type": { + "count": 93, + "subtype": { + "kind": "struct", + "name": "tagOEMBITMAPINFO" + }, + "kind": "array" + }, + "offset": 2964 + }, + "apfnClientWorker": { + "type": { + "kind": "struct", + "name": "_PFNCLIENTWORKER" + }, + "offset": 760 + }, + "dwDefaultHeapBase": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 904 + }, + "BitsPixel": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4473 + }, + "wMaxLeftOverlapChars": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2820 + }, + "dmLogPixels": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4470 + }, + "dwLastSystemRITEventTickCountUpdate": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4488 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 2796 + }, + "atomIconProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1358 + }, + "Planes": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4472 + }, + "dpiSystem": { + "type": { + "kind": "struct", + "name": "tagDPISERVERINFO" + }, + "offset": 2896 + }, + "hIcoWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2944 + }, + "apfnClientW": { + "type": { + "kind": "struct", + "name": "_PFNCLIENT" + }, + "offset": 576 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2956 + }, + "MBStrings": { + "type": { + "count": 11, + "subtype": { + "kind": "struct", + "name": "tagMBSTRING" + }, + "kind": "array" + }, + "offset": 916 + }, + "atomContextHelpIdProp": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 1360 + }, + "adwDBGTAGFlags": { + "type": { + "count": 35, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 4492 + }, + "aiSysMet": { + "type": { + "count": 97, + "subtype": { + "kind": "base", + "name": "long" + }, + "kind": "array" + }, + "offset": 1880 + }, + "dwRIPFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4636 + }, + "uCaretWidth": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4480 + }, + "cCaptures": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2960 + }, + "tmSysFont": { + "type": { + "kind": "struct", + "name": "tagTEXTMETRICW" + }, + "offset": 2836 + }, + "cHandleEntries": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ptCursor": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 2776 + }, + "hIconSmWindows": { + "type": { + "subtype": { + "kind": "struct", + "name": "HICON__" + }, + "kind": "pointer" + }, + "offset": 2936 + }, + "mpFnidPfn": { + "type": { + "count": 32, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "UILangID": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 4484 + }, + "acAnsiToOem": { + "type": { + "count": 256, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 1620 + }, + "aStoCidPfn": { + "type": { + "count": 7, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 272 + }, + "rcScreenReal": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 4452 + }, + "dwLastRITEventTickCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 2792 + } + }, + "kind": "struct", + "size": 4640 + }, + "tagPOOLRECORD": { + "fields": { + "ExtraData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "trace": { + "type": { + "count": 6, + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "array" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "__unnamed_195a": { + "fields": { + "Priority": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Reserved1": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagUSERSTARTUPINFO": { + "fields": { + "dwYSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "cbReserved2": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 26 + }, + "cb": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwX": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "dwY": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwXSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 12 + }, + "wShowWindow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 24 + } + }, + "kind": "struct", + "size": 28 + }, + "_DMM_VIDPN_SERIALIZATION": { + "fields": { + "PathsFromSourceSerializationOffsets": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "array" + }, + "offset": 8 + }, + "NumActiveSources": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 4 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 12 + }, + "__unnamed_11df": { + "fields": { + "IrpCount": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "SystemBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "MasterIrp": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_IRP" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagHID_PAGEONLY_REQUEST": { + "fields": { + "usUsagePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 16 + }, + "link": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 0 + }, + "cRefCount": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1233": { + "fields": { + "Interface": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_INTERFACE" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "InterfaceSpecificData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "Version": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "InterfaceType": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_GUID" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "tagQMSG": { + "fields": { + "Padding": { + "type": { + "bit_position": 30, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 2 + }, + "offset": 80 + }, + "ptMouseReal": { + "type": { + "kind": "struct", + "name": "tagPOINT" + }, + "offset": 72 + }, + "FromPen": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "ExtraInfo": { + "type": { + "kind": "base", + "name": "long long" + }, + "offset": 64 + }, + "Wow64Message": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "MsgPPInfo": { + "type": { + "kind": "struct", + "name": "tagMSGPPINFO" + }, + "offset": 96 + }, + "dwQEvent": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 30 + }, + "offset": 80 + }, + "pqmsgPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FromTouch": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "NoCoalesce": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "long" + }, + "bit_length": 1 + }, + "offset": 84 + }, + "msg": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 16 + }, + "pqmsgNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQMSG" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 104 + }, + "__unnamed_1237": { + "fields": { + "Capabilities": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_DEVICE_CAPABILITIES" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "__unnamed_11e6": { + "fields": { + "AsynchronousParameters": { + "type": { + "kind": "struct", + "name": "__unnamed_11e4" + }, + "offset": 0 + }, + "AllocationSize": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LARGE_INTEGER" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagDESKTOP": { + "fields": { + "spmenuVScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "dwMouseHoverTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 212 + }, + "rpwinstaParent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWINDOWSTATION" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "spmenuDialogSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "spwndForeground": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "spmenuHScroll": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "spwndTooltip": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "dwSessionId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "spwndMessage": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "cciConsole": { + "type": { + "kind": "struct", + "name": "_CONSOLE_CARET_INFO" + }, + "offset": 144 + }, + "PtiList": { + "type": { + "kind": "struct", + "name": "nt_symbols!_LIST_ENTRY" + }, + "offset": 160 + }, + "spwndTray": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "rpdeskNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "dwDTFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "pMagInputTransform": { + "type": { + "subtype": { + "kind": "struct", + "name": "_MAGNIFICATION_INPUT_TRANSFORM" + }, + "kind": "pointer" + }, + "offset": 216 + }, + "spwndTrack": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 184 + }, + "htEx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 192 + }, + "ulHeapSize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 136 + }, + "pheapDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!tagWIN32HEAP" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "rcMouseHover": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 196 + }, + "hsectionDesktop": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "dwDesktopId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "spmenuSys": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 224 + }, + "_MAGNIFICATION_INPUT_TRANSFORM": { + "fields": { + "rcScreen": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 16 + }, + "magFactorX": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 40 + }, + "magFactorY": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 44 + }, + "ptiMagThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "rcSource": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 48 + }, + "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { + "fields": { + "Origin": { + "type": { + "kind": "enum", + "name": "OriginEnum" + }, + "offset": 0 + }, + "ConstraintType": { + "type": { + "kind": "enum", + "name": "ConstraintTypeEnum" + }, + "offset": 36 + }, + "RangeLimits": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_FREQUENCY_RANGE" + }, + "offset": 4 + }, + "Constraint": { + "type": { + "kind": "struct", + "name": "__unnamed_16c1" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 48 + }, + "__unnamed_121d": { + "fields": { + "Type3InputBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "OutputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IoControlCode": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "InputBufferLength": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 32 + }, + "_PFNCLIENTWORKER": { + "fields": { + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnCtfHookProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 88 + }, + "__unnamed_12e0": { + "fields": { + "InitialPrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" + }, + "offset": 0 + }, + "PrivilegeSet": { + "type": { + "kind": "struct", + "name": "nt_symbols!_PRIVILEGE_SET" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 44 + }, + "tagMENULIST": { + "fields": { + "pMenu": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENU" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagMENULIST" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "_DMA_OPERATIONS": { + "fields": { + "PutDmaAdapter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "FreeMapRegisters": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "MapTransfer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "FreeCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "ReadDmaCounter": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "AllocateCommonBuffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "PutScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "BuildMdlFromScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "GetScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "CalculateScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "FreeAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "GetDmaAlignment": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "FlushAdapterBuffers": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "AllocateAdapterChannel": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "BuildScatterGatherList": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 128 + }, + "__unnamed_1811": { + "fields": { + "Start": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "Reserved": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 12 + }, + "tagSPB": { + "fields": { + "hbm": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "hrgn": { + "type": { + "subtype": { + "kind": "struct", + "name": "HRGN__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "ulSaveId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 56 + }, + "flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "rc": { + "type": { + "kind": "struct", + "name": "tagRECT" + }, + "offset": 24 + }, + "pspbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSPB" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 64 + }, + "tagWin32PoolHead": { + "fields": { + "pPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pTrace": { + "type": { + "subtype": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWin32PoolHead" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "size": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 32 + }, + "_DXGK_DIAG_HEADER": { + "fields": { + "Index": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "ProcessName": { + "type": { + "count": 16, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 16 + }, + "LogTimestamp": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "ThreadId": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "Type": { + "type": { + "kind": "enum", + "name": "TypeEnum" + }, + "offset": 0 + }, + "WdLogIdx": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 48 + }, + "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { + "fields": { + "CleanupAfterFailedCommitVidPn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ModeChangeRequestId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "ReclaimClonedTarget": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + }, + "ForceAllActiveVidPnModeListInvalidation": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned char" + }, + "bit_length": 1 + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 12 + }, + "tagTOUCHINPUT": { + "fields": { + "dwExtraInfo": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "hSource": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "dwMask": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "cyContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 44 + }, + "cxContact": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 40 + }, + "dwFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "dwID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "dwTime": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 48 + }, + "_SM_VALUES_STRINGS": { + "fields": { + "StorageType": { + "type": { + "kind": "enum", + "name": "StorageTypeEnum" + }, + "offset": 16 + }, + "pszName": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulValue": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + }, + "RangeType": { + "type": { + "kind": "enum", + "name": "RangeTypeEnum" + }, + "offset": 12 + } + }, + "kind": "struct", + "size": 24 + }, + "__unnamed_1956": { + "fields": { + "MinimumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "MaximumChannel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + } + }, + "kind": "struct", + "size": 8 + }, + "_D3DKMDT_VIDEO_SIGNAL_INFO": { + "fields": { + "VSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 20 + }, + "ActiveSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 12 + }, + "PixelRate": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "TotalSize": { + "type": { + "kind": "struct", + "name": "_D3DKMDT_2DREGION" + }, + "offset": 4 + }, + "VideoStandard": { + "type": { + "kind": "enum", + "name": "VideoStandardEnum" + }, + "offset": 0 + }, + "ScanLineOrdering": { + "type": { + "kind": "enum", + "name": "ScanLineOrderingEnum" + }, + "offset": 48 + }, + "HSyncFreq": { + "type": { + "kind": "struct", + "name": "_D3DDDI_RATIONAL" + }, + "offset": 28 + } + }, + "kind": "struct", + "size": 56 + }, + "tagTERMINAL": { + "fields": { + "spwndDesktopOwner": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pEventInputReady": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "rpdeskDestroy": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOP" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pqDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagQ" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "dwTERMF_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "dwNestedLevel": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ptiDesktop": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pEventTermInit": { + "type": { + "subtype": { + "kind": "struct", + "name": "nt_symbols!_KEVENT" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "HFONT__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { + "fields": { + "MacroVisionFull": { + "type": { + "bit_position": 2, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "MacroVisionApsTrigger": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "NoProtection": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 3, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 29 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "_PFNCLIENT": { + "fields": { + "pfnDispatchDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 160 + }, + "pfnStaticWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 112 + }, + "pfnDispatchHook": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 152 + }, + "pfnDesktopWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "pfnImeWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 120 + }, + "pfnScrollBarWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pfnEditWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 88 + }, + "pfnGhostWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 128 + }, + "pfnMessageWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pfnSwitchWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "pfnComboListBoxProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 72 + }, + "pfnComboBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 64 + }, + "pfnMDIClientWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 104 + }, + "pfnDialogWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "pfnHkINLPCWPSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 136 + }, + "pfnTitleWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "pfnHkINLPCWPRETSTRUCT": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "pfnButtonWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pfnMenuWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "pfnListBoxWndProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "pfnDispatchMessage": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 168 + }, + "pfnDefWindowProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "pfnMDIActivateDlgProc": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 176 + } + }, + "kind": "struct", + "size": 184 + }, + "tagOEMBITMAPINFO": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1221": { + "fields": { + "SecurityInformation": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "SecurityDescriptor": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "_KLIST_ENTRY": { + "fields": { + "Flink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "Blink": { + "type": { + "subtype": { + "kind": "struct", + "name": "_KLIST_ENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "HMONITOR__": { + "fields": { + "unused": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_1247": { + "fields": { + "DeviceTextType": { + "type": { + "kind": "enum", + "name": "DeviceTextTypeEnum" + }, + "offset": 0 + }, + "LocaleId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "tagCLIENTINFO": { + "fields": { + "msgDbcsCB": { + "type": { + "kind": "struct", + "name": "tagMSG" + }, + "offset": 160 + }, + "dwCompatFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 20 + }, + "achDbcsCF": { + "type": { + "count": 2, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 154 + }, + "dwTIFlags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "pClientThreadInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagCLIENTTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 152 + }, + "dwKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "dwHookCurrent": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "afAsyncKeyStateRecentDown": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 136 + }, + "dwCompatFlags2": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "fsHooks": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 56 + }, + "ulClientDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "pDeskInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDESKTOPINFO" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "dwExpWinVer": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "dwHookData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 104 + }, + "afAsyncKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 128 + }, + "CallbackWnd": { + "type": { + "kind": "struct", + "name": "_CALLBACKWND" + }, + "offset": 64 + }, + "lpdwRegisteredClasses": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned long" + }, + "kind": "pointer" + }, + "offset": 208 + }, + "cInDDEMLCallback": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 92 + }, + "cSpins": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 8 + }, + "hKL": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 144 + }, + "dwAsyncKeyCache": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 124 + }, + "afKeyState": { + "type": { + "count": 8, + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "array" + }, + "offset": 116 + }, + "CI_flags": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 0 + }, + "phkCurrent": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagHOOK" + }, + "kind": "pointer" + }, + "offset": 48 + } + }, + "kind": "struct", + "size": 216 + }, + "_DMM_MONITOR_SERIALIZATION": { + "fields": { + "SourceModeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "FrequencyRangeSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 28 + }, + "DescriptorSetOffset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "ModePruningAlgorithm": { + "type": { + "kind": "enum", + "name": "ModePruningAlgorithmEnum" + }, + "offset": 16 + }, + "VideoPresentTargetId": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 4 + }, + "IsUsingDefaultProfile": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 13 + }, + "MonitorPowerState": { + "type": { + "kind": "enum", + "name": "MonitorPowerStateEnum" + }, + "offset": 20 + }, + "MonitorType": { + "type": { + "kind": "enum", + "name": "MonitorTypeEnum" + }, + "offset": 36 + }, + "Size": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "IsSimulatedMonitor": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 12 + }, + "Orientation": { + "type": { + "kind": "enum", + "name": "OrientationEnum" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 40 + }, + "tagPROP": { + "fields": { + "fs": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 10 + }, + "hData": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "atomKey": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 8 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_1243": { + "fields": { + "IdType": { + "type": { + "kind": "enum", + "name": "IdTypeEnum" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 4 + }, + "__unnamed_123d": { + "fields": { + "Buffer": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "WhichSpace": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + }, + "Length": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 24 + }, + "Offset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + } + }, + "kind": "struct", + "size": 32 + }, + "_WNDMSG": { + "fields": { + "abMsgs": { + "type": { + "subtype": { + "kind": "base", + "name": "unsigned char" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "maxMsgs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagSHAREDINFO": { + "fields": { + "psi": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagSERVERINFO" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "ulSharedDelta": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 32 + }, + "aheList": { + "type": { + "subtype": { + "kind": "struct", + "name": "_HANDLEENTRY" + }, + "kind": "pointer" + }, + "offset": 8 + }, + "DefWindowSpecMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 552 + }, + "awmControl": { + "type": { + "count": 31, + "subtype": { + "kind": "struct", + "name": "_WNDMSG" + }, + "kind": "array" + }, + "offset": 40 + }, + "pDispInfo": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagDISPLAYINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "HeEntrySize": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 16 + }, + "DefWindowMsgs": { + "type": { + "kind": "struct", + "name": "_WNDMSG" + }, + "offset": 536 + } + }, + "kind": "struct", + "size": 568 + }, + "__unnamed_181b": { + "fields": { + "BusNumber": { + "type": { + "kind": "struct", + "name": "__unnamed_1811" + }, + "offset": 0 + }, + "Dma": { + "type": { + "kind": "struct", + "name": "__unnamed_180d" + }, + "offset": 0 + }, + "DeviceSpecificData": { + "type": { + "kind": "struct", + "name": "__unnamed_1813" + }, + "offset": 0 + }, + "Memory48": { + "type": { + "kind": "struct", + "name": "__unnamed_1817" + }, + "offset": 0 + }, + "MessageInterrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_180b" + }, + "offset": 0 + }, + "Generic": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Memory40": { + "type": { + "kind": "struct", + "name": "__unnamed_1815" + }, + "offset": 0 + }, + "DevicePrivate": { + "type": { + "kind": "struct", + "name": "nt_symbols!__unnamed_180f" + }, + "offset": 0 + }, + "Memory64": { + "type": { + "kind": "struct", + "name": "__unnamed_1819" + }, + "offset": 0 + }, + "Memory": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + }, + "Interrupt": { + "type": { + "kind": "struct", + "name": "__unnamed_1807" + }, + "offset": 0 + }, + "Port": { + "type": { + "kind": "struct", + "name": "__unnamed_1805" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "tagPOINT": { + "fields": { + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 4 + }, + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagIMC": { + "fields": { + "dwClientImcData": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 48 + }, + "head": { + "type": { + "kind": "struct", + "name": "_THRDESKHEAD" + }, + "offset": 0 + }, + "hImeWnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "HWND__" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "pImcNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMC" + }, + "kind": "pointer" + }, + "offset": 40 + } + }, + "kind": "struct", + "size": 64 + }, + "tagKL": { + "fields": { + "uNumTbl": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 88 + }, + "pklPrev": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "head": { + "type": { + "kind": "struct", + "name": "_HEAD" + }, + "offset": 0 + }, + "pklNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKL" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "spkfPrimary": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 56 + }, + "dwFontSigs": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 64 + }, + "dwLastKbdType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 104 + }, + "CodePage": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 72 + }, + "dwKL_Flags": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 32 + }, + "iBaseCharset": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 68 + }, + "dwKLID": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 112 + }, + "spkf": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "offset": 48 + }, + "piiex": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagIMEINFOEX" + }, + "kind": "pointer" + }, + "offset": 80 + }, + "hkl": { + "type": { + "subtype": { + "kind": "struct", + "name": "HKL__" + }, + "kind": "pointer" + }, + "offset": 40 + }, + "pspkfExtra": { + "type": { + "subtype": { + "subtype": { + "kind": "struct", + "name": "tagKBDFILE" + }, + "kind": "pointer" + }, + "kind": "pointer" + }, + "offset": 96 + }, + "wchDiacritic": { + "type": { + "kind": "base", + "name": "wchar" + }, + "offset": 74 + }, + "dwLastKbdSubType": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 108 + } + }, + "kind": "struct", + "size": 120 + }, + "__unnamed_115b": { + "fields": { + "NextEntry": { + "type": { + "bit_position": 4, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 60 + }, + "offset": 8 + }, + "Depth": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 16 + }, + "offset": 0 + }, + "Reserved": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 3 + }, + "offset": 8 + }, + "HeaderType": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "Sequence": { + "type": { + "bit_position": 16, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "bit_length": 48 + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 16 + }, + "__unnamed_182e": { + "fields": { + "pRgb256x3x16": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pRaw": { + "type": { + "subtype": { + "kind": "base", + "name": "void" + }, + "kind": "pointer" + }, + "offset": 0 + }, + "pDxgi1": { + "type": { + "subtype": { + "kind": "struct", + "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 8 + }, + "tagTDB": { + "fields": { + "pti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 16 + }, + "TDB_Flags": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 34 + }, + "hTaskWow": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 32 + }, + "pwti": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWOWTHREADINFO" + }, + "kind": "pointer" + }, + "offset": 24 + }, + "nEvents": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 8 + }, + "nPriority": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "ptdbNext": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagTDB" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 40 + }, + "tagCARET": { + "fields": { + "x": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 16 + }, + "iHideLevel": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 12 + }, + "hTimer": { + "type": { + "kind": "base", + "name": "unsigned long long" + }, + "offset": 40 + }, + "yOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 56 + }, + "y": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 20 + }, + "xOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 52 + }, + "cy": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 24 + }, + "cx": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 28 + }, + "fVisible": { + "type": { + "bit_position": 0, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "hBitmap": { + "type": { + "subtype": { + "kind": "struct", + "name": "HBITMAP__" + }, + "kind": "pointer" + }, + "offset": 32 + }, + "cxOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 60 + }, + "cyOwnDc": { + "type": { + "kind": "base", + "name": "long" + }, + "offset": 64 + }, + "tid": { + "type": { + "kind": "base", + "name": "unsigned long" + }, + "offset": 48 + }, + "fOn": { + "type": { + "bit_position": 1, + "kind": "bitfield", + "type": { + "kind": "base", + "name": "unsigned long" + }, + "bit_length": 1 + }, + "offset": 8 + }, + "spwnd": { + "type": { + "subtype": { + "kind": "struct", + "name": "tagWND" + }, + "kind": "pointer" + }, + "offset": 0 + } + }, + "kind": "struct", + "size": 72 + }, + "_LIGATURE1": { + "fields": { + "wch": { + "type": { + "count": 1, + "subtype": { + "kind": "base", + "name": "wchar" + }, + "kind": "array" + }, + "offset": 4 + }, + "VirtualKey": { + "type": { + "kind": "base", + "name": "unsigned char" + }, + "offset": 0 + }, + "ModificationNumber": { + "type": { + "kind": "base", + "name": "unsigned short" + }, + "offset": 2 + } + }, + "kind": "struct", + "size": 6 } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1153": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 59 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 9 - }, - "offset": 0 - }, - "Region": { - "type": { - "bit_position": 61, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 39 - }, - "offset": 0 + }, + "base_types": { + "unsigned char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, + "float": { + "kind": "float", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "wchar": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "pointer": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 + }, + "unsigned int": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 4 + }, + "short": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 2 + }, + "long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 4 + }, + "unsigned short": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 2 + }, + "long long": { + "kind": "int", + "endian": "little", + "signed": true, + "size": 8 + }, + "unsigned long long": { + "kind": "int", + "endian": "little", + "signed": false, + "size": 8 } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1960": { - "fields": { - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 + }, + "enums": { + "TextEnum": { + "base": "long", + "constants": { + "D3DKMDT_TRF_UNINITIALIZED": 0 + }, + "size": 4 + }, + "PreferenceEnum": { + "base": "long", + "constants": { + "D3DKMDT_MP_PREFERRED": 1, + "D3DKMDT_MP_MAXVALID": 2, + "D3DKMDT_MP_UNINITIALIZED": 0 + }, + "size": 4 + }, + "FileInformationClassEnum": { + "base": "long", + "constants": { + "FileInternalInformation": 6, + "FileQuotaInformation": 32, + "FileIoStatusBlockRangeInformation": 42, + "FilePipeLocalInformation": 24, + "FileStandardLinkInformation": 54, + "FileIdFullDirectoryInformation": 38, + "FileLinkInformation": 11, + "FileFullDirectoryInformation": 2, + "FileAllInformation": 18, + "FileSfioVolumeInformation": 45, + "FileStreamInformation": 22, + "FileRenameInformation": 10, + "FileValidDataLengthInformation": 39, + "FileAlternateNameInformation": 21, + "FileBasicInformation": 4, + "FilePositionInformation": 14, + "FileCompletionInformation": 30, + "FileAttributeCacheInformation": 52, + "FileReparsePointInformation": 33, + "FileMailslotSetInformation": 27, + "FileNetworkPhysicalNameInformation": 49, + "FileAllocationInformation": 19, + "FileIsRemoteDeviceInformation": 51, + "FileFullEaInformation": 15, + "FileProcessIdsUsingFileInformation": 47, + "FileDispositionInformation": 13, + "FileStandardInformation": 5, + "FileAccessInformation": 8, + "FileNumaNodeInformation": 53, + "FilePipeRemoteInformation": 25, + "FileIoPriorityHintInformation": 43, + "FileMailslotQueryInformation": 26, + "FileRemoteProtocolInformation": 55, + "FileNamesInformation": 12, + "FileHardLinkInformation": 46, + "FileEndOfFileInformation": 20, + "FileIdBothDirectoryInformation": 37, + "FileSfioReserveInformation": 44, + "FileIdGlobalTxDirectoryInformation": 50, + "FileNetworkOpenInformation": 34, + "FileObjectIdInformation": 29, + "FileMoveClusterInformation": 31, + "FileIoCompletionNotificationInformation": 41, + "FileNameInformation": 9, + "FileBothDirectoryInformation": 3, + "FileDirectoryInformation": 1, + "FileMaximumInformation": 56, + "FileNormalizedNameInformation": 48, + "FilePipeInformation": 23, + "FileCompressionInformation": 28, + "FileTrackingInformation": 36, + "FileEaInformation": 7, + "FileShortNameInformation": 40, + "FileModeInformation": 16, + "FileAlignmentInformation": 17, + "FileAttributeTagInformation": 35 + }, + "size": 4 + }, + "ModePruningAlgorithmEnum": { + "base": "long", + "constants": { + "DMM_MPA_MAXVALID": 3, + "DMM_MPA_GDI": 1, + "DMM_MPA_VISTA": 2, + "DMM_MPA_UNINITIALIZED": 0 + }, + "size": 4 + }, + "fmtEnum": { + "base": "unsigned long", + "constants": { + "CF_ENHMETAFILE": 14, + "CF_PENDATA": 10, + "CF_BITMAP": 2, + "CF_UNICODETEXT": 13, + "CF_HDROP": 15, + "CF_OEMTEXT": 7, + "CF_WAVE": 12, + "CF_DSPTEXT": 129, + "CF_DIBV5": 17, + "CF_TIFF": 6, + "CF_PALETTE": 9, + "CF_OWNERDISPLAY": 128, + "CF_DSPMETAFILEPICT": 131, + "CF_METAFILEPICT": 3, + "CF_RIFF": 11, + "CF_DSPENHMETAFILE": 142, + "CF_TEXT": 1, + "CF_LOCALE": 16, + "CF_SYLK": 4, + "CF_DSPBITMAP": 130, + "CF_DIB": 8, + "CF_DIF": 5 + }, + "size": 4 + }, + "MonitorPowerStateEnum": { + "base": "long", + "constants": { + "PowerDeviceUnspecified": 0, + "PowerDeviceD0": 1, + "PowerDeviceD1": 2, + "PowerDeviceD2": 3, + "PowerDeviceD3": 4, + "PowerDeviceMaximum": 5 + }, + "size": 4 + }, + "bTypeEnum": { + "base": "unsigned char", + "constants": { + "TYPE_DDEXACT": 11, + "TYPE_HOOK": 5, + "TYPE_FREE": 0, + "TYPE_MONITOR": 12, + "TYPE_GESTURE": 21, + "TYPE_DEVICEINFO": 19, + "TYPE_DDEACCESS": 9, + "TYPE_CALLPROC": 7, + "TYPE_CURSOR": 3, + "TYPE_KBDLAYOUT": 13, + "TYPE_WINEVENTHOOK": 15, + "TYPE_MENU": 2, + "TYPE_ACCELTABLE": 8, + "TYPE_TOUCH": 20, + "TYPE_SETWINDOWPOS": 4, + "TYPE_CLIPDATA": 6, + "TYPE_KBDFILE": 14, + "TYPE_DDECONV": 10, + "TYPE_HIDDATA": 18, + "TYPE_WINDOW": 1, + "TYPE_INPUTCONTEXT": 17, + "TYPE_TIMER": 16 + }, + "size": 1 + }, + "OriginEnum": { + "base": "long", + "constants": { + "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, + "D3DKMDT_MCO_UNINITIALIZED": 0, + "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, + "D3DKMDT_MCO_MAXVALID": 5, + "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, + "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 + }, + "size": 4 + }, + "CodePointTypeEnum": { + "base": "long", + "constants": { + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, + "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, + "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, + "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, + "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, + "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, + "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, + "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, + "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, + "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, + "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, + "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, + "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, + "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, + "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, + "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, + "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, + "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, + "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, + "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, + "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, + "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, + "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, + "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, + "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, + "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, + "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, + "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, + "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, + "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, + "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, + "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, + "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, + "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, + "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, + "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, + "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, + "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, + "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 + }, + "size": 4 + }, + "ConstraintTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MFRC_MAXPIXELRATE": 2, + "D3DKMDT_MFRC_ACTIVESIZE": 1, + "D3DKMDT_MFRC_UNINITIALIZED": 0 + }, + "size": 4 + }, + "VidPnTargetColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MonitorTypeEnum": { + "base": "long", + "constants": { + "DMM_VMT_TEMPORARY_MONITOR": 4, + "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, + "DMM_VMT_PHYSICAL_MONITOR": 1, + "DMM_VMT_UNINITIALIZED": 0, + "DMM_VMT_SIMULATED_MONITOR": 5, + "DMM_VMT_PERSISTENT_MONITOR": 3 + }, + "size": 4 + }, + "PowerStateEnum": { + "base": "long", + "constants": { + "PowerSystemSleeping2": 3, + "PowerSystemSleeping1": 2, + "PowerSystemSleeping3": 4, + "PowerSystemUnspecified": 0, + "PowerSystemMaximum": 7, + "PowerSystemShutdown": 6, + "PowerSystemHibernate": 5, + "PowerSystemWorking": 1 + }, + "size": 4 + }, + "ShutdownTypeEnum": { + "base": "long", + "constants": { + "PowerActionNone": 0, + "PowerActionReserved": 1, + "PowerActionHibernate": 3, + "PowerActionShutdownOff": 6, + "PowerActionShutdown": 4, + "PowerActionSleep": 2, + "PowerActionShutdownReset": 5, + "PowerActionWarmEject": 7 + }, + "size": 4 + }, + "ScalingEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPS_CENTERED": 2, + "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, + "D3DKMDT_VPPS_STRETCHED": 3, + "D3DKMDT_VPPS_UNINITIALIZED": 0, + "D3DKMDT_VPPS_UNPINNED": 254, + "D3DKMDT_VPPS_IDENTITY": 1, + "D3DKMDT_VPPS_NOTSPECIFIED": 255, + "D3DKMDT_VPPS_CUSTOM": 5, + "D3DKMDT_VPPS_RESERVED1": 253 + }, + "size": 4 + }, + "CurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "StorageTypeEnum": { + "base": "long", + "constants": { + "SmStorageActual": 0, + "SmStorageNonActual": 1 + }, + "size": 4 + }, + "ScanLineOrderingEnum": { + "base": "long", + "constants": { + "D3DDDI_VSSLO_PROGRESSIVE": 1, + "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, + "D3DDDI_VSSLO_UNINITIALIZED": 0, + "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, + "D3DDDI_VSSLO_OTHER": 255 + }, + "size": 4 + }, + "PixelValueAccessModeEnum": { + "base": "long", + "constants": { + "D3DKMDT_PVAM_UNINITIALIZED": 0, + "D3DKMDT_PVAM_DIRECT": 1, + "D3DKMDT_PVAM_PRESETPALETTE": 2, + "D3DKMDT_PVAM_MAXVALID": 3 + }, + "size": 4 + }, + "PriorityPolicyEnum": { + "base": "long", + "constants": { + "IrqPriorityHigh": 3, + "IrqPriorityNormal": 2, + "IrqPriorityLow": 1, + "IrqPriorityUndefined": 0 + }, + "size": 4 + }, + "OrientationEnum": { + "base": "long", + "constants": { + "D3DKMDT_MO_90DEG": 2, + "D3DKMDT_MO_0DEG": 1, + "D3DKMDT_MO_270DEG": 4, + "D3DKMDT_MO_UNINITIALIZED": 0, + "D3DKMDT_MO_180DEG": 3 + }, + "size": 4 + }, + "ContentEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPC_NOTSPECIFIED": 255, + "D3DKMDT_VPPC_UNINITIALIZED": 0, + "D3DKMDT_VPPC_GRAPHICS": 1, + "D3DKMDT_VPPC_VIDEO": 2 + }, + "size": 4 + }, + "ColorBasisEnum": { + "base": "long", + "constants": { + "D3DKMDT_CB_MAXVALID": 5, + "D3DKMDT_CB_INTENSITY": 1, + "D3DKMDT_CB_SCRGB": 3, + "D3DKMDT_CB_YCBCR": 4, + "D3DKMDT_CB_SRGB": 2, + "D3DKMDT_CB_UNINITIALIZED": 0 + }, + "size": 4 + }, + "MoveRectStyleEnum": { + "base": "long", + "constants": { + "MoveRectMidTopAtCursor": 1, + "MoveRectSidewiseKeepPositionAtCursor": 3, + "MoveRectKeepPositionAtCursor": 0, + "MoveRectKeepAspectRatioAtCursor": 2 + }, + "size": 4 + }, + "VideoStandardEnum": { + "base": "long", + "constants": { + "D3DKMDT_VSS_PAL_G": 11, + "D3DKMDT_VSS_PAL_D": 14, + "D3DKMDT_VSS_PAL_B": 9, + "D3DKMDT_VSS_SECAM_K": 21, + "D3DKMDT_VSS_VESA_GTF": 2, + "D3DKMDT_VSS_PAL_L": 30, + "D3DKMDT_VSS_PAL_M": 31, + "D3DKMDT_VSS_PAL_K": 28, + "D3DKMDT_VSS_PAL_H": 12, + "D3DKMDT_VSS_PAL_I": 13, + "D3DKMDT_VSS_SECAM_L1": 24, + "D3DKMDT_VSS_VESA_DMT": 1, + "D3DKMDT_VSS_SECAM_L": 23, + "D3DKMDT_VSS_EIA_861": 25, + "D3DKMDT_VSS_PAL_N": 15, + "D3DKMDT_VSS_APPLE": 5, + "D3DKMDT_VSS_NTSC_M": 6, + "D3DKMDT_VSS_SECAM_H": 20, + "D3DKMDT_VSS_NTSC_J": 7, + "D3DKMDT_VSS_SECAM_B": 17, + "D3DKMDT_VSS_SECAM_G": 19, + "D3DKMDT_VSS_SECAM_D": 18, + "D3DKMDT_VSS_IBM": 4, + "D3DKMDT_VSS_SECAM_K1": 22, + "D3DKMDT_VSS_PAL_NC": 16, + "D3DKMDT_VSS_PAL_B1": 10, + "D3DKMDT_VSS_EIA_861A": 26, + "D3DKMDT_VSS_EIA_861B": 27, + "D3DKMDT_VSS_UNINITIALIZED": 0, + "D3DKMDT_VSS_OTHER": 255, + "D3DKMDT_VSS_PAL_K1": 29, + "D3DKMDT_VSS_VESA_CVT": 3, + "D3DKMDT_VSS_NTSC_443": 8 + }, + "size": 4 + }, + "ImportanceOrdinalEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPI_QUATERNARY": 4, + "D3DKMDT_VPPI_SECONDARY": 2, + "D3DKMDT_VPPI_PRIMARY": 1, + "D3DKMDT_VPPI_QUINARY": 5, + "D3DKMDT_VPPI_DENARY": 10, + "D3DKMDT_VPPI_SENARY": 6, + "D3DKMDT_VPPI_TERTIARY": 3, + "D3DKMDT_VPPI_SEPTENARY": 7, + "D3DKMDT_VPPI_NONARY": 9, + "D3DKMDT_VPPI_UNINITIALIZED": 0, + "D3DKMDT_VPPI_OCTONARY": 8, + "D3DKMDT_VPPI_MAX": 32, + "D3DKMDT_VPPI_NOTSPECIFIED": 255 + }, + "size": 4 + }, + "RangeTypeEnum": { + "base": "long", + "constants": { + "SmRangeBool": 2, + "SmRangeNonSharedInfo": 1, + "SmRangeSharedInfo": 0 + }, + "size": 4 + }, + "TimingTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_MTT_EXTRASTANDARD": 3, + "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, + "D3DKMDT_MTT_STANDARD": 2, + "D3DKMDT_MTT_UNINITIALIZED": 0, + "D3DKMDT_MTT_MAXVALID": 6, + "D3DKMDT_MTT_DETAILED": 4, + "D3DKMDT_MTT_ESTABLISHED": 1 + }, + "size": 4 + }, + "PixelFormatEnum": { + "base": "long", + "constants": { + "D3DDDIFMT_W11V11U10": 65, + "D3DDDIFMT_A16B16G16R16F": 113, + "D3DDDIFMT_A8R8G8B8": 21, + "D3DDDIFMT_D32_LOCKABLE": 84, + "D3DDDIFMT_L8": 50, + "D3DDDIFMT_DXVA_RESERVED27": 177, + "D3DDDIFMT_DXVA_RESERVED26": 176, + "D3DDDIFMT_DXVA_RESERVED25": 175, + "D3DDDIFMT_DXVA_RESERVED24": 174, + "D3DDDIFMT_DXVA_RESERVED23": 173, + "D3DDDIFMT_DXVA_RESERVED22": 172, + "D3DDDIFMT_DXVA_RESERVED21": 171, + "D3DDDIFMT_DXVA_RESERVED20": 170, + "D3DDDIFMT_DXVA_RESERVED29": 179, + "D3DDDIFMT_DXVA_RESERVED28": 178, + "D3DDDIFMT_R3G3B2": 27, + "D3DDDIFMT_A8R3G3B2": 29, + "D3DDDIFMT_INDEX16": 101, + "D3DDDIFMT_X4R4G4B4": 30, + "D3DDDIFMT_A4R4G4B4": 26, + "D3DDDIFMT_Q8W8V8U8": 63, + "D3DDDIFMT_FORCE_UINT": 2147483647, + "D3DDDIFMT_S1D15": 72, + "D3DDDIFMT_A16B16G16R16": 36, + "D3DDDIFMT_A8L8": 51, + "D3DDDIFMT_D24X4S4": 79, + "D3DDDIFMT_BINARYBUFFER": 199, + "D3DDDIFMT_DXVA_RESERVED30": 180, + "D3DDDIFMT_R32F": 114, + "D3DDDIFMT_VERTEXDATA": 100, + "D3DDDIFMT_R5G6B5": 23, + "D3DDDIFMT_R8G8_B8G8": 1195525970, + "D3DDDIFMT_A4L4": 52, + "D3DDDIFMT_A1R5G5B5": 25, + "D3DDDIFMT_X1R5G5B5": 24, + "D3DDDIFMT_D32": 71, + "D3DDDIFMT_G8R8_G8B8": 1111970375, + "D3DDDIFMT_A2B10G10R10": 31, + "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, + "D3DDDIFMT_MULTI2_ARGB8": 827606349, + "D3DDDIFMT_D16_LOCKABLE": 70, + "D3DDDIFMT_BITSTREAMDATA": 156, + "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, + "D3DDDIFMT_X8B8G8R8": 33, + "D3DDDIFMT_R8G8B8": 20, + "D3DDDIFMT_S8_LOCKABLE": 85, + "D3DDDIFMT_D24S8": 75, + "D3DDDIFMT_X8D24": 76, + "D3DDDIFMT_A2R10G10B10": 35, + "D3DDDIFMT_P8": 41, + "D3DDDIFMT_L6V5U5": 61, + "D3DDDIFMT_X8R8G8B8": 22, + "D3DDDIFMT_D16": 80, + "D3DDDIFMT_A2W10V10U10": 67, + "D3DDDIFMT_D24FS8": 83, + "D3DDDIFMT_MOTIONVECTORBUFFER": 157, + "D3DDDIFMT_L16": 81, + "D3DDDIFMT_X8L8V8U8": 62, + "D3DDDIFMT_A32B32G32R32F": 116, + "D3DDDIFMT_A8P8": 40, + "D3DDDIFMT_YUY2": 844715353, + "D3DDDIFMT_R16F": 111, + "D3DDDIFMT_G16R16": 34, + "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, + "D3DDDIFMT_Q16W16V16U16": 110, + "D3DDDIFMT_S8D24": 74, + "D3DDDIFMT_PICTUREPARAMSDATA": 150, + "D3DDDIFMT_A1": 118, + "D3DDDIFMT_FILMGRAINBUFFER": 158, + "D3DDDIFMT_A8": 28, + "D3DDDIFMT_UNKNOWN": 0, + "D3DDDIFMT_DXVA_RESERVED19": 169, + "D3DDDIFMT_D32F_LOCKABLE": 82, + "D3DDDIFMT_MACROBLOCKDATA": 151, + "D3DDDIFMT_A8B8G8R8": 32, + "D3DDDIFMT_UYVY": 1498831189, + "D3DDDIFMT_DXT1": 827611204, + "D3DDDIFMT_DEBLOCKINGDATA": 153, + "D3DDDIFMT_DXT3": 861165636, + "D3DDDIFMT_DXT4": 877942852, + "D3DDDIFMT_DXT5": 894720068, + "D3DDDIFMT_CxV8U8": 117, + "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, + "D3DDDIFMT_DXVA_RESERVED9": 159, + "D3DDDIFMT_DXT2": 844388420, + "D3DDDIFMT_G32R32F": 115, + "D3DDDIFMT_X4S4D24": 78, + "D3DDDIFMT_D24X8": 77, + "D3DDDIFMT_DXVA_RESERVED12": 162, + "D3DDDIFMT_DXVA_RESERVED13": 163, + "D3DDDIFMT_DXVA_RESERVED10": 160, + "D3DDDIFMT_DXVA_RESERVED11": 161, + "D3DDDIFMT_DXVA_RESERVED16": 166, + "D3DDDIFMT_DXVA_RESERVED17": 167, + "D3DDDIFMT_DXVA_RESERVED14": 164, + "D3DDDIFMT_DXVA_RESERVED15": 165, + "D3DDDIFMT_DXVA_RESERVED18": 168, + "D3DDDIFMT_D15S1": 73, + "D3DDDIFMT_V16U16": 64, + "D3DDDIFMT_SLICECONTROLDATA": 155, + "D3DDDIFMT_G16R16F": 112, + "D3DDDIFMT_INDEX32": 102, + "D3DDDIFMT_V8U8": 60 + }, + "size": 4 + }, + "IdTypeEnum": { + "base": "long", + "constants": { + "BusQueryCompatibleIDs": 2, + "BusQueryInstanceID": 3, + "BusQueryDeviceID": 0, + "BusQueryDeviceSerialNumber": 4, + "BusQueryHardwareIDs": 1, + "BusQueryContainerID": 5 + }, + "size": 4 + }, + "StartCurrentHitTargetEnum": { + "base": "long", + "constants": { + "ThresholdMarginRight": 2, + "ThresholdMarginMax": 4, + "ThresholdMarginBottom": 3, + "ThresholdMarginLeft": 1, + "ThresholdMarginTop": 0 + }, + "size": 4 + }, + "TypeEnum": { + "base": "long", + "constants": { + "DevicePowerState": 1, + "SystemPowerState": 0 + }, + "size": 4 + }, + "RotationEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPR_IDENTITY": 1, + "D3DKMDT_VPPR_NOTSPECIFIED": 255, + "D3DKMDT_VPPR_UNPINNED": 254, + "D3DKMDT_VPPR_ROTATE270": 4, + "D3DKMDT_VPPR_ROTATE90": 2, + "D3DKMDT_VPPR_ROTATE180": 3, + "D3DKMDT_VPPR_UNINITIALIZED": 0 + }, + "size": 4 + }, + "CopyProtectionTypeEnum": { + "base": "long", + "constants": { + "D3DKMDT_VPPMT_NOTSPECIFIED": 255, + "D3DKMDT_VPPMT_UNINITIALIZED": 0, + "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, + "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, + "D3DKMDT_VPPMT_NOPROTECTION": 1 + }, + "size": 4 + }, + "FsInformationClassEnum": { + "base": "long", + "constants": { + "FileFsFullSizeInformation": 7, + "FileFsAttributeInformation": 5, + "FileFsVolumeFlagsInformation": 10, + "FileFsVolumeInformation": 1, + "FileFsSizeInformation": 3, + "FileFsLabelInformation": 2, + "FileFsDeviceInformation": 4, + "FileFsControlInformation": 6, + "FileFsDriverPathInformation": 9, + "FileFsMaximumInformation": 11, + "FileFsObjectIdInformation": 8 + }, + "size": 4 + }, + "DeviceTextTypeEnum": { + "base": "long", + "constants": { + "DeviceTextLocationInformation": 1, + "DeviceTextDescription": 0 + }, + "size": 4 } - }, - "kind": "struct", - "size": 24 - }, - "tagCLIENTTHREADINFO": { - "fields": { - "fsWakeMask": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "CTIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fsWakeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - }, - "fsWakeBitsJournal": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "fsChangeBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4 - }, - "tickLastMsgChecked": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "tagKbdNlsLayer": { - "fields": { - "OEMIdentifier": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "NumOfVkToF": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pusMouseVKey": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "NumOfMouseVKey": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pVkToF": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_FUNCTION_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "LayoutInformation": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1158": { - "fields": { - "Reserved": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 2 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - }, - "Init": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HBITMAP__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_124b": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "count": 3, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1 - }, - "InPath": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_TL": { - "fields": { - "pfnFree": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pobj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagTOUCHINPUTINFO": { - "fields": { - "dwcInputs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "TouchInput": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagTOUCHINPUT" - }, - "kind": "array" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 80 - }, - "tagTHREADINFO": { - "fields": { - "ForceLegacyResizeNCMetr": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptl": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 336 - }, - "timeLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 448 - }, - "DontJournalAttach": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fPack": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 26 - }, - "offset": 928 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 516 - }, - "psmsSent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 424 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 552 - }, - "DefaultCharset": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 512 - }, - "psmsReceiveList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 440 - }, - "sphkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 560 - }, - "No50ExStyles": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "IgnoreFaults": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pClientInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTINFO" - }, - "kind": "pointer" - }, - "offset": 400 - }, - "DDENoAsyncReg": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DealyHwndShakeChk": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "amdesk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 720 - }, - "fsChangeBitsRemoved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 704 - }, - "psmsCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 432 - }, - "NoInitFlagsOnFocus": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "StrictLLHook": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "NoShadow": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EnumHelv": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoBatching": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 736 - }, - "Winver31": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Win30AvgWidth": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "AlwaysSendSyncPaint": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "IgnoreNoDiscard": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cPaintsReady": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 480 - }, - "SubtractClips": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "apEvent": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 712 - }, - "cEnterCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 672 - }, - "OpenGLEMF": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "fThreadCleanupFinished": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "idLast": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 456 - }, - "DisableDBCSProp": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "NoEMFSpooling": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptdb": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "SpareCompatFlags2": { - "type": { - "bit_position": 33, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 31 - }, - "offset": 520 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "mlPost": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 680 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 496 - }, - "NoCustomPaperSize": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cTimersReady": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 484 - }, - "NoScrollBarCtxMenu": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hPrevHidData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 880 - }, - "NoPaddedBorder": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "DpiAware": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "MultipleBands": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 376 - }, - "AnimationOff": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "No50ExStyleBits": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ulThreadFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 928 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 472 - }, - "spklActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 360 - }, - "MoreExtraWndWords": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "NoGhost": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoHRGN1": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "ptLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 628 - }, - "GiveUpForegound": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "spDefaultImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 656 - }, - "pmsd": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MOVESIZEDATA" - }, - "kind": "pointer" - }, - "offset": 544 - }, - "HardwareMixer": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 904 - }, - "EnumTTNotDevice": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fSpecialInitialization": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ForceFusion": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "cti": { - "type": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "offset": 864 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pstrAppName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 416 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "SendMnuDblClk": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "DDENoSync": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "EditNoMouseHide": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ptLastReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 636 - }, - "hTouchInputCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HTOUCHINPUT__" - }, - "kind": "pointer" - }, - "offset": 888 - }, - "pEventQueueServer": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "cNestedStableVisRgn": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "NoDrawPatRect": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ForceTTGrapchis": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "GetDeviceCaps": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fsReserveKeys": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 708 - }, - "pq": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 352 - }, - "NoSoftCursOnMoveSize": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "hEventQueueClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 592 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "DDE": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "exitCode": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 464 - }, - "wchInjected": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 706 - }, - "CallTTDevice": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "MsShellDlg": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TransparentBltMirror": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "PtiLink": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 640 - }, - "HackWinFlags": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "cVisWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 728 - }, - "NcCalcSizeOnMove": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "KCOff": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "readyHead": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 912 - }, - "pMenuState": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 488 - }, - "UsePrintingEscape": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "hGestureInfoCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "HGESTUREINFO__" - }, - "kind": "pointer" - }, - "offset": 896 - }, - "ForceTextBand": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cWindows": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 724 - }, - "fETWReserved": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 928 - }, - "pqAttach": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 528 - }, - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "TIF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 408 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "Win31DevModeSize": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSBTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBTRACK" - }, - "kind": "pointer" - }, - "offset": 584 - }, - "spwndDefaultIme": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 648 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 520 - }, - "EditSetTextMunge": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "Random31Ux": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "fgfSwitchInProgressSetter": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 928 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 392 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "NoTimeCbProtect": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "DisableFontAssoc": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pcti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 368 - }, - "NoCharDeadKey": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "TTIgnoreRasterDupe": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "lParamHkCurrent": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 568 - }, - "qwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 520 - }, - "wParamHkCurrent": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 576 - }, - "NoWindowArrangement": { - "type": { - "bit_position": 32, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "ActiveMenus": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 384 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "psiiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 504 - }, - "IgnoreTopMost": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "TryExceptCallWndProc": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "NoDDETrackDying": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "FontSubs": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 520 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "SmoothScrolling": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 624 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "ptiSibling": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 536 - }, - "hklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "IncreaseStack": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 516 - } - }, - "kind": "struct", - "size": 936 - }, - "__unnamed_11ff": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "EaLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FileAttributes": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_CALLPROCDATA": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "pfnClientPrevious": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "wType": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "spcpdNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH": { - "fields": { - "VidPnTargetColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 48 - }, - "VidPnTargetColorBasis": { - "type": { - "kind": "enum", - "name": "VidPnTargetColorBasisEnum" - }, - "offset": 44 - }, - "ContentTransformation": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION" - }, - "offset": 12 - }, - "GammaRamp": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GAMMA_RAMP" - }, - "offset": 336 - }, - "CopyProtection": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION" - }, - "offset": 68 - }, - "VidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Content": { - "type": { - "kind": "enum", - "name": "ContentEnum" - }, - "offset": 64 - }, - "VisibleFromActiveTLOffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 28 - }, - "VidPnTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "VisibleFromActiveBROffset": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 36 - }, - "ImportanceOrdinal": { - "type": { - "kind": "enum", - "name": "ImportanceOrdinalEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 360 - }, - "__unnamed_1253": { - "fields": { - "PowerSequence": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_POWER_SEQUENCE" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESS_HID_TABLE": { - "fields": { - "UsagePageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 96 - }, - "fExclusiveMouseSink": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboardSink": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fAppKeys": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fCaptureMouse": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyMouse": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawKeyboard": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fNoLegacyKeyboard": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "nSinks": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fExclusiveKeyboardSink": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "spwndTargetKbd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "UsagePageList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 32 - }, - "UsageLast": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 98 - }, - "fNoHotKeys": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "pLastRequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_REQUEST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "ExclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - }, - "spwndTargetMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fRawMouse": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "fRawMouseSink": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 100 - }, - "InclusionList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1809": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "MessageCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHOOK": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "iHook": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "phkNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "offPfn": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "fLastHookHung": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 88 - }, - "nTimeout": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 7 - }, - "offset": 88 - }, - "ihmod": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "ptiHooked": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 80 - } - }, - "kind": "struct", - "size": 96 - }, - "_THROBJHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagPROCESS_HID_REQUEST": { - "fields": { - "fSinkable": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "pTLCInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_TLC_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fDevNotify": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "fExSinkable": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "ptr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "pPORequest": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHID_PAGEONLY_REQUEST" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "fExclusiveOrphaned": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 20 - }, - "spwndTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - } - }, - "kind": "struct", - "size": 40 - }, - "_KFLOATING_SAVE": { - "fields": { - "Dummy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT": { - "fields": { - "Rotate270": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate90": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Rotate180": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMLIST": { - "fields": { - "cMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pqmsgRead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pqmsgWriteLast": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_CONSOLE_CARET_INFO": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1807": { - "fields": { - "Affinity": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Vector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - }, - "Level": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "DEADKEY": { - "fields": { - "wchComposed": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 4 - }, - "dwBoth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uFlags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 6 - } - }, - "kind": "struct", - "size": 8 - }, - "tagPROCESSINFO": { - "fields": { - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "fHasMagContext": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 736 - }, - "hwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWINSTA__" - }, - "kind": "pointer" - }, - "offset": 608 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ptiList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 256 - }, - "pHidTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESS_HID_TABLE" - }, - "kind": "pointer" - }, - "offset": 744 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "pclsPublicList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 288 - }, - "dwhmodLibLoadedMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 340 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "hdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDESK__" - }, - "kind": "pointer" - }, - "offset": 328 - }, - "pvwplWndGCList": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 760 - }, - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "dwImeCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 696 - }, - "hMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HMONITOR__" - }, - "kind": "pointer" - }, - "offset": 624 - }, - "ptiMainThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "dwRegisteredClasses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 752 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "usi": { - "type": { - "kind": "struct", - "name": "tagUSERSTARTUPINFO" - }, - "offset": 708 - }, - "luidSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 700 - }, - "Unused": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 736 - }, - "pW32Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 688 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 320 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "bmHandleFlags": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_BITMAP" - }, - "offset": 648 - }, - "pclsPrivateList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "amwinsta": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 616 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ppiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 736 - }, - "dwHotkey": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 620 - }, - "cSysExpunge": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "rpdeskStartup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pdvList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 632 - }, - "pwpi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "ppiNextRunning": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "dwLayout": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 740 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "rpwinsta": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 600 - }, - "pCursorCache": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 664 - }, - "pClientBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 672 - }, - "ahmodLibLoaded": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 344 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 640 - }, - "dwLpkEntryPoints": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 680 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 768 - }, - "HBRUSH__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLIP": { - "fields": { - "fmt": { - "type": { - "kind": "enum", - "name": "fmtEnum" - }, - "offset": 0 - }, - "fGlobalHandle": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagUAHMENUPOPUPMETRICS": { - "fields": { - "rgcx": { - "type": { - "count": 4, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 0 - }, - "fUpdateMaxWidths": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 20 - }, - "tagSMS": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 72 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 80 - }, - "lpResultCallBack": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lRet": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 56 - }, - "psmsReceiveNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "tSent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "pvCapture": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "psmsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSMS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ptiReceiver": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ptiCallBackSender": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "dwData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 112 - }, - "__unnamed_195e": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_195c": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Alignment40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 24 - }, - "_W32THREAD": { - "fields": { - "pRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "iVisRgnUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 328 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pDevHTInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "pUMPDHeap": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pgdiBrushAttr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ulWindowSystemRendering": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "tlSpriteState": { - "type": { - "kind": "struct", - "name": "_TLSPRITESTATE" - }, - "offset": 104 - }, - "pdcoRender": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "bEnableEngUpdateDeviceSurface": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 320 - }, - "pdcoAA": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 296 - }, - "pNonRBRecursionCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "ptlW32": { - "type": { - "subtype": { - "kind": "struct", - "name": "_TL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "GdiTmpTgoList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 80 - }, - "pUMPDObjs": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pgdiDcattr": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "bIncludeSprites": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 321 - }, - "pEThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pSpriteState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "pProxyPort": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "ulDevHTInfoUniqueness": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "pdcoSrc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 312 - }, - "pUMPDObj": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pClientID": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 336 - }, - "_VK_TO_WCHAR_TABLE": { - "fields": { - "pVkToWchars": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHARS1" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cbSize": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - }, - "nModifications": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPROPLIST": { - "fields": { - "aprop": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "tagPROP" - }, - "kind": "array" - }, - "offset": 8 - }, - "iFirstFree": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cEntries": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_D3DKMDT_FREQUENCY_RANGE": { - "fields": { - "MinVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 0 - }, - "MaxVSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 8 - }, - "MaxHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 24 - }, - "MinHSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_11f8": { - "fields": { - "Apc": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KAPC" - }, - "offset": 0 - }, - "CompletionKey": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Overlay": { - "type": { - "kind": "struct", - "name": "__unnamed_11f5" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_18bf": { - "fields": { - "BaseMiddle": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "Flags1": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "Flags2": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "tagPROFILEVALUEINFO": { - "fields": { - "dwValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "uSection": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "pwszKeyName": { - "type": { - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_11f5": { - "fields": { - "Thread": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ETHREAD" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "DeviceQueueEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_KDEVICE_QUEUE_ENTRY" - }, - "offset": 0 - }, - "CurrentStackLocation": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_STACK_LOCATION" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "DriverContext": { - "type": { - "count": 4, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 0 - }, - "AuxiliaryBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "OriginalFileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "PacketType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 80 - }, - "__unnamed_125f": { - "fields": { - "AllocatedResources": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "AllocatedResourcesTranslated": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_CM_RESOURCE_LIST" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "D3DDDI_DXGI_RGB": { - "fields": { - "Blue": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "Green": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "Red": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1219": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FsControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_125b": { - "fields": { - "State": { - "type": { - "kind": "struct", - "name": "nt_symbols!_POWER_STATE" - }, - "offset": 16 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 8 - }, - "SystemContext": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ShutdownType": { - "type": { - "kind": "enum", - "name": "ShutdownTypeEnum" - }, - "offset": 24 - }, - "SystemPowerStateContext": { - "type": { - "kind": "struct", - "name": "nt_symbols!_SYSTEM_POWER_STATE_CONTEXT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "HDC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagDISPLAYINFO": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "SpatialListHead": { - "type": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "offset": 144 - }, - "BitCountMax": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 130 - }, - "cyGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "hdcBits": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fDesktopIsRect": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "hbmGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pmdev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "cFullScreen": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 160 - }, - "cxGray": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 128 - }, - "hDevInfo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fAnyPalette": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 132 - }, - "pspbFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pMonitorPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 162 - }, - "pMonitorFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "hdcGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "hrgnScreenReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cMonitors": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "hdcScreen": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "DockThresholdMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "pdceFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 168 - }, - "tagWin32AllocStats": { - "fields": { - "dwMaxAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwMaxMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwCrtAlloc": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwCrtMem": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18c5": { - "fields": { - "DefaultBig": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "BaseMiddle": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "BaseHigh": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 8 - }, - "offset": 0 - }, - "LimitHigh": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 0 - }, - "System": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Granularity": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Dpl": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 0 - }, - "Type": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "Present": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "LongMode": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1261": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ProviderId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "BufferSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DataPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1263": { - "fields": { - "Argument4": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Argument2": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Argument3": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "Argument1": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1265": { - "fields": { - "DeviceIoControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121d" - }, - "offset": 0 - }, - "ReadWriteConfig": { - "type": { - "kind": "struct", - "name": "__unnamed_123d" - }, - "offset": 0 - }, - "Create": { - "type": { - "kind": "struct", - "name": "__unnamed_11ff" - }, - "offset": 0 - }, - "Write": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "PowerSequence": { - "type": { - "kind": "struct", - "name": "__unnamed_1253" - }, - "offset": 0 - }, - "QueryId": { - "type": { - "kind": "struct", - "name": "__unnamed_1243" - }, - "offset": 0 - }, - "SetFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1213" - }, - "offset": 0 - }, - "CreatePipe": { - "type": { - "kind": "struct", - "name": "__unnamed_1203" - }, - "offset": 0 - }, - "Power": { - "type": { - "kind": "struct", - "name": "__unnamed_125b" - }, - "offset": 0 - }, - "Read": { - "type": { - "kind": "struct", - "name": "__unnamed_1209" - }, - "offset": 0 - }, - "StartDevice": { - "type": { - "kind": "struct", - "name": "__unnamed_125f" - }, - "offset": 0 - }, - "QueryDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120d" - }, - "offset": 0 - }, - "LockControl": { - "type": { - "kind": "struct", - "name": "__unnamed_121b" - }, - "offset": 0 - }, - "QueryInterface": { - "type": { - "kind": "struct", - "name": "__unnamed_1233" - }, - "offset": 0 - }, - "Others": { - "type": { - "kind": "struct", - "name": "__unnamed_1263" - }, - "offset": 0 - }, - "FileSystemControl": { - "type": { - "kind": "struct", - "name": "__unnamed_1219" - }, - "offset": 0 - }, - "SetLock": { - "type": { - "kind": "struct", - "name": "__unnamed_123f" - }, - "offset": 0 - }, - "QueryDeviceText": { - "type": { - "kind": "struct", - "name": "__unnamed_1247" - }, - "offset": 0 - }, - "WMI": { - "type": { - "kind": "struct", - "name": "__unnamed_1261" - }, - "offset": 0 - }, - "CreateMailslot": { - "type": { - "kind": "struct", - "name": "__unnamed_1207" - }, - "offset": 0 - }, - "FilterResourceRequirements": { - "type": { - "kind": "struct", - "name": "__unnamed_123b" - }, - "offset": 0 - }, - "MountVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QueryVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1217" - }, - "offset": 0 - }, - "UsageNotification": { - "type": { - "kind": "struct", - "name": "__unnamed_124b" - }, - "offset": 0 - }, - "Scsi": { - "type": { - "kind": "struct", - "name": "__unnamed_1229" - }, - "offset": 0 - }, - "WaitWake": { - "type": { - "kind": "struct", - "name": "__unnamed_124f" - }, - "offset": 0 - }, - "QueryFile": { - "type": { - "kind": "struct", - "name": "__unnamed_1211" - }, - "offset": 0 - }, - "VerifyVolume": { - "type": { - "kind": "struct", - "name": "__unnamed_1225" - }, - "offset": 0 - }, - "QuerySecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_121f" - }, - "offset": 0 - }, - "QueryDeviceRelations": { - "type": { - "kind": "struct", - "name": "__unnamed_122d" - }, - "offset": 0 - }, - "NotifyDirectory": { - "type": { - "kind": "struct", - "name": "__unnamed_120f" - }, - "offset": 0 - }, - "SetSecurity": { - "type": { - "kind": "struct", - "name": "__unnamed_1221" - }, - "offset": 0 - }, - "DeviceCapabilities": { - "type": { - "kind": "struct", - "name": "__unnamed_1237" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1817": { - "fields": { - "Length48": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1815": { - "fields": { - "Length40": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "tagKbdLayer": { - "fields": { - "pVkToWcharTable": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VK_TO_WCHAR_TABLE" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fLocaleFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "pCharModifiers": { - "type": { - "subtype": { - "kind": "struct", - "name": "MODIFIERS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pKeyNamesExt": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pDeadKey": { - "type": { - "subtype": { - "kind": "struct", - "name": "DEADKEY" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pusVSCtoVK": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pKeyNamesDead": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pLigature": { - "type": { - "subtype": { - "kind": "struct", - "name": "_LIGATURE1" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "cbLgEntry": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 85 - }, - "pKeyNames": { - "type": { - "subtype": { - "kind": "struct", - "name": "VSC_LPWSTR" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "dwSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "nLgMax": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 84 - }, - "pVSCtoVK_E1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pVSCtoVK_E0": { - "type": { - "subtype": { - "kind": "struct", - "name": "_VSC_VK" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "bMaxVSCtoVK": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1813": { - "fields": { - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT": { - "fields": { - "Centered": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "AspectRatioCenteredMax": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Stretched": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Identity": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Custom": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1958": { - "fields": { - "MinBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "MaxBusNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_2DREGION": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "HRGN__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1954": { - "fields": { - "AffinityPolicy": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "PriorityPolicy": { - "type": { - "kind": "enum", - "name": "PriorityPolicyEnum" - }, - "offset": 12 - }, - "Group": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "MaximumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "TargetedProcessors": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "MinimumVector": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "_PROCMARKHEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagSIZE": { - "fields": { - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagDESKTOPVIEW": { - "fields": { - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "pdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pdvNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPVIEW" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1819": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length64": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "_DMM_COFUNCPATHSMODALITY_SERIALIZATION": { - "fields": { - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "PathAndTargetModeSetOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBTRACK": { - "fields": { - "spwndSBNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hTimerSB": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "cmdSB": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "xxxpfnSB": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fTrackVert": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posNew": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 84 - }, - "posOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "fCtlSB": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "rcTrack": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 32 - }, - "fTrackRecalc": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndSB": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "pxOld": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fHitOld": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "pSBCalc": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBCALC" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "nBar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 88 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_16c1": { - "fields": { - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "MaxPixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_DMA_ADAPTER": { - "fields": { - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 0 - }, - "DmaOperations": { - "type": { - "subtype": { - "kind": "struct", - "name": "_DMA_OPERATIONS" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMONITOR": { - "fields": { - "hDev": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "rcMonitorReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 28 - }, - "pMonitorNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hDevReal": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "hrgnMonitorReal": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "rcWorkReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 44 - }, - "dwMONFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cWndStack": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 74 - }, - "DockTargets": { - "type": { - "count": 7, - "subtype": { - "count": 4, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "kind": "array" - }, - "offset": 96 - }, - "Spare0": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 144 - }, - "__unnamed_180b": { - "fields": { - "Translated": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Raw": { - "type": { - "kind": "struct", - "name": "__unnamed_1809" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagRECT": { - "fields": { - "top": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "right": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "bottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "left": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_180d": { - "fields": { - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Port": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Channel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "MODIFIERS": { - "fields": { - "wMaxModBits": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - }, - "pVkToBit": { - "type": { - "subtype": { - "kind": "struct", - "name": "VK_TO_BIT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ModNumber": { - "type": { - "count": 0, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 10 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120f": { - "fields": { - "CompletionFilter": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_120d": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 16 - }, - "FileName": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHSFROMSOURCE_SERIALIZATION": { - "fields": { - "PathAndTargetModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 48 - }, - "NumPathsFromSource": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 40 - }, - "SourceMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_SOURCE_MODE" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 480 - }, - "tagMSG": { - "fields": { - "wParam": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "lParam": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 24 - }, - "pt": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 36 - }, - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "time": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "message": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 48 - }, - "tagDPISERVERINFO": { - "fields": { - "hMsgFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hCaptionFont": { - "type": { - "subtype": { - "kind": "struct", - "name": "HFONT__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "gclBorder": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cxMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "wMaxBtnSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "cyMsgFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DDDI_GAMMA_RAMP_RGB256x3x16": { - "fields": { - "Blue": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 1024 - }, - "Green": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 512 - }, - "Red": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1536 - }, - "__unnamed_124f": { - "fields": { - "PowerState": { - "type": { - "kind": "enum", - "name": "PowerStateEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagWOWPROCESSINFO": { - "fields": { - "ptdbHead": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ptiScheduled": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "nRecvLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CSLockCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "nSendLock": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pEventWowExec": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "lpfnWowExitTask": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "CSOwningThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "hEventWowExecClient": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwpiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "HTOUCHINPUT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagMENU": { - "fields": { - "iItem": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCDESKHEAD" - }, - "offset": 0 - }, - "umpm": { - "type": { - "kind": "struct", - "name": "tagUAHMENUPOPUPMETRICS" - }, - "offset": 132 - }, - "cItems": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pParentMenus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "fFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "cxMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "dwContextHelpId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "cxTextAlign": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "cAlloced": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "hbrBack": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwArrowsOn": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 128 - }, - "iMaxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 124 - }, - "dwMenuData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "cyMenu": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "rgItems": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagITEM" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "cyMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - } - }, - "kind": "struct", - "size": 152 - }, - "_D3DDDI_GAMMA_RAMP_DXGI_1": { - "fields": { - "GammaCurve": { - "type": { - "count": 1025, - "subtype": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "kind": "array" - }, - "offset": 24 - }, - "Scale": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 0 - }, - "Offset": { - "type": { - "kind": "struct", - "name": "D3DDDI_DXGI_RGB" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 12324 - }, - "_MOVESIZEDATA": { - "fields": { - "fmsKbd": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "pStartMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "impy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 152 - }, - "fMoveFromMax": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapMoving": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "frcNormalCheckPtValid": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptMaxTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 96 - }, - "ptRestore": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 156 - }, - "fUsePreviewRect": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForceSizing": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fThresholdSelector": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 3 - }, - "offset": 164 - }, - "ptStartHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 208 - }, - "fDragFullWindows": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fForeground": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "dyMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 140 - }, - "fHasSoftwareCursor": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsHitPtOffScreen": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fSnapSizingTemporaryAllowed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fCheckPtForcefullyRestored": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedRight": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ulCountDragOutOfLeftRightTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 228 - }, - "Unused": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 4 - }, - "offset": 164 - }, - "dxMouse": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 136 - }, - "fStartVerticallyMaximizedRight": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcParent": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 72 - }, - "fOffScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fWindowWasSuperMaximized": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fVerticallyMaximizedLeft": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "StartCurrentHitTarget": { - "type": { - "kind": "enum", - "name": "StartCurrentHitTargetEnum" - }, - "offset": 176 - }, - "fHasPreviewRect": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fLockWindowUpdate": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcPreview": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 40 - }, - "fSnapSizing": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fIsMoveSizeLoop": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fInitSize": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcDragCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "ulCountDragOutOfTopTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 224 - }, - "rcPreviewCursor": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 56 - }, - "CurrentHitTarget": { - "type": { - "kind": "enum", - "name": "CurrentHitTargetEnum" - }, - "offset": 192 - }, - "fSnapMovingTemporaryAllowed": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "fTrackCancelled": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "ptHitWindowRelative": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 200 - }, - "ptLastTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 216 - }, - "cmd": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 144 - }, - "Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 164 - }, - "MoveRectStyle": { - "type": { - "kind": "enum", - "name": "MoveRectStyleEnum" - }, - "offset": 196 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 104 - }, - "ulCountSizeOutOfTopBottomTarget": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 232 - }, - "fStartVerticallyMaximizedLeft": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 164 - }, - "rcNormalStartCheckPt": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 120 - }, - "ptMinTrack": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 88 - }, - "rcDrag": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 8 - }, - "pMonitorCurrentHitTarget": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "impx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 148 - } - }, - "kind": "struct", - "size": 240 - }, - "_D3DDDI_RATIONAL": { - "fields": { - "Denominator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Numerator": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "VWPL": { - "fields": { - "cElem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "aElement": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "VWPLELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "fTagged": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cThreshhold": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "cPwnd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagTEXTMETRICW": { - "fields": { - "tmOverhang": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "tmPitchAndFamily": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 55 - }, - "tmStruckOut": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 54 - }, - "tmCharSet": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 56 - }, - "tmDigitizedAspectX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "tmDigitizedAspectY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "tmFirstChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 44 - }, - "tmWeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "tmDescent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "tmDefaultChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 48 - }, - "tmLastChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 46 - }, - "tmMaxCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "tmItalic": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 52 - }, - "tmUnderlined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 53 - }, - "tmInternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "tmAscent": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "tmHeight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "tmAveCharWidth": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "tmBreakChar": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 50 - }, - "tmExternalLeading": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 60 - }, - "_SCATTER_GATHER_LIST": { - "fields": { - "Elements": { - "type": { - "count": 0, - "subtype": { - "kind": "struct", - "name": "_SCATTER_GATHER_ELEMENT" - }, - "kind": "array" - }, - "offset": 16 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "NumberOfElements": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "HICON__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_HANDLEENTRY": { - "fields": { - "pOwner": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "bType": { - "type": { - "kind": "enum", - "name": "bTypeEnum" - }, - "offset": 16 - }, - "bFlags": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 17 - }, - "phead": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HEAD" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "wUniq": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - } - }, - "kind": "struct", - "size": 24 - }, - "_THRDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagSVR_INSTANCE_INFO": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_THROBJHEAD" - }, - "offset": 0 - }, - "next": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nextInThisThread": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSVR_INSTANCE_INFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "spwndEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "afCmd": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pcii": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_VIDPNTARGETMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 80 - }, - "_DMM_COMMITVIDPNREQUEST_SERIALIZATION": { - "fields": { - "RequestDiagInfo": { - "type": { - "kind": "struct", - "name": "_DMM_COMMITVIDPNREQUEST_DIAGINFO" - }, - "offset": 4 - }, - "AffectedVidPnSourceId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "VidPnSerialization": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPN_SERIALIZATION" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 28 - }, - "tagPOPUPMENU": { - "fields": { - "fDroppedLeft": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fIsSysMenu": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posDropped": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fIsMenuBar": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHierarchyDropped": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDropNextPopup": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fRightButton": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ppopupmenuRoot": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "fFirstClick": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNotify": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fRtoL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSendUninit": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fAboutToHide": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndNextPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "fFlushDelayedFree": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHasMenuBar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fTrackMouseEvent": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fNoNotify": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "posSelectedItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fUseMonitorRect": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndPrevPopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "ppmDelayedFree": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "fFreed": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fSynchronous": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spmenuAlternate": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "fDestroyed": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "iDropDir": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 0 - }, - "fIsTrackPopup": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "spwndActivePopup": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "fInCancel": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fToggle": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fDelayedFree": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fHideTimer": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "fShowTimer": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "_D3DKMDT_MONITOR_SOURCE_MODE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 84 - }, - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "ColorCoeffDynamicRanges": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES" - }, - "offset": 68 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 88 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 96 - }, - "_DMM_MONITORDESCRIPTOR_SERIALIZATION": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 8 - }, - "Data": { - "type": { - "count": 128, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 12 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 140 - }, - "__unnamed_127c": { - "fields": { - "Wcb": { - "type": { - "kind": "struct", - "name": "nt_symbols!_WAIT_CONTEXT_BLOCK" - }, - "offset": 0 - }, - "ListEntry": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_D3DMATRIX": { - "fields": { - "_41": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 48 - }, - "_42": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 52 - }, - "_43": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 56 - }, - "_44": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 60 - }, - "_34": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 44 - }, - "_14": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 12 - }, - "_13": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 8 - }, - "_12": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 4 - }, - "_11": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 0 - }, - "_24": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 28 - }, - "_31": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 32 - }, - "_33": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 40 - }, - "_32": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 36 - }, - "_22": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 20 - }, - "_23": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 24 - }, - "_21": { - "type": { - "kind": "base", - "name": "float" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 64 - }, - "_LARGE_UNICODE_STRING": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumLength": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 31 - }, - "offset": 4 - }, - "bAnsi": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "_VK_VALUES_STRINGS": { - "fields": { - "fReserved": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "pszMultiNames": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagHID_TLC_INFO": { - "fields": { - "cExcludeOrphaned": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - }, - "cDevices": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "usUsage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "cExcludeRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cUsagePageRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "cDirectRequest": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION": { - "fields": { - "Info": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_SOURCE_MODE" - }, - "offset": 0 - }, - "TimingType": { - "type": { - "kind": "enum", - "name": "TimingTypeEnum" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 104 - }, - "tagCURSOR": { - "fields": { - "rt": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 58 - }, - "head": { - "type": { - "kind": "struct", - "name": "_PROCMARKHEAD" - }, - "offset": 0 - }, - "hbmUserAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "xHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 68 - }, - "hbmColor": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pcurNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "CURSORF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hbmMask": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bpp": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 120 - }, - "cy": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 128 - }, - "cx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "rcBounds": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 96 - }, - "atomModName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 56 - }, - "hbmAlpha": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "yHotspot": { - "type": { - "kind": "base", - "name": "short" - }, - "offset": 70 - }, - "strName": { - "type": { - "kind": "struct", - "name": "nt_symbols!_UNICODE_STRING" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 136 - }, - "_D3DKMDT_GAMMA_RAMP": { - "fields": { - "Data": { - "type": { - "kind": "struct", - "name": "__unnamed_182e" - }, - "offset": 16 - }, - "DataSize": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "HWND__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1207": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_MAILSLOT_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_18a1": { - "fields": { - "Text": { - "type": { - "kind": "enum", - "name": "TextEnum" - }, - "offset": 0 - }, - "Graphics": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_GRAPHICS_RENDERING_FORMAT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DMM_VIDPNPATHANDTARGETMODE_SERIALIZATION": { - "fields": { - "TargetMode": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_TARGET_MODE" - }, - "offset": 360 - }, - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 432 - }, - "HKL__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1209": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "tagDCE": { - "fields": { - "hrgnClipPublic": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pwndOrg": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pdceNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ppiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "DCX_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "hdc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ptiOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "hrgnSavedVis": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pwndRedirect": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pMonitor": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMONITOR" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pwndClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 96 - }, - "VSC_LPWSTR": { - "fields": { - "vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pwsz": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagQ": { - "fields": { - "hwndDblClk": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "timeDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "spwndFocus": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 328 - }, - "cLockCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 322 - }, - "iCursorLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 312 - }, - "ptiSysLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "caret": { - "type": { - "kind": "struct", - "name": "tagCARET" - }, - "offset": 232 - }, - "ptiMouse": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "spwndActivePrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ptMouseMove": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 128 - }, - "msgDblClk": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 100 - }, - "msgJournal": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 324 - }, - "ptiKeyboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "cThreads": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 320 - }, - "QF_flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 316 - }, - "mlInput": { - "type": { - "kind": "struct", - "name": "tagMLIST" - }, - "offset": 0 - }, - "spwndActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "codeCapture": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 96 - }, - "idSysLock": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "spcurCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 304 - }, - "ulEtwReserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 336 - }, - "ptDblClk": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 120 - }, - "xbtnDblClk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 104 - }, - "afKeyRecentDown": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "afKeyState": { - "type": { - "count": 64, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 168 - }, - "spwndCapture": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "idSysPeek": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 344 - }, - "__unnamed_1203": { - "fields": { - "ShareAccess": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 18 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "SecurityContext": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_SECURITY_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Options": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Parameters": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_NAMED_PIPE_CREATE_PARAMETERS" - }, - "kind": "pointer" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "HGESTUREINFO__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagCLS": { - "fields": { - "spcur": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 100 - }, - "pclsClone": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "lpszClientAnsiMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pclsBase": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "atomNVClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "pclsNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "CSF_flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "lpszAnsiClassName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "spcpdFirst": { - "type": { - "subtype": { - "kind": "struct", - "name": "_CALLPROCDATA" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "lpszClientUnicodeMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "cbclsExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 96 - }, - "lpszMenuName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "spicnSm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "cWndReferenceCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 80 - }, - "hbrBackground": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "spicn": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCURSOR" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 12 - }, - "pdce": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDCE" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "rpdeskParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "atomClassName": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 160 - }, - "_PROCDESKHEAD": { - "fields": { - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pSelf": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "rpdesk": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "_DMM_COMMITVIDPNREQUESTSET_SERIALIZATION": { - "fields": { - "CommitVidPnRequestOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumCommitVidPnRequests": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "_VK_TO_FUNCTION_TABLE": { - "fields": { - "NLSFEProcType": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "NLSFEProcCurrent": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 2 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcSwitch": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 3 - }, - "NLSFEProcAlt": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 68 - }, - "NLSFEProc": { - "type": { - "count": 8, - "subtype": { - "kind": "struct", - "name": "_VK_FUNCTION_PARAM" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 132 - }, - "_DMM_MONITORDESCRIPTORSET_SERIALIZATION": { - "fields": { - "NumDescriptors": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "DescriptorSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITORDESCRIPTOR_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 144 - }, - "_DMM_MONITORSOURCEMODESET_SERIALIZATION": { - "fields": { - "NumModes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_DMM_MONITOR_SOURCE_MODE_SERIALIZATION" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 112 - }, - "_CALLBACKWND": { - "fields": { - "hwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "_DMM_VIDPNPATHANDTARGETMODESET_SERIALIZATION": { - "fields": { - "PathInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH" - }, - "offset": 0 - }, - "TargetModeSet": { - "type": { - "kind": "struct", - "name": "_DMM_VIDPNTARGETMODESET_SERIALIZATION" - }, - "offset": 360 - } - }, - "kind": "struct", - "size": 440 - }, - "_VK_FUNCTION_PARAM": { - "fields": { - "NLSFEProcIndex": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "NLSFEProcParam": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "tagSBCALC": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "pxStart": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "pxThumbBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 48 - }, - "cpxThumb": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 32 - }, - "pxMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "pxThumbTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "pxDownArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cpx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "pxBottom": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "pxTop": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "pxLeft": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "pxRight": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "pxUpArrow": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 36 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "HDESK__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "HIMC__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_COLOR_COEFF_DYNAMIC_RANGES": { - "fields": { - "SecondChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "FourthChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "ThirdChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "FirstChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagMENUSTATE": { - "fields": { - "cxAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 116 - }, - "pGlobalPopupMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPOPUPMENU" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "uDraggingIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "fNotifyByPos": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInCallHandleMenuMessages": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ixAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "dwLockCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "fAutoDismiss": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fIsSysMenu": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "dwAniStartTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "uButtonDownHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 64 - }, - "fIgnoreButtonUp": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptButtonDown": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 56 - }, - "fMenuStarted": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "iAniDropDir": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 5 - }, - "offset": 8 - }, - "hdcAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "fModelessMenu": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hbmAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "fInEndMenu": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 92 - }, - "vkButtonDown": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "fSetCapture": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInDoDragDrop": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fActiveNoForeground": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fMouseOffMenu": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fDragAndDrop": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fInsideMenuLoop": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "uDraggingHitArea": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 80 - }, - "fButtonDown": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptiMenuStateOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 120 - }, - "iyAni": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 112 - }, - "hdcWndAni": { - "type": { - "subtype": { - "kind": "struct", - "name": "HDC__" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "fAboutToAutoDismiss": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "mnFocus": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "uButtonDownIndex": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "fButtonAlwaysDown": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "fUnderline": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "ptMouseLast": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 12 - }, - "pmnsPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENUSTATE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "fDragging": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "cmdLast": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 144 - }, - "VK_TO_BIT": { - "fields": { - "Vk": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModBits": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - } - }, - "kind": "struct", - "size": 2 - }, - "tagWOWTHREADINFO": { - "fields": { - "pIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "idParentProcess": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "idTask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pwtiNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "idWaitObject": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 40 - }, - "__unnamed_1805": { - "fields": { - "Start": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_1211": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1213": { - "fields": { - "FileInformationClass": { - "type": { - "kind": "enum", - "name": "FileInformationClassEnum" - }, - "offset": 8 - }, - "AdvanceOnly": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 25 - }, - "ClusterCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "DeleteHandle": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReplaceIfExists": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 24 - }, - "FileObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_FILE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_1217": { - "fields": { - "FsInformationClass": { - "type": { - "kind": "enum", - "name": "FsInformationClassEnum" - }, - "offset": 8 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_123b": { - "fields": { - "IoResourceRequirementList": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IO_RESOURCE_REQUIREMENTS_LIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_122d": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1950": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "MinimumAddress": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 8 - }, - "Alignment": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 24 - }, - "tagITEM": { - "fields": { - "fType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "ulX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "wID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwItemData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "hbmpChecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "xItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "spSubMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hbmpUnchecked": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "fState": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dxTab": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "cxBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 104 - }, - "yItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "cyItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 76 - }, - "umim": { - "type": { - "kind": "struct", - "name": "tagUAHMENUITEMMETRICS" - }, - "offset": 112 - }, - "cch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "ulWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "cyBmp": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 108 - }, - "lpstr": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "cxItem": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "hbmp": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 96 - } - }, - "kind": "struct", - "size": 144 - }, - "tagIMEINFOEX": { - "fields": { - "dwImeWinVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 84 - }, - "fSysWow64Only": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "fInitOpen": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 72 - }, - "wszImeDescription": { - "type": { - "count": 50, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 88 - }, - "fCUASLayer": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 348 - }, - "ImeInfo": { - "type": { - "kind": "struct", - "name": "tagIMEINFO" - }, - "offset": 8 - }, - "wszImeFile": { - "type": { - "count": 80, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 188 - }, - "wszUIClass": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 36 - }, - "fLoadFlag": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 76 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "dwProdVersion": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 80 - }, - "fdwInitConvMode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - } - }, - "kind": "struct", - "size": 352 - }, - "__unnamed_1962": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1958" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_1956" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_195e" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_195c" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "ConfigData": { - "type": { - "kind": "struct", - "name": "__unnamed_195a" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1960" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1954" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1950" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagMSGPPINFO": { - "fields": { - "dwIndexMsgPP": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "tagSBINFO": { - "fields": { - "WSBflags": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "Horz": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 4 - }, - "Vert": { - "type": { - "kind": "struct", - "name": "tagSBDATA" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 36 - }, - "VWPLELEMENT": { - "fields": { - "DataOrTag": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "pwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSBDATA": { - "fields": { - "posMax": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "posMin": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "page": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "pos": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 16 - }, - "_VSC_VK": { - "fields": { - "Vsc": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "Vk": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123f": { - "fields": { - "Lock": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 1 - }, - "_SCATTER_GATHER_ELEMENT": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 16 - }, - "Address": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 24 - }, - "tagWND": { - "fields": { - "spwndLastActive": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "bWS_CLIPCHILDREN": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bMaximizeButtonDown": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bUIStateActive": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_TABSTOP": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDialogWindow": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "lpfnWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bMinimizeButtonDown": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hImc": { - "type": { - "subtype": { - "kind": "struct", - "name": "HIMC__" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "style": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "bChildNoActivate": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_LAYERED": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bReserved3": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bStartPaint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bVerticallyMaximizedLeft": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bHiddenPopup": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSendEraseBackground": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin50Compat": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_CLIENTEDGE": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "fnid": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 66 - }, - "bWS_EX_TOOLWINDOW": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bDisabled": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bAnsiWindowProc": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWin40Compat": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcClient": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 128 - }, - "bAnsiCreator": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bAnyScrollButtonDown": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bSendSizeMoveMsgs": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bLinked": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bSendNCPaint": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bInternalPaint": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasClientEdge": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasPalette": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHasHorizontalScrollbar": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUIStateFocusRectHidden": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_DLGFRAME": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_MDICHILD": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasVerticalScrollbar": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved2": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bSmallIconFromWMQueryDrag": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bNoNCPaint": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused1": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasSPB": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_MINIMIZEBOX": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarVerticalTracking": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_DLGMODALFRAME": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_TRANSPARENT": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bPaintNotProcessed": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bSyncPaintPending": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "hrgnClip": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "bShellHookRegistered": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndChild": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "bUnused5": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bInDestroy": { - "type": { - "bit_position": 7, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "state": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "bWS_EX_LEFTSCROLLBAR": { - "type": { - "bit_position": 14, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bToggleTopmost": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_VSCROLL": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "ExStyle": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "bWS_HSCROLL": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUpdateDirty": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWMPaintSent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_WINDOWEDGE": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_ACCEPTFILE": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_GROUP": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "bVisible": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bVerticallyMaximizedRight": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bForceMenuDraw": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bForceNCPaint": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bOldUI": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spwndClipboardListenerNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 280 - }, - "bWS_EX_NOPADDEDBORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bNoMinmaxAnimatedRects": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "bWS_MAXIMIZEBOX": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bHasCaption": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bEraseBackground": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "spwndOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cbwndExtra": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 232 - }, - "bMakeVisibleWhenUnghosted": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused8": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bUnused9": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 52 - }, - "bForceFullNCPaintClipRgn": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_RTLREADING": { - "type": { - "bit_position": 13, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pSBInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSBINFO" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "bUnused2": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused3": { - "type": { - "bit_position": 21, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUnused4": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasMeun": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bUnused6": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bUnused7": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 2 - }, - "offset": 52 - }, - "bClipboardListener": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bScrollBarLineDownBtnDown": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedirectedForPrint": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_RIGHT": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bHasCreatestructName": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITED": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bFullScreen": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnUpdate": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "bConsoleWindow": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "ppropList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROPLIST" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "bWS_EX_TOPMOST": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bScrollBarPageDownBtnDown": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bScrollBarLineUpBtnDown": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRecievedQuerySuspendMsg": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bMaximizeMonitorRegion": { - "type": { - "bit_position": 11, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bRedrawIfHung": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_POPUP": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTEXTHELP": { - "type": { - "bit_position": 10, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "dwUserData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 256 - }, - "hMod16": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 64 - }, - "FullScreenMode": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 3 - }, - "offset": 44 - }, - "bLayeredLimbo": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_EX_NOINHERITLAYOUT": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_LAYOUTRTL": { - "type": { - "bit_position": 22, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bUIStateKbdAccelHidden": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_BORDER": { - "type": { - "bit_position": 23, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_SIZEBOX": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bDestroyed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bServerSideWindowProc": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bCaptionTextTruncated": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "rcWindow": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 112 - }, - "bEndPaintInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "hrgnNewFrame": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "bBeingActivated": { - "type": { - "bit_position": 20, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_COMPOSITEDCompositing": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWMCreateMsgProcessed": { - "type": { - "bit_position": 31, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bWS_EX_NOACTIVATE": { - "type": { - "bit_position": 27, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bWS_EX_APPWINDOW": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bCloseButtonDown": { - "type": { - "bit_position": 12, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bMaximized": { - "type": { - "bit_position": 24, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_CHILD": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "spwndParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "bWS_THICKFRAME": { - "type": { - "bit_position": 18, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bWS_EX_CONTROLPARENT": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "pcls": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLS" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "bLayeredForDWM": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bMsgBox": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bHelpButtonDown": { - "type": { - "bit_position": 15, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bHasOverlay": { - "type": { - "bit_position": 9, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bRedrawFrameIfHung": { - "type": { - "bit_position": 28, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_NOPARENTNOTIFY": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bMaximizesToMonitor": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bBottomMost": { - "type": { - "bit_position": 5, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "bReserved1": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bRedirected": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - }, - "bActiveFrame": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bReserved4": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved5": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved6": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "bReserved7": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 16 - }, - "offset": 52 - }, - "spwndPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "bLayeredInvalidate": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "state2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "bWS_CLIPSIBLINGS": { - "type": { - "bit_position": 26, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bScrollBarPageUpBtnDown": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "pTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DMATRIX" - }, - "kind": "pointer" - }, - "offset": 272 - }, - "bWin31Compat": { - "type": { - "bit_position": 8, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 44 - }, - "ExStyle2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 288 - }, - "bHIGHDPI_UNAWARE_Unused": { - "type": { - "bit_position": 6, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 288 - }, - "bWS_SYSMENU": { - "type": { - "bit_position": 19, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "hModule": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "strName": { - "type": { - "kind": "struct", - "name": "_LARGE_UNICODE_STRING" - }, - "offset": 216 - }, - "pActCtx": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_ACTIVATION_CONTEXT" - }, - "kind": "pointer" - }, - "offset": 264 - }, - "bMinimized": { - "type": { - "bit_position": 29, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 52 - }, - "bRecievedSuspendMsg": { - "type": { - "bit_position": 25, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 40 - }, - "bWS_EX_STATICEDGE": { - "type": { - "bit_position": 17, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 296 - }, - "_WM_VALUES_STRINGS": { - "fields": { - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "fInternal": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 8 - }, - "fDefined": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 9 - } - }, - "kind": "struct", - "size": 16 - }, - "_D3DKMDT_GRAPHICS_RENDERING_FORMAT": { - "fields": { - "VisibleRegionSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 8 - }, - "Stride": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "PixelFormat": { - "type": { - "kind": "enum", - "name": "PixelFormatEnum" - }, - "offset": 20 - }, - "PixelValueAccessMode": { - "type": { - "kind": "enum", - "name": "PixelValueAccessModeEnum" - }, - "offset": 28 - }, - "PrimSurfSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 0 - }, - "ColorBasis": { - "type": { - "kind": "enum", - "name": "ColorBasisEnum" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 32 - }, - "_VK_TO_WCHARS1": { - "fields": { - "Attributes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 1 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 4 - }, - "_TLSPRITESTATE": { - "fields": { - "flOriginalSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "iSpriteType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "pfnSaveScreenBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "bInsideDriverCall": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "pfnStrokePath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnTransparentBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnPaint": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnStretchBltROP": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "iType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "pfnPlgBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnCopyBits": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pState": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "iOriginalType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "pfnTextOut": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDrawStream": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStrokeAndFillPath": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnLineTo": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnStretchBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGradientFill": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnAlphaBlend": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "flSpriteSurfFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "pfnBitBlt": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - } - }, - "kind": "struct", - "size": 168 - }, - "tagUAHMENUITEMMETRICS": { - "fields": { - "rgsizeBar": { - "type": { - "count": 2, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - }, - "rgsizePopup": { - "type": { - "count": 4, - "subtype": { - "kind": "struct", - "name": "tagSIZE" - }, - "kind": "array" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "__unnamed_121b": { - "fields": { - "Length": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ByteOffset": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 16 - }, - "Key": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1229": { - "fields": { - "Srb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_SCSI_REQUEST_BLOCK" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_121f": { - "fields": { - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1225": { - "fields": { - "DeviceObject": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_OBJECT" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "Vpb": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_VPB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_HEAD": { - "fields": { - "h": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "cLockObj": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagIMEINFO": { - "fields": { - "fdwProperty": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "fdwSelectCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fdwUICaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwPrivateDataSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "fdwSCSCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "fdwSentenceCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "fdwConversionCaps": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 28 - }, - "_DXGK_DIAG_CODE_POINT_PACKET": { - "fields": { - "Header": { - "type": { - "kind": "struct", - "name": "_DXGK_DIAG_HEADER" - }, - "offset": 0 - }, - "Param3": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 60 - }, - "Param1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "CodePointType": { - "type": { - "kind": "enum", - "name": "CodePointTypeEnum" - }, - "offset": 48 - }, - "Param2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - } - }, - "kind": "struct", - "size": 64 - }, - "_D3DKMDT_VIDPN_SOURCE_MODE": { - "fields": { - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 4 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Format": { - "type": { - "kind": "struct", - "name": "__unnamed_18a1" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagW32JOB": { - "fields": { - "restrictions": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "ughCrt": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "pAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "ughMax": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 52 - }, - "pgh": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long long" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "Job": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EJOB" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "ppiTable": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "uProcessCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "uMaxProcesses": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagW32JOB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 64 - }, - "_DMM_MONITORFREQUENCYRANGESET_SERIALIZATION": { - "fields": { - "NumFrequencyRanges": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "FrequencyRangeSerialization": { - "type": { - "count": 1, - "subtype": { - "kind": "struct", - "name": "_D3DKMDT_MONITOR_FREQUENCY_RANGE" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 56 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION": { - "fields": { - "APSTriggerBits": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "CopyProtectionType": { - "type": { - "kind": "enum", - "name": "CopyProtectionTypeEnum" - }, - "offset": 0 - }, - "CopyProtectionSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT" - }, - "offset": 264 - }, - "OEMCopyProtection": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 268 - }, - "tagWINDOWSTATION": { - "fields": { - "pClipBase": { - "type": { - "subtype": { - "count": 104, - "subtype": { - "kind": "struct", - "name": "tagCLIP" - }, - "kind": "array" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "cNumClipFormats": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "luidUser": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 136 - }, - "pGlobalAtomTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "ptiClipLock": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "dwWSF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "rpdeskList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spklList": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "spwndClipOpen": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "iClipSerialNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - }, - "pTerm": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTERMINAL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "rpwinstaNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndClipboardListener": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "spwndClipViewer": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "iClipSequenceNumber": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "ptiDrawingClipboard": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "spwndClipOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "psidUser": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "luidEndSession": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LUID" - }, - "offset": 128 - } - }, - "kind": "struct", - "size": 152 - }, - "tagDESKTOPINFO": { - "fields": { - "spwndProgman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 192 - }, - "pvwplMessagePPHandler": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 224 - }, - "pvDesktopLimit": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "fComposited": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndGestureEngine": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "pvDesktopBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwndShell": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "ppiShellProcess": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagPROCESSINFO" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pvwplShellHook": { - "type": { - "subtype": { - "kind": "struct", - "name": "VWPL" - }, - "kind": "pointer" - }, - "offset": 200 - }, - "fIsDwmDesktop": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 232 - }, - "spwndTaskman": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "aphkStart": { - "type": { - "count": 16, - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 32 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cntMBox": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 208 - }, - "spwndBkGnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 176 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 240 - }, - "tagMBSTRING": { - "fields": { - "szName": { - "type": { - "count": 15, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 0 - }, - "uID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "uStr": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 36 - } - }, - "kind": "struct", - "size": 40 - }, - "_D3DKMDT_VIDPN_TARGET_MODE": { - "fields": { - "VideoSignalInfo": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDEO_SIGNAL_INFO" - }, - "offset": 8 - }, - "Id": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Preference": { - "type": { - "kind": "enum", - "name": "PreferenceEnum" - }, - "offset": 64 - } - }, - "kind": "struct", - "size": 72 - }, - "_DMM_VIDPNSET_SERIALIZATION": { - "fields": { - "VidPnOffset": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4 - }, - "NumVidPns": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagKBDFILE": { - "fields": { - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "awchDllName": { - "type": { - "count": 32, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 56 - }, - "pKbdTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdLayer" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pkfNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pKbdNlsTbl": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKbdNlsLayer" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "hBase": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_11e4": { - "fields": { - "UserApcContext": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "UserApcRoutine": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "IssuingProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_W32PROCESS": { - "fields": { - "GDIPushLock": { - "type": { - "kind": "struct", - "name": "nt_symbols!_EX_PUSH_LOCK" - }, - "offset": 80 - }, - "DxProcess": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 248 - }, - "pBrushAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "Process": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_EPROCESS" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "GDIHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "RefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "StartCursorHideTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "InputIdleEvent": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "W32PF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "GDIHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "NextStart": { - "type": { - "subtype": { - "kind": "struct", - "name": "_W32PROCESS" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "hSecureGdiSharedHandleTable": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 240 - }, - "UserHandleCountPeak": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 72 - }, - "GDIW32PIDLockedBitmaps": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 224 - }, - "UserHandleCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 68 - }, - "W32Pid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "GDIEngUserMemAllocTable": { - "type": { - "kind": "struct", - "name": "nt_symbols!_RTL_AVL_TABLE" - }, - "offset": 88 - }, - "pDCAttrList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "GDIBrushAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 208 - }, - "GDIDcAttrFreeList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 192 - } - }, - "kind": "struct", - "size": 256 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_TRANSFORMATION": { - "fields": { - "Scaling": { - "type": { - "kind": "enum", - "name": "ScalingEnum" - }, - "offset": 0 - }, - "RotationSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_ROTATION_SUPPORT" - }, - "offset": 12 - }, - "Rotation": { - "type": { - "kind": "enum", - "name": "RotationEnum" - }, - "offset": 8 - }, - "ScalingSupport": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_VIDPN_PRESENT_PATH_SCALING_SUPPORT" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSERVERINFO": { - "fields": { - "uiShellMsg": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 912 - }, - "cbHandleTable": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 848 - }, - "atomSysClass": { - "type": { - "count": 25, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 852 - }, - "dtScroll": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2800 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2952 - }, - "atomIconSmProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1356 - }, - "argbSystemUnmatched": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2268 - }, - "dwTagCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4632 - }, - "ucWheelScrollLines": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2812 - }, - "ptCursorReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2784 - }, - "ucWheelScrollChars": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2816 - }, - "acOemToAnsi": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1364 - }, - "cySysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2832 - }, - "atomFrostedWindowProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1362 - }, - "mpFnid_serverCBWndProc": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned short" - }, - "kind": "array" - }, - "offset": 328 - }, - "PUSIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4476 - }, - "BitCount": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4468 - }, - "argbSystem": { - "type": { - "count": 31, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 2392 - }, - "dtLBSearch": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2804 - }, - "dtCaretBlink": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2808 - }, - "dwInstalledEventHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 1876 - }, - "apfnClientA": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 392 - }, - "cxSysFontChar": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2828 - }, - "hbrGray": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "offset": 2768 - }, - "ahbrSystem": { - "type": { - "count": 31, - "subtype": { - "subtype": { - "kind": "struct", - "name": "HBRUSH__" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 2520 - }, - "dwDefaultHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 908 - }, - "wMaxRightOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2824 - }, - "dwSRVIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "oembmi": { - "type": { - "count": 93, - "subtype": { - "kind": "struct", - "name": "tagOEMBITMAPINFO" - }, - "kind": "array" - }, - "offset": 2964 - }, - "apfnClientWorker": { - "type": { - "kind": "struct", - "name": "_PFNCLIENTWORKER" - }, - "offset": 760 - }, - "dwDefaultHeapBase": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 904 - }, - "BitsPixel": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4473 - }, - "wMaxLeftOverlapChars": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2820 - }, - "dmLogPixels": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4470 - }, - "dwLastSystemRITEventTickCountUpdate": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4488 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 2796 - }, - "atomIconProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1358 - }, - "Planes": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4472 - }, - "dpiSystem": { - "type": { - "kind": "struct", - "name": "tagDPISERVERINFO" - }, - "offset": 2896 - }, - "hIcoWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2944 - }, - "apfnClientW": { - "type": { - "kind": "struct", - "name": "_PFNCLIENT" - }, - "offset": 576 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2956 - }, - "MBStrings": { - "type": { - "count": 11, - "subtype": { - "kind": "struct", - "name": "tagMBSTRING" - }, - "kind": "array" - }, - "offset": 916 - }, - "atomContextHelpIdProp": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 1360 - }, - "adwDBGTAGFlags": { - "type": { - "count": 35, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 4492 - }, - "aiSysMet": { - "type": { - "count": 97, - "subtype": { - "kind": "base", - "name": "long" - }, - "kind": "array" - }, - "offset": 1880 - }, - "dwRIPFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4636 - }, - "uCaretWidth": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4480 - }, - "cCaptures": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2960 - }, - "tmSysFont": { - "type": { - "kind": "struct", - "name": "tagTEXTMETRICW" - }, - "offset": 2836 - }, - "cHandleEntries": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ptCursor": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 2776 - }, - "hIconSmWindows": { - "type": { - "subtype": { - "kind": "struct", - "name": "HICON__" - }, - "kind": "pointer" - }, - "offset": 2936 - }, - "mpFnidPfn": { - "type": { - "count": 32, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "UILangID": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 4484 - }, - "acAnsiToOem": { - "type": { - "count": 256, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 1620 - }, - "aStoCidPfn": { - "type": { - "count": 7, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 272 - }, - "rcScreenReal": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 4452 - }, - "dwLastRITEventTickCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 2792 - } - }, - "kind": "struct", - "size": 4640 - }, - "tagPOOLRECORD": { - "fields": { - "ExtraData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "trace": { - "type": { - "count": 6, - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "array" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "__unnamed_195a": { - "fields": { - "Priority": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Reserved1": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagUSERSTARTUPINFO": { - "fields": { - "dwYSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "cbReserved2": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 26 - }, - "cb": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwX": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "dwY": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwXSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 12 - }, - "wShowWindow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 24 - } - }, - "kind": "struct", - "size": 28 - }, - "_DMM_VIDPN_SERIALIZATION": { - "fields": { - "PathsFromSourceSerializationOffsets": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "array" - }, - "offset": 8 - }, - "NumActiveSources": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 4 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 12 - }, - "__unnamed_11df": { - "fields": { - "IrpCount": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "SystemBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "MasterIrp": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_IRP" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagHID_PAGEONLY_REQUEST": { - "fields": { - "usUsagePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 16 - }, - "link": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 0 - }, - "cRefCount": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1233": { - "fields": { - "Interface": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_INTERFACE" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "InterfaceSpecificData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "Version": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "InterfaceType": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_GUID" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "tagQMSG": { - "fields": { - "Padding": { - "type": { - "bit_position": 30, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 2 - }, - "offset": 80 - }, - "ptMouseReal": { - "type": { - "kind": "struct", - "name": "tagPOINT" - }, - "offset": 72 - }, - "FromPen": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "ExtraInfo": { - "type": { - "kind": "base", - "name": "long long" - }, - "offset": 64 - }, - "Wow64Message": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "MsgPPInfo": { - "type": { - "kind": "struct", - "name": "tagMSGPPINFO" - }, - "offset": 96 - }, - "dwQEvent": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 30 - }, - "offset": 80 - }, - "pqmsgPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FromTouch": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "NoCoalesce": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "long" - }, - "bit_length": 1 - }, - "offset": 84 - }, - "msg": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 16 - }, - "pqmsgNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQMSG" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 104 - }, - "__unnamed_1237": { - "fields": { - "Capabilities": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_DEVICE_CAPABILITIES" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "__unnamed_11e6": { - "fields": { - "AsynchronousParameters": { - "type": { - "kind": "struct", - "name": "__unnamed_11e4" - }, - "offset": 0 - }, - "AllocationSize": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LARGE_INTEGER" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagDESKTOP": { - "fields": { - "spmenuVScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "dwMouseHoverTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 212 - }, - "rpwinstaParent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWINDOWSTATION" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "spmenuDialogSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "spwndForeground": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "spmenuHScroll": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "spwndTooltip": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "dwSessionId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "spwndMessage": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "cciConsole": { - "type": { - "kind": "struct", - "name": "_CONSOLE_CARET_INFO" - }, - "offset": 144 - }, - "PtiList": { - "type": { - "kind": "struct", - "name": "nt_symbols!_LIST_ENTRY" - }, - "offset": 160 - }, - "spwndTray": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "rpdeskNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "dwDTFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "pMagInputTransform": { - "type": { - "subtype": { - "kind": "struct", - "name": "_MAGNIFICATION_INPUT_TRANSFORM" - }, - "kind": "pointer" - }, - "offset": 216 - }, - "spwndTrack": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 184 - }, - "htEx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 192 - }, - "ulHeapSize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 136 - }, - "pheapDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!tagWIN32HEAP" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "rcMouseHover": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 196 - }, - "hsectionDesktop": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "dwDesktopId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "spmenuSys": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 224 - }, - "_MAGNIFICATION_INPUT_TRANSFORM": { - "fields": { - "rcScreen": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 16 - }, - "magFactorX": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 40 - }, - "magFactorY": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 44 - }, - "ptiMagThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "rcSource": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 48 - }, - "_D3DKMDT_MONITOR_FREQUENCY_RANGE": { - "fields": { - "Origin": { - "type": { - "kind": "enum", - "name": "OriginEnum" - }, - "offset": 0 - }, - "ConstraintType": { - "type": { - "kind": "enum", - "name": "ConstraintTypeEnum" - }, - "offset": 36 - }, - "RangeLimits": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_FREQUENCY_RANGE" - }, - "offset": 4 - }, - "Constraint": { - "type": { - "kind": "struct", - "name": "__unnamed_16c1" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 48 - }, - "__unnamed_121d": { - "fields": { - "Type3InputBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "OutputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IoControlCode": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "InputBufferLength": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 32 - }, - "_PFNCLIENTWORKER": { - "fields": { - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnCtfHookProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 88 - }, - "__unnamed_12e0": { - "fields": { - "InitialPrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_INITIAL_PRIVILEGE_SET" - }, - "offset": 0 - }, - "PrivilegeSet": { - "type": { - "kind": "struct", - "name": "nt_symbols!_PRIVILEGE_SET" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 44 - }, - "tagMENULIST": { - "fields": { - "pMenu": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENU" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagMENULIST" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "_DMA_OPERATIONS": { - "fields": { - "PutDmaAdapter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "FreeMapRegisters": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "MapTransfer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "FreeCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "ReadDmaCounter": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "AllocateCommonBuffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "PutScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "BuildMdlFromScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "GetScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "CalculateScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "FreeAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "GetDmaAlignment": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "FlushAdapterBuffers": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "AllocateAdapterChannel": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "BuildScatterGatherList": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 128 - }, - "__unnamed_1811": { - "fields": { - "Start": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "Reserved": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 12 - }, - "tagSPB": { - "fields": { - "hbm": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "hrgn": { - "type": { - "subtype": { - "kind": "struct", - "name": "HRGN__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "ulSaveId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 56 - }, - "flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "rc": { - "type": { - "kind": "struct", - "name": "tagRECT" - }, - "offset": 24 - }, - "pspbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSPB" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 64 - }, - "tagWin32PoolHead": { - "fields": { - "pPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pTrace": { - "type": { - "subtype": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWin32PoolHead" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "size": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 32 - }, - "_DXGK_DIAG_HEADER": { - "fields": { - "Index": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "ProcessName": { - "type": { - "count": 16, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 16 - }, - "LogTimestamp": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "ThreadId": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "Type": { - "type": { - "kind": "enum", - "name": "TypeEnum" - }, - "offset": 0 - }, - "WdLogIdx": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 48 - }, - "_DMM_COMMITVIDPNREQUEST_DIAGINFO": { - "fields": { - "CleanupAfterFailedCommitVidPn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ModeChangeRequestId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "ReclaimClonedTarget": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - }, - "ForceAllActiveVidPnModeListInvalidation": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned char" - }, - "bit_length": 1 - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 12 - }, - "tagTOUCHINPUT": { - "fields": { - "dwExtraInfo": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "hSource": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "dwMask": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "cyContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 44 - }, - "cxContact": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 40 - }, - "dwFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "dwID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "dwTime": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 48 - }, - "_SM_VALUES_STRINGS": { - "fields": { - "StorageType": { - "type": { - "kind": "enum", - "name": "StorageTypeEnum" - }, - "offset": 16 - }, - "pszName": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulValue": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - }, - "RangeType": { - "type": { - "kind": "enum", - "name": "RangeTypeEnum" - }, - "offset": 12 - } - }, - "kind": "struct", - "size": 24 - }, - "__unnamed_1956": { - "fields": { - "MinimumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "MaximumChannel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - } - }, - "kind": "struct", - "size": 8 - }, - "_D3DKMDT_VIDEO_SIGNAL_INFO": { - "fields": { - "VSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 20 - }, - "ActiveSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 12 - }, - "PixelRate": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "TotalSize": { - "type": { - "kind": "struct", - "name": "_D3DKMDT_2DREGION" - }, - "offset": 4 - }, - "VideoStandard": { - "type": { - "kind": "enum", - "name": "VideoStandardEnum" - }, - "offset": 0 - }, - "ScanLineOrdering": { - "type": { - "kind": "enum", - "name": "ScanLineOrderingEnum" - }, - "offset": 48 - }, - "HSyncFreq": { - "type": { - "kind": "struct", - "name": "_D3DDDI_RATIONAL" - }, - "offset": 28 - } - }, - "kind": "struct", - "size": 56 - }, - "tagTERMINAL": { - "fields": { - "spwndDesktopOwner": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pEventInputReady": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "rpdeskDestroy": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOP" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pqDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagQ" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "dwTERMF_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "dwNestedLevel": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ptiDesktop": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pEventTermInit": { - "type": { - "subtype": { - "kind": "struct", - "name": "nt_symbols!_KEVENT" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "HFONT__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_D3DKMDT_VIDPN_PRESENT_PATH_COPYPROTECTION_SUPPORT": { - "fields": { - "MacroVisionFull": { - "type": { - "bit_position": 2, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "MacroVisionApsTrigger": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "NoProtection": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 3, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 29 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "_PFNCLIENT": { - "fields": { - "pfnDispatchDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 160 - }, - "pfnStaticWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 112 - }, - "pfnDispatchHook": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 152 - }, - "pfnDesktopWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "pfnImeWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 120 - }, - "pfnScrollBarWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pfnEditWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 88 - }, - "pfnGhostWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 128 - }, - "pfnMessageWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pfnSwitchWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "pfnComboListBoxProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 72 - }, - "pfnComboBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 64 - }, - "pfnMDIClientWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 104 - }, - "pfnDialogWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "pfnHkINLPCWPSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 136 - }, - "pfnTitleWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "pfnHkINLPCWPRETSTRUCT": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "pfnButtonWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pfnMenuWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "pfnListBoxWndProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "pfnDispatchMessage": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 168 - }, - "pfnDefWindowProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "pfnMDIActivateDlgProc": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 176 - } - }, - "kind": "struct", - "size": 184 - }, - "tagOEMBITMAPINFO": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1221": { - "fields": { - "SecurityInformation": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "SecurityDescriptor": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "_KLIST_ENTRY": { - "fields": { - "Flink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "Blink": { - "type": { - "subtype": { - "kind": "struct", - "name": "_KLIST_ENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "HMONITOR__": { - "fields": { - "unused": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_1247": { - "fields": { - "DeviceTextType": { - "type": { - "kind": "enum", - "name": "DeviceTextTypeEnum" - }, - "offset": 0 - }, - "LocaleId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "tagCLIENTINFO": { - "fields": { - "msgDbcsCB": { - "type": { - "kind": "struct", - "name": "tagMSG" - }, - "offset": 160 - }, - "dwCompatFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 20 - }, - "achDbcsCF": { - "type": { - "count": 2, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 154 - }, - "dwTIFlags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "pClientThreadInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagCLIENTTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 152 - }, - "dwKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "dwHookCurrent": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "afAsyncKeyStateRecentDown": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 136 - }, - "dwCompatFlags2": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "fsHooks": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 56 - }, - "ulClientDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "pDeskInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDESKTOPINFO" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "dwExpWinVer": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "dwHookData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 104 - }, - "afAsyncKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 128 - }, - "CallbackWnd": { - "type": { - "kind": "struct", - "name": "_CALLBACKWND" - }, - "offset": 64 - }, - "lpdwRegisteredClasses": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned long" - }, - "kind": "pointer" - }, - "offset": 208 - }, - "cInDDEMLCallback": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 92 - }, - "cSpins": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 8 - }, - "hKL": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 144 - }, - "dwAsyncKeyCache": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 124 - }, - "afKeyState": { - "type": { - "count": 8, - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "array" - }, - "offset": 116 - }, - "CI_flags": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 0 - }, - "phkCurrent": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagHOOK" - }, - "kind": "pointer" - }, - "offset": 48 - } - }, - "kind": "struct", - "size": 216 - }, - "_DMM_MONITOR_SERIALIZATION": { - "fields": { - "SourceModeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "FrequencyRangeSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 28 - }, - "DescriptorSetOffset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "ModePruningAlgorithm": { - "type": { - "kind": "enum", - "name": "ModePruningAlgorithmEnum" - }, - "offset": 16 - }, - "VideoPresentTargetId": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 4 - }, - "IsUsingDefaultProfile": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 13 - }, - "MonitorPowerState": { - "type": { - "kind": "enum", - "name": "MonitorPowerStateEnum" - }, - "offset": 20 - }, - "MonitorType": { - "type": { - "kind": "enum", - "name": "MonitorTypeEnum" - }, - "offset": 36 - }, - "Size": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "IsSimulatedMonitor": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 12 - }, - "Orientation": { - "type": { - "kind": "enum", - "name": "OrientationEnum" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 40 - }, - "tagPROP": { - "fields": { - "fs": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 10 - }, - "hData": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "atomKey": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 8 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_1243": { - "fields": { - "IdType": { - "type": { - "kind": "enum", - "name": "IdTypeEnum" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 4 - }, - "__unnamed_123d": { - "fields": { - "Buffer": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "WhichSpace": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - }, - "Length": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 24 - }, - "Offset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - } - }, - "kind": "struct", - "size": 32 - }, - "_WNDMSG": { - "fields": { - "abMsgs": { - "type": { - "subtype": { - "kind": "base", - "name": "unsigned char" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "maxMsgs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagSHAREDINFO": { - "fields": { - "psi": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagSERVERINFO" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "ulSharedDelta": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 32 - }, - "aheList": { - "type": { - "subtype": { - "kind": "struct", - "name": "_HANDLEENTRY" - }, - "kind": "pointer" - }, - "offset": 8 - }, - "DefWindowSpecMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 552 - }, - "awmControl": { - "type": { - "count": 31, - "subtype": { - "kind": "struct", - "name": "_WNDMSG" - }, - "kind": "array" - }, - "offset": 40 - }, - "pDispInfo": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagDISPLAYINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "HeEntrySize": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 16 - }, - "DefWindowMsgs": { - "type": { - "kind": "struct", - "name": "_WNDMSG" - }, - "offset": 536 - } - }, - "kind": "struct", - "size": 568 - }, - "__unnamed_181b": { - "fields": { - "BusNumber": { - "type": { - "kind": "struct", - "name": "__unnamed_1811" - }, - "offset": 0 - }, - "Dma": { - "type": { - "kind": "struct", - "name": "__unnamed_180d" - }, - "offset": 0 - }, - "DeviceSpecificData": { - "type": { - "kind": "struct", - "name": "__unnamed_1813" - }, - "offset": 0 - }, - "Memory48": { - "type": { - "kind": "struct", - "name": "__unnamed_1817" - }, - "offset": 0 - }, - "MessageInterrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_180b" - }, - "offset": 0 - }, - "Generic": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Memory40": { - "type": { - "kind": "struct", - "name": "__unnamed_1815" - }, - "offset": 0 - }, - "DevicePrivate": { - "type": { - "kind": "struct", - "name": "nt_symbols!__unnamed_180f" - }, - "offset": 0 - }, - "Memory64": { - "type": { - "kind": "struct", - "name": "__unnamed_1819" - }, - "offset": 0 - }, - "Memory": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - }, - "Interrupt": { - "type": { - "kind": "struct", - "name": "__unnamed_1807" - }, - "offset": 0 - }, - "Port": { - "type": { - "kind": "struct", - "name": "__unnamed_1805" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "tagPOINT": { - "fields": { - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 4 - }, - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagIMC": { - "fields": { - "dwClientImcData": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 48 - }, - "head": { - "type": { - "kind": "struct", - "name": "_THRDESKHEAD" - }, - "offset": 0 - }, - "hImeWnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "HWND__" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "pImcNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMC" - }, - "kind": "pointer" - }, - "offset": 40 - } - }, - "kind": "struct", - "size": 64 - }, - "tagKL": { - "fields": { - "uNumTbl": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 88 - }, - "pklPrev": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "head": { - "type": { - "kind": "struct", - "name": "_HEAD" - }, - "offset": 0 - }, - "pklNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKL" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "spkfPrimary": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 56 - }, - "dwFontSigs": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 64 - }, - "dwLastKbdType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 104 - }, - "CodePage": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 72 - }, - "dwKL_Flags": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 32 - }, - "iBaseCharset": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 68 - }, - "dwKLID": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 112 - }, - "spkf": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "offset": 48 - }, - "piiex": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagIMEINFOEX" - }, - "kind": "pointer" - }, - "offset": 80 - }, - "hkl": { - "type": { - "subtype": { - "kind": "struct", - "name": "HKL__" - }, - "kind": "pointer" - }, - "offset": 40 - }, - "pspkfExtra": { - "type": { - "subtype": { - "subtype": { - "kind": "struct", - "name": "tagKBDFILE" - }, - "kind": "pointer" - }, - "kind": "pointer" - }, - "offset": 96 - }, - "wchDiacritic": { - "type": { - "kind": "base", - "name": "wchar" - }, - "offset": 74 - }, - "dwLastKbdSubType": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 108 - } - }, - "kind": "struct", - "size": 120 - }, - "__unnamed_115b": { - "fields": { - "NextEntry": { - "type": { - "bit_position": 4, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 60 - }, - "offset": 8 - }, - "Depth": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 16 - }, - "offset": 0 - }, - "Reserved": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 3 - }, - "offset": 8 - }, - "HeaderType": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "Sequence": { - "type": { - "bit_position": 16, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "bit_length": 48 - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 16 - }, - "__unnamed_182e": { - "fields": { - "pRgb256x3x16": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_RGB256x3x16" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pRaw": { - "type": { - "subtype": { - "kind": "base", - "name": "void" - }, - "kind": "pointer" - }, - "offset": 0 - }, - "pDxgi1": { - "type": { - "subtype": { - "kind": "struct", - "name": "_D3DDDI_GAMMA_RAMP_DXGI_1" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 8 - }, - "tagTDB": { - "fields": { - "pti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 16 - }, - "TDB_Flags": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 34 - }, - "hTaskWow": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 32 - }, - "pwti": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWOWTHREADINFO" - }, - "kind": "pointer" - }, - "offset": 24 - }, - "nEvents": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 8 - }, - "nPriority": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "ptdbNext": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagTDB" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 40 - }, - "tagCARET": { - "fields": { - "x": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 16 - }, - "iHideLevel": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 12 - }, - "hTimer": { - "type": { - "kind": "base", - "name": "unsigned long long" - }, - "offset": 40 - }, - "yOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 56 - }, - "y": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 20 - }, - "xOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 52 - }, - "cy": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 24 - }, - "cx": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 28 - }, - "fVisible": { - "type": { - "bit_position": 0, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "hBitmap": { - "type": { - "subtype": { - "kind": "struct", - "name": "HBITMAP__" - }, - "kind": "pointer" - }, - "offset": 32 - }, - "cxOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 60 - }, - "cyOwnDc": { - "type": { - "kind": "base", - "name": "long" - }, - "offset": 64 - }, - "tid": { - "type": { - "kind": "base", - "name": "unsigned long" - }, - "offset": 48 - }, - "fOn": { - "type": { - "bit_position": 1, - "kind": "bitfield", - "type": { - "kind": "base", - "name": "unsigned long" - }, - "bit_length": 1 - }, - "offset": 8 - }, - "spwnd": { - "type": { - "subtype": { - "kind": "struct", - "name": "tagWND" - }, - "kind": "pointer" - }, - "offset": 0 - } - }, - "kind": "struct", - "size": 72 - }, - "_LIGATURE1": { - "fields": { - "wch": { - "type": { - "count": 1, - "subtype": { - "kind": "base", - "name": "wchar" - }, - "kind": "array" - }, - "offset": 4 - }, - "VirtualKey": { - "type": { - "kind": "base", - "name": "unsigned char" - }, - "offset": 0 - }, - "ModificationNumber": { - "type": { - "kind": "base", - "name": "unsigned short" - }, - "offset": 2 - } - }, - "kind": "struct", - "size": 6 + }, + "metadata": { + "producer": { + "version": "0.0.1", + "name": "dgmcdona-via-conversion-script", + "datetime": "2024-09-03T18:22:52Z" + }, + "format": "4.0.0" } - }, - "base_types": { - "unsigned char": { - "kind": "char", - "endian": "little", - "signed": false, - "size": 1 - }, - "float": { - "kind": "float", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "wchar": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "pointer": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - }, - "unsigned int": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 4 - }, - "short": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 2 - }, - "long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 4 - }, - "unsigned short": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 2 - }, - "long long": { - "kind": "int", - "endian": "little", - "signed": true, - "size": 8 - }, - "unsigned long long": { - "kind": "int", - "endian": "little", - "signed": false, - "size": 8 - } - }, - "enums": { - "TextEnum": { - "base": "long", - "constants": { - "D3DKMDT_TRF_UNINITIALIZED": 0 - }, - "size": 4 - }, - "PreferenceEnum": { - "base": "long", - "constants": { - "D3DKMDT_MP_PREFERRED": 1, - "D3DKMDT_MP_MAXVALID": 2, - "D3DKMDT_MP_UNINITIALIZED": 0 - }, - "size": 4 - }, - "FileInformationClassEnum": { - "base": "long", - "constants": { - "FileInternalInformation": 6, - "FileQuotaInformation": 32, - "FileIoStatusBlockRangeInformation": 42, - "FilePipeLocalInformation": 24, - "FileStandardLinkInformation": 54, - "FileIdFullDirectoryInformation": 38, - "FileLinkInformation": 11, - "FileFullDirectoryInformation": 2, - "FileAllInformation": 18, - "FileSfioVolumeInformation": 45, - "FileStreamInformation": 22, - "FileRenameInformation": 10, - "FileValidDataLengthInformation": 39, - "FileAlternateNameInformation": 21, - "FileBasicInformation": 4, - "FilePositionInformation": 14, - "FileCompletionInformation": 30, - "FileAttributeCacheInformation": 52, - "FileReparsePointInformation": 33, - "FileMailslotSetInformation": 27, - "FileNetworkPhysicalNameInformation": 49, - "FileAllocationInformation": 19, - "FileIsRemoteDeviceInformation": 51, - "FileFullEaInformation": 15, - "FileProcessIdsUsingFileInformation": 47, - "FileDispositionInformation": 13, - "FileStandardInformation": 5, - "FileAccessInformation": 8, - "FileNumaNodeInformation": 53, - "FilePipeRemoteInformation": 25, - "FileIoPriorityHintInformation": 43, - "FileMailslotQueryInformation": 26, - "FileRemoteProtocolInformation": 55, - "FileNamesInformation": 12, - "FileHardLinkInformation": 46, - "FileEndOfFileInformation": 20, - "FileIdBothDirectoryInformation": 37, - "FileSfioReserveInformation": 44, - "FileIdGlobalTxDirectoryInformation": 50, - "FileNetworkOpenInformation": 34, - "FileObjectIdInformation": 29, - "FileMoveClusterInformation": 31, - "FileIoCompletionNotificationInformation": 41, - "FileNameInformation": 9, - "FileBothDirectoryInformation": 3, - "FileDirectoryInformation": 1, - "FileMaximumInformation": 56, - "FileNormalizedNameInformation": 48, - "FilePipeInformation": 23, - "FileCompressionInformation": 28, - "FileTrackingInformation": 36, - "FileEaInformation": 7, - "FileShortNameInformation": 40, - "FileModeInformation": 16, - "FileAlignmentInformation": 17, - "FileAttributeTagInformation": 35 - }, - "size": 4 - }, - "ModePruningAlgorithmEnum": { - "base": "long", - "constants": { - "DMM_MPA_MAXVALID": 3, - "DMM_MPA_GDI": 1, - "DMM_MPA_VISTA": 2, - "DMM_MPA_UNINITIALIZED": 0 - }, - "size": 4 - }, - "fmtEnum": { - "base": "unsigned long", - "constants": { - "CF_ENHMETAFILE": 14, - "CF_PENDATA": 10, - "CF_BITMAP": 2, - "CF_UNICODETEXT": 13, - "CF_HDROP": 15, - "CF_OEMTEXT": 7, - "CF_WAVE": 12, - "CF_DSPTEXT": 129, - "CF_DIBV5": 17, - "CF_TIFF": 6, - "CF_PALETTE": 9, - "CF_OWNERDISPLAY": 128, - "CF_DSPMETAFILEPICT": 131, - "CF_METAFILEPICT": 3, - "CF_RIFF": 11, - "CF_DSPENHMETAFILE": 142, - "CF_TEXT": 1, - "CF_LOCALE": 16, - "CF_SYLK": 4, - "CF_DSPBITMAP": 130, - "CF_DIB": 8, - "CF_DIF": 5 - }, - "size": 4 - }, - "MonitorPowerStateEnum": { - "base": "long", - "constants": { - "PowerDeviceUnspecified": 0, - "PowerDeviceD0": 1, - "PowerDeviceD1": 2, - "PowerDeviceD2": 3, - "PowerDeviceD3": 4, - "PowerDeviceMaximum": 5 - }, - "size": 4 - }, - "bTypeEnum": { - "base": "unsigned char", - "constants": { - "TYPE_DDEXACT": 11, - "TYPE_HOOK": 5, - "TYPE_FREE": 0, - "TYPE_MONITOR": 12, - "TYPE_GESTURE": 21, - "TYPE_DEVICEINFO": 19, - "TYPE_DDEACCESS": 9, - "TYPE_CALLPROC": 7, - "TYPE_CURSOR": 3, - "TYPE_KBDLAYOUT": 13, - "TYPE_WINEVENTHOOK": 15, - "TYPE_MENU": 2, - "TYPE_ACCELTABLE": 8, - "TYPE_TOUCH": 20, - "TYPE_SETWINDOWPOS": 4, - "TYPE_CLIPDATA": 6, - "TYPE_KBDFILE": 14, - "TYPE_DDECONV": 10, - "TYPE_HIDDATA": 18, - "TYPE_WINDOW": 1, - "TYPE_INPUTCONTEXT": 17, - "TYPE_TIMER": 16 - }, - "size": 1 - }, - "OriginEnum": { - "base": "long", - "constants": { - "D3DKMDT_MCO_MONITORDESCRIPTOR_REGISTRYOVERRIDE": 3, - "D3DKMDT_MCO_UNINITIALIZED": 0, - "D3DKMDT_MCO_MONITORDESCRIPTOR": 2, - "D3DKMDT_MCO_MAXVALID": 5, - "D3DKMDT_MCO_SPECIFICCAP_REGISTRYOVERRIDE": 4, - "D3DKMDT_MCO_DEFAULTMONITORPROFILE": 1 - }, - "size": 4 - }, - "CodePointTypeEnum": { - "base": "long", - "constants": { - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_BTL": 8, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_TARGET_MODE": 20, - "DXGK_DIAG_CODE_POINT_TYPE_HANDLE_IRP": 40, - "DXGK_DIAG_CODE_POINT_TYPE_CHANGE_UNSUPPORTED_MONITOR_MODE_FLAG": 41, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_ENFORCED_CLONE_PATH_INVALID_SOURCE_IDX": 57, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_GDI": 11, - "DXGK_DIAG_CODE_POINT_TYPE_BML_TARGET_MODE_NOT_PINNED": 22, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DEVICE_REMOVED": 51, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BACKTRACK": 17, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_RECREATE_DEVICE_FAILED": 53, - "DXGK_DIAG_CODE_POINT_TYPE_BML_NO_EXACT_SOURCE_MODE": 19, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_ENABLE_VGA": 48, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_SOURCE_MODE": 32, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_DISABLEGDI": 43, - "DXGK_DIAG_CODE_POINT_TYPE_TDR": 24, - "DXGK_DIAG_CODE_POINT_TYPE_BML_BEST_TARGET_MODE": 33, - "DXGK_DIAG_CODE_POINT_TYPE_MON_DEPART_GETRECENTTOP_FAIL": 61, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_LOG_FAILURE": 3, - "DXGK_DIAG_CODE_POINT_TYPE_STOP_ADAPTER": 36, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_DRVASSERTMODE_TRUE_FAILED": 52, - "DXGK_DIAG_CODE_POINT_TYPE_FORCE_UINT32": -1, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_MODESWITCH": 45, - "DXGK_DIAG_CODE_POINT_TYPE_START_ADAPTER": 35, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_CCDBML_FAIL_VISTABML_SUCCESSED": 31, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_NOTIFY_CALLBACK": 42, - "DXGK_DIAG_CODE_POINT_TYPE_MON_ARRIVE_INC_ADD_FAIL": 62, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKCDDENABLE_OPTIMIZED_MODE_CHANGE": 59, - "DXGK_DIAG_CODE_POINT_TYPE_NONE": 0, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEFUNVIDPN_RELAX_REFRESH_MATCH": 30, - "DXGK_DIAG_CODE_POINT_TYPE_QDC_LOG_FAILURE": 10, - "DXGK_DIAG_CODE_POINT_TYPE_COMMIT_VIDPN_LOG_FAILURE": 55, - "DXGK_DIAG_CODE_POINT_TYPE_OS_RECOMMENDED_VIDPN": 2, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING": 37, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_DIM_MONITOR": 15, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_LOG_FAILURE": 5, - "DXGK_DIAG_CODE_POINT_TYPE_ACPI_EVENT_NOTIFICATION": 25, - "DXGK_DIAG_CODE_POINT_TYPE_INDICATE_CHILD_STATUS": 39, - "DXGK_DIAG_CODE_POINT_TYPE_REBUILD_DXGK_MODE_CACHE": 29, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_GDI": 12, - "DXGK_DIAG_CODE_POINT_TYPE_CDD_MAPSHADOWBUFFER_FAILED": 54, - "DXGK_DIAG_CODE_POINT_TYPE_BML_CLOSEST_TARGET_MODE": 18, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_CDD_CREATE_DEVICE_FAILED": 50, - "DXGK_DIAG_CODE_POINT_TYPE_ADD_DEVICE": 34, - "DXGK_DIAG_CODE_POINT_TYPE_SDC_INVALIDATE_ERROR": 4, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_EXCLUDE_EVICTALL_ENABLEGDI": 44, - "DXGK_DIAG_CODE_POINT_TYPE_CDS_FAILURE_DB": 7, - "DXGK_DIAG_CODE_POINT_TYPE_BML_SOURCE_MODE_NOT_PINNED": 21, - "DXGK_DIAG_CODE_POINT_TYPE_INVALIDATE_DXGK_MODE_CACHE": 28, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_SYNC_MONITOR_EVENT": 46, - "DXGK_DIAG_CODE_POINT_TYPE_DRIVER_RECOMMEND_LOG_FAILURE": 56, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_TDR_SWITCH_GDI": 49, - "DXGK_DIAG_CODE_POINT_TYPE_DXGKSETDISPLAYMODE_OPTIMIZED_MODE_CHANGE": 60, - "DXGK_DIAG_CODE_POINT_TYPE_CHILD_POLLING_TARGET": 38, - "DXGK_DIAG_CODE_POINT_TYPE_RECOMMEND_FUNC_VIDPN": 1, - "DXGK_DIAG_CODE_POINT_TYPE_CREATEMDEV_USE_DEFAULT_MODE": 26, - "DXGK_DIAG_CODE_POINT_TYPE_BML_RESTARTED": 23, - "DXGK_DIAG_CODE_POINT_TYPE_CCD_DATABASE_PERSIST": 63, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_ON_MONITOR": 13, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_UNDIM_MONITOR": 16, - "DXGK_DIAG_CODE_POINT_TYPE_RETRIEVE_DB": 9, - "DXGK_DIAG_CODE_POINT_TYPE_CONNECTED_SET_LOG_FAILURE": 27, - "DXGK_DIAG_CODE_POINT_TYPE_DRVPROBEANDCAPTURE_FAILED": 58, - "DXGK_DIAG_CODE_POINT_TYPE_VIDEOPORTCALLOUT_PNP_NOTIFY_GDI": 47, - "DXGK_DIAG_CODE_POINT_TYPE_POWER_OFF_MONITOR": 14, - "DXGK_DIAG_CODE_POINT_TYPE_MAX": 64 - }, - "size": 4 - }, - "ConstraintTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MFRC_MAXPIXELRATE": 2, - "D3DKMDT_MFRC_ACTIVESIZE": 1, - "D3DKMDT_MFRC_UNINITIALIZED": 0 - }, - "size": 4 - }, - "VidPnTargetColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MonitorTypeEnum": { - "base": "long", - "constants": { - "DMM_VMT_TEMPORARY_MONITOR": 4, - "DMM_VMT_BOOT_PERSISTENT_MONITOR": 2, - "DMM_VMT_PHYSICAL_MONITOR": 1, - "DMM_VMT_UNINITIALIZED": 0, - "DMM_VMT_SIMULATED_MONITOR": 5, - "DMM_VMT_PERSISTENT_MONITOR": 3 - }, - "size": 4 - }, - "PowerStateEnum": { - "base": "long", - "constants": { - "PowerSystemSleeping2": 3, - "PowerSystemSleeping1": 2, - "PowerSystemSleeping3": 4, - "PowerSystemUnspecified": 0, - "PowerSystemMaximum": 7, - "PowerSystemShutdown": 6, - "PowerSystemHibernate": 5, - "PowerSystemWorking": 1 - }, - "size": 4 - }, - "ShutdownTypeEnum": { - "base": "long", - "constants": { - "PowerActionNone": 0, - "PowerActionReserved": 1, - "PowerActionHibernate": 3, - "PowerActionShutdownOff": 6, - "PowerActionShutdown": 4, - "PowerActionSleep": 2, - "PowerActionShutdownReset": 5, - "PowerActionWarmEject": 7 - }, - "size": 4 - }, - "ScalingEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPS_CENTERED": 2, - "D3DKMDT_VPPS_ASPECTRATIOCENTEREDMAX": 4, - "D3DKMDT_VPPS_STRETCHED": 3, - "D3DKMDT_VPPS_UNINITIALIZED": 0, - "D3DKMDT_VPPS_UNPINNED": 254, - "D3DKMDT_VPPS_IDENTITY": 1, - "D3DKMDT_VPPS_NOTSPECIFIED": 255, - "D3DKMDT_VPPS_CUSTOM": 5, - "D3DKMDT_VPPS_RESERVED1": 253 - }, - "size": 4 - }, - "CurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "StorageTypeEnum": { - "base": "long", - "constants": { - "SmStorageActual": 0, - "SmStorageNonActual": 1 - }, - "size": 4 - }, - "ScanLineOrderingEnum": { - "base": "long", - "constants": { - "D3DDDI_VSSLO_PROGRESSIVE": 1, - "D3DDDI_VSSLO_INTERLACED_LOWERFIELDFIRST": 3, - "D3DDDI_VSSLO_UNINITIALIZED": 0, - "D3DDDI_VSSLO_INTERLACED_UPPERFIELDFIRST": 2, - "D3DDDI_VSSLO_OTHER": 255 - }, - "size": 4 - }, - "PixelValueAccessModeEnum": { - "base": "long", - "constants": { - "D3DKMDT_PVAM_UNINITIALIZED": 0, - "D3DKMDT_PVAM_DIRECT": 1, - "D3DKMDT_PVAM_PRESETPALETTE": 2, - "D3DKMDT_PVAM_MAXVALID": 3 - }, - "size": 4 - }, - "PriorityPolicyEnum": { - "base": "long", - "constants": { - "IrqPriorityHigh": 3, - "IrqPriorityNormal": 2, - "IrqPriorityLow": 1, - "IrqPriorityUndefined": 0 - }, - "size": 4 - }, - "OrientationEnum": { - "base": "long", - "constants": { - "D3DKMDT_MO_90DEG": 2, - "D3DKMDT_MO_0DEG": 1, - "D3DKMDT_MO_270DEG": 4, - "D3DKMDT_MO_UNINITIALIZED": 0, - "D3DKMDT_MO_180DEG": 3 - }, - "size": 4 - }, - "ContentEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPC_NOTSPECIFIED": 255, - "D3DKMDT_VPPC_UNINITIALIZED": 0, - "D3DKMDT_VPPC_GRAPHICS": 1, - "D3DKMDT_VPPC_VIDEO": 2 - }, - "size": 4 - }, - "ColorBasisEnum": { - "base": "long", - "constants": { - "D3DKMDT_CB_MAXVALID": 5, - "D3DKMDT_CB_INTENSITY": 1, - "D3DKMDT_CB_SCRGB": 3, - "D3DKMDT_CB_YCBCR": 4, - "D3DKMDT_CB_SRGB": 2, - "D3DKMDT_CB_UNINITIALIZED": 0 - }, - "size": 4 - }, - "MoveRectStyleEnum": { - "base": "long", - "constants": { - "MoveRectMidTopAtCursor": 1, - "MoveRectSidewiseKeepPositionAtCursor": 3, - "MoveRectKeepPositionAtCursor": 0, - "MoveRectKeepAspectRatioAtCursor": 2 - }, - "size": 4 - }, - "VideoStandardEnum": { - "base": "long", - "constants": { - "D3DKMDT_VSS_PAL_G": 11, - "D3DKMDT_VSS_PAL_D": 14, - "D3DKMDT_VSS_PAL_B": 9, - "D3DKMDT_VSS_SECAM_K": 21, - "D3DKMDT_VSS_VESA_GTF": 2, - "D3DKMDT_VSS_PAL_L": 30, - "D3DKMDT_VSS_PAL_M": 31, - "D3DKMDT_VSS_PAL_K": 28, - "D3DKMDT_VSS_PAL_H": 12, - "D3DKMDT_VSS_PAL_I": 13, - "D3DKMDT_VSS_SECAM_L1": 24, - "D3DKMDT_VSS_VESA_DMT": 1, - "D3DKMDT_VSS_SECAM_L": 23, - "D3DKMDT_VSS_EIA_861": 25, - "D3DKMDT_VSS_PAL_N": 15, - "D3DKMDT_VSS_APPLE": 5, - "D3DKMDT_VSS_NTSC_M": 6, - "D3DKMDT_VSS_SECAM_H": 20, - "D3DKMDT_VSS_NTSC_J": 7, - "D3DKMDT_VSS_SECAM_B": 17, - "D3DKMDT_VSS_SECAM_G": 19, - "D3DKMDT_VSS_SECAM_D": 18, - "D3DKMDT_VSS_IBM": 4, - "D3DKMDT_VSS_SECAM_K1": 22, - "D3DKMDT_VSS_PAL_NC": 16, - "D3DKMDT_VSS_PAL_B1": 10, - "D3DKMDT_VSS_EIA_861A": 26, - "D3DKMDT_VSS_EIA_861B": 27, - "D3DKMDT_VSS_UNINITIALIZED": 0, - "D3DKMDT_VSS_OTHER": 255, - "D3DKMDT_VSS_PAL_K1": 29, - "D3DKMDT_VSS_VESA_CVT": 3, - "D3DKMDT_VSS_NTSC_443": 8 - }, - "size": 4 - }, - "ImportanceOrdinalEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPI_QUATERNARY": 4, - "D3DKMDT_VPPI_SECONDARY": 2, - "D3DKMDT_VPPI_PRIMARY": 1, - "D3DKMDT_VPPI_QUINARY": 5, - "D3DKMDT_VPPI_DENARY": 10, - "D3DKMDT_VPPI_SENARY": 6, - "D3DKMDT_VPPI_TERTIARY": 3, - "D3DKMDT_VPPI_SEPTENARY": 7, - "D3DKMDT_VPPI_NONARY": 9, - "D3DKMDT_VPPI_UNINITIALIZED": 0, - "D3DKMDT_VPPI_OCTONARY": 8, - "D3DKMDT_VPPI_MAX": 32, - "D3DKMDT_VPPI_NOTSPECIFIED": 255 - }, - "size": 4 - }, - "RangeTypeEnum": { - "base": "long", - "constants": { - "SmRangeBool": 2, - "SmRangeNonSharedInfo": 1, - "SmRangeSharedInfo": 0 - }, - "size": 4 - }, - "TimingTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_MTT_EXTRASTANDARD": 3, - "D3DKMDT_MTT_DEFAULTMONITORPROFILE": 5, - "D3DKMDT_MTT_STANDARD": 2, - "D3DKMDT_MTT_UNINITIALIZED": 0, - "D3DKMDT_MTT_MAXVALID": 6, - "D3DKMDT_MTT_DETAILED": 4, - "D3DKMDT_MTT_ESTABLISHED": 1 - }, - "size": 4 - }, - "PixelFormatEnum": { - "base": "long", - "constants": { - "D3DDDIFMT_W11V11U10": 65, - "D3DDDIFMT_A16B16G16R16F": 113, - "D3DDDIFMT_A8R8G8B8": 21, - "D3DDDIFMT_D32_LOCKABLE": 84, - "D3DDDIFMT_L8": 50, - "D3DDDIFMT_DXVA_RESERVED27": 177, - "D3DDDIFMT_DXVA_RESERVED26": 176, - "D3DDDIFMT_DXVA_RESERVED25": 175, - "D3DDDIFMT_DXVA_RESERVED24": 174, - "D3DDDIFMT_DXVA_RESERVED23": 173, - "D3DDDIFMT_DXVA_RESERVED22": 172, - "D3DDDIFMT_DXVA_RESERVED21": 171, - "D3DDDIFMT_DXVA_RESERVED20": 170, - "D3DDDIFMT_DXVA_RESERVED29": 179, - "D3DDDIFMT_DXVA_RESERVED28": 178, - "D3DDDIFMT_R3G3B2": 27, - "D3DDDIFMT_A8R3G3B2": 29, - "D3DDDIFMT_INDEX16": 101, - "D3DDDIFMT_X4R4G4B4": 30, - "D3DDDIFMT_A4R4G4B4": 26, - "D3DDDIFMT_Q8W8V8U8": 63, - "D3DDDIFMT_FORCE_UINT": 2147483647, - "D3DDDIFMT_S1D15": 72, - "D3DDDIFMT_A16B16G16R16": 36, - "D3DDDIFMT_A8L8": 51, - "D3DDDIFMT_D24X4S4": 79, - "D3DDDIFMT_BINARYBUFFER": 199, - "D3DDDIFMT_DXVA_RESERVED30": 180, - "D3DDDIFMT_R32F": 114, - "D3DDDIFMT_VERTEXDATA": 100, - "D3DDDIFMT_R5G6B5": 23, - "D3DDDIFMT_R8G8_B8G8": 1195525970, - "D3DDDIFMT_A4L4": 52, - "D3DDDIFMT_A1R5G5B5": 25, - "D3DDDIFMT_X1R5G5B5": 24, - "D3DDDIFMT_D32": 71, - "D3DDDIFMT_G8R8_G8B8": 1111970375, - "D3DDDIFMT_A2B10G10R10": 31, - "D3DDDIFMT_DXVACOMPBUFFER_MAX": 181, - "D3DDDIFMT_MULTI2_ARGB8": 827606349, - "D3DDDIFMT_D16_LOCKABLE": 70, - "D3DDDIFMT_BITSTREAMDATA": 156, - "D3DDDIFMT_RESIDUALDIFFERENCEDATA": 152, - "D3DDDIFMT_X8B8G8R8": 33, - "D3DDDIFMT_R8G8B8": 20, - "D3DDDIFMT_S8_LOCKABLE": 85, - "D3DDDIFMT_D24S8": 75, - "D3DDDIFMT_X8D24": 76, - "D3DDDIFMT_A2R10G10B10": 35, - "D3DDDIFMT_P8": 41, - "D3DDDIFMT_L6V5U5": 61, - "D3DDDIFMT_X8R8G8B8": 22, - "D3DDDIFMT_D16": 80, - "D3DDDIFMT_A2W10V10U10": 67, - "D3DDDIFMT_D24FS8": 83, - "D3DDDIFMT_MOTIONVECTORBUFFER": 157, - "D3DDDIFMT_L16": 81, - "D3DDDIFMT_X8L8V8U8": 62, - "D3DDDIFMT_A32B32G32R32F": 116, - "D3DDDIFMT_A8P8": 40, - "D3DDDIFMT_YUY2": 844715353, - "D3DDDIFMT_R16F": 111, - "D3DDDIFMT_G16R16": 34, - "D3DDDIFMT_A2B10G10R10_XR_BIAS": 119, - "D3DDDIFMT_Q16W16V16U16": 110, - "D3DDDIFMT_S8D24": 74, - "D3DDDIFMT_PICTUREPARAMSDATA": 150, - "D3DDDIFMT_A1": 118, - "D3DDDIFMT_FILMGRAINBUFFER": 158, - "D3DDDIFMT_A8": 28, - "D3DDDIFMT_UNKNOWN": 0, - "D3DDDIFMT_DXVA_RESERVED19": 169, - "D3DDDIFMT_D32F_LOCKABLE": 82, - "D3DDDIFMT_MACROBLOCKDATA": 151, - "D3DDDIFMT_A8B8G8R8": 32, - "D3DDDIFMT_UYVY": 1498831189, - "D3DDDIFMT_DXT1": 827611204, - "D3DDDIFMT_DEBLOCKINGDATA": 153, - "D3DDDIFMT_DXT3": 861165636, - "D3DDDIFMT_DXT4": 877942852, - "D3DDDIFMT_DXT5": 894720068, - "D3DDDIFMT_CxV8U8": 117, - "D3DDDIFMT_INVERSEQUANTIZATIONDATA": 154, - "D3DDDIFMT_DXVA_RESERVED9": 159, - "D3DDDIFMT_DXT2": 844388420, - "D3DDDIFMT_G32R32F": 115, - "D3DDDIFMT_X4S4D24": 78, - "D3DDDIFMT_D24X8": 77, - "D3DDDIFMT_DXVA_RESERVED12": 162, - "D3DDDIFMT_DXVA_RESERVED13": 163, - "D3DDDIFMT_DXVA_RESERVED10": 160, - "D3DDDIFMT_DXVA_RESERVED11": 161, - "D3DDDIFMT_DXVA_RESERVED16": 166, - "D3DDDIFMT_DXVA_RESERVED17": 167, - "D3DDDIFMT_DXVA_RESERVED14": 164, - "D3DDDIFMT_DXVA_RESERVED15": 165, - "D3DDDIFMT_DXVA_RESERVED18": 168, - "D3DDDIFMT_D15S1": 73, - "D3DDDIFMT_V16U16": 64, - "D3DDDIFMT_SLICECONTROLDATA": 155, - "D3DDDIFMT_G16R16F": 112, - "D3DDDIFMT_INDEX32": 102, - "D3DDDIFMT_V8U8": 60 - }, - "size": 4 - }, - "IdTypeEnum": { - "base": "long", - "constants": { - "BusQueryCompatibleIDs": 2, - "BusQueryInstanceID": 3, - "BusQueryDeviceID": 0, - "BusQueryDeviceSerialNumber": 4, - "BusQueryHardwareIDs": 1, - "BusQueryContainerID": 5 - }, - "size": 4 - }, - "StartCurrentHitTargetEnum": { - "base": "long", - "constants": { - "ThresholdMarginRight": 2, - "ThresholdMarginMax": 4, - "ThresholdMarginBottom": 3, - "ThresholdMarginLeft": 1, - "ThresholdMarginTop": 0 - }, - "size": 4 - }, - "TypeEnum": { - "base": "long", - "constants": { - "DevicePowerState": 1, - "SystemPowerState": 0 - }, - "size": 4 - }, - "RotationEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPR_IDENTITY": 1, - "D3DKMDT_VPPR_NOTSPECIFIED": 255, - "D3DKMDT_VPPR_UNPINNED": 254, - "D3DKMDT_VPPR_ROTATE270": 4, - "D3DKMDT_VPPR_ROTATE90": 2, - "D3DKMDT_VPPR_ROTATE180": 3, - "D3DKMDT_VPPR_UNINITIALIZED": 0 - }, - "size": 4 - }, - "CopyProtectionTypeEnum": { - "base": "long", - "constants": { - "D3DKMDT_VPPMT_NOTSPECIFIED": 255, - "D3DKMDT_VPPMT_UNINITIALIZED": 0, - "D3DKMDT_VPPMT_MACROVISION_FULLSUPPORT": 3, - "D3DKMDT_VPPMT_MACROVISION_APSTRIGGER": 2, - "D3DKMDT_VPPMT_NOPROTECTION": 1 - }, - "size": 4 - }, - "FsInformationClassEnum": { - "base": "long", - "constants": { - "FileFsFullSizeInformation": 7, - "FileFsAttributeInformation": 5, - "FileFsVolumeFlagsInformation": 10, - "FileFsVolumeInformation": 1, - "FileFsSizeInformation": 3, - "FileFsLabelInformation": 2, - "FileFsDeviceInformation": 4, - "FileFsControlInformation": 6, - "FileFsDriverPathInformation": 9, - "FileFsMaximumInformation": 11, - "FileFsObjectIdInformation": 8 - }, - "size": 4 - }, - "DeviceTextTypeEnum": { - "base": "long", - "constants": { - "DeviceTextLocationInformation": 1, - "DeviceTextDescription": 0 - }, - "size": 4 - } - }, - "metadata": { - "producer": { - "version": "0.0.1", - "name": "dgmcdona-via-conversion-script", - "datetime": "2024-09-03T18:22:52Z" - }, - "format": "4.0.0" - } } From cad15d0c921132c36edd495800bd99dd801901b6 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 17:35:31 -0600 Subject: [PATCH 0695/1352] Windows DeskScan: Add version to class code review fix --- volatility3/framework/plugins/windows/deskscan.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/windows/deskscan.py b/volatility3/framework/plugins/windows/deskscan.py index baba3d8a0..6a8ff9e65 100644 --- a/volatility3/framework/plugins/windows/deskscan.py +++ b/volatility3/framework/plugins/windows/deskscan.py @@ -16,6 +16,7 @@ class DeskScan(desktops.Desktops): """Scans for the Desktop instances of each Window Station""" _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) From f139dde1217f7c3af9d9e59565c438efdfb51ce0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 16:53:54 -0600 Subject: [PATCH 0696/1352] Code Review: Fix pslist param Change to self.current_kernel_name so people can change this value. --- volatility3/cli/volshell/windows.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index cf8fd400d..c5bab3b74 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -38,7 +38,9 @@ class Volshell(generic.Volshell): def list_processes(self): """Returns a list of EPROCESS objects from the primary layer""" # We always use the main kernel memory and associated symbols - return list(pslist.PsList.list_processes(self.context, self.config["kernel"])) + return list( + pslist.PsList.list_processes(self.context, self.current_kernel_name) + ) def get_process(self, pid=None, virtaddr=None, physaddr=None): """Returns the _EPROCESS object that matches the pid. If a physical or a virtual address is provided, construct the _EPROCESS object at said address. Only one parameter is allowed. From c2c93ad90e7aae43d1f23ea4ae94127c5d0c08fb Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 17:44:37 -0600 Subject: [PATCH 0697/1352] Code Review: Simplify dictionary construction Also adds some keywords in method call args, and fixes an incorrect type-hint. --- .../framework/plugins/windows/modules.py | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 4872135a9..ee42b665b 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import Generator, Iterable, List, Optional, Dict +from typing import Generator, Iterable, List, Optional, Dict, Tuple from volatility3.framework import symbols, constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -93,11 +93,13 @@ class Modules(interfaces.plugins.PluginInterface): session_layers = list( self.get_session_layers( self.context, - self.config["kernel"], + kernel_module_name=self.config["kernel"], ) ) - for mod in self._enumeration_method(self.context, self.config["kernel"]): + for mod in self._enumeration_method( + self.context, kernel_module_name=self.config["kernel"] + ): if self.config["base"] and self.config["base"] != mod.DllBase: continue @@ -167,7 +169,7 @@ class Modules(interfaces.plugins.PluginInterface): context: interfaces.context.ContextInterface, kernel_module_name: str, pids: Optional[List[int]] = None, - ) -> Generator[str, None, None]: + ) -> Generator[Tuple[int, str], None, None]: """Build a cache of possible virtual layers, in priority starting with the primary/kernel layer. Then keep one layer per session by cycling through the process list. @@ -273,14 +275,7 @@ class Modules(interfaces.plugins.PluginInterface): Wraps `_do_get_session_layers` to produce a dictionary where each key is a session_id and the value is the name of the layer for that session """ - sessions: Dict[int, str] = {} - - for session_id, proc_layer_name in cls._do_get_session_layers( - context, kernel_module_name, pids - ): - sessions[session_id] = proc_layer_name - - return sessions + return dict(cls._do_get_session_layers(context, kernel_module_name, pids)) @classmethod def find_session_layer( From 2b9f61abeadfa12f4862301c5ea1edf5aa7bfcba Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 17:52:11 -0600 Subject: [PATCH 0698/1352] Code Review: Parameter renaming Makes it explicit that these are symbol table names, not actual symbol tables. --- .../framework/plugins/windows/poolscanner.py | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 75de8bb95..050a86c58 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -366,8 +366,8 @@ class PoolScanner(plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, - kernel_symbol_table: str, - object_symbol_table: str, + kernel_symbol_table_name: str, + object_symbol_table_name: str, constraints: List[PoolConstraint], ) -> Generator[ Tuple[ @@ -396,18 +396,18 @@ class PoolScanner(plugins.PluginInterface): type_map = handles.Handles.get_type_map( context=context, layer_name=kernel_layer_name, - symbol_table=kernel_symbol_table, + symbol_table=kernel_symbol_table_name, ) cookie = handles.Handles.find_cookie( context=context, layer_name=kernel_layer_name, - symbol_table=kernel_symbol_table, + symbol_table=kernel_symbol_table_name, ) - is_windows_10 = versions.is_windows_10(context, kernel_symbol_table) + is_windows_10 = versions.is_windows_10(context, kernel_symbol_table_name) is_windows_8_or_later = versions.is_windows_8_or_later( - context, kernel_symbol_table + context, kernel_symbol_table_name ) # start off with the primary virtual layer @@ -417,14 +417,18 @@ class PoolScanner(plugins.PluginInterface): if not is_windows_10: scan_layer = context.layers[scan_layer].config["memory_layer"] - if symbols.symbol_table_is_64bit(context, kernel_symbol_table): + if symbols.symbol_table_is_64bit(context, kernel_symbol_table_name): alignment = 0x10 else: alignment = 8 # scan in the main kernel layer for the object(s) for constraint, header in cls.pool_scan( - context, scan_layer, object_symbol_table, constraints, alignment=alignment + context, + scan_layer, + object_symbol_table_name, + constraints, + alignment=alignment, ): # construct the object in its own layer, using its own types @@ -432,7 +436,7 @@ class PoolScanner(plugins.PluginInterface): constraint=constraint, use_top_down=is_windows_8_or_later, native_layer_name=kernel_layer_name, - kernel_symbol_table=kernel_symbol_table, + kernel_symbol_table=kernel_symbol_table_name, ) for mem_object in mem_objects: From 5c6107bf33e13e154c20bbcc382fc43390ad5904 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 17:27:45 -0600 Subject: [PATCH 0699/1352] Code Review (style): Use keyword args for clarity This updates a whole host of method calls to pass keyword arguments instead of positional arguments. --- volatility3/framework/layers/registry.py | 2 +- volatility3/framework/plugins/linux/bash.py | 2 +- .../framework/plugins/linux/malfind.py | 2 +- volatility3/framework/plugins/linux/psscan.py | 4 +++- volatility3/framework/plugins/mac/bash.py | 2 +- .../framework/plugins/windows/amcache.py | 8 ++++--- .../framework/plugins/windows/cachedump.py | 6 ++--- .../framework/plugins/windows/callbacks.py | 7 ++++-- .../framework/plugins/windows/cmdline.py | 4 ++-- .../framework/plugins/windows/cmdscan.py | 14 ++++++------ .../framework/plugins/windows/consoles.py | 14 +++++++----- .../plugins/windows/debugregisters.py | 4 +++- .../plugins/windows/direct_system_calls.py | 6 ++--- .../framework/plugins/windows/dlllist.py | 10 +++++---- .../framework/plugins/windows/driverirp.py | 6 +++-- .../framework/plugins/windows/drivermodule.py | 3 ++- .../framework/plugins/windows/dumpfiles.py | 4 ++-- .../framework/plugins/windows/envars.py | 10 ++++----- .../plugins/windows/getservicesids.py | 6 ++--- .../framework/plugins/windows/getsids.py | 10 ++++----- .../framework/plugins/windows/handles.py | 6 ++--- .../framework/plugins/windows/hashdump.py | 6 ++--- .../plugins/windows/hollowprocesses.py | 4 ++-- volatility3/framework/plugins/windows/iat.py | 4 ++-- volatility3/framework/plugins/windows/info.py | 9 +++++++- .../framework/plugins/windows/joblinks.py | 4 ++-- .../framework/plugins/windows/ldrmodules.py | 4 ++-- .../framework/plugins/windows/lsadump.py | 6 ++--- .../framework/plugins/windows/malfind.py | 6 ++--- .../framework/plugins/windows/mbrscan.py | 4 +++- .../framework/plugins/windows/memmap.py | 4 ++-- .../framework/plugins/windows/modules.py | 10 +++++---- .../framework/plugins/windows/netscan.py | 4 +++- .../framework/plugins/windows/netstat.py | 4 +++- .../plugins/windows/orphan_kernel_threads.py | 4 ++-- .../framework/plugins/windows/pe_symbols.py | 8 +++++-- .../framework/plugins/windows/pedump.py | 17 +++++++------- .../framework/plugins/windows/poolscanner.py | 8 +++++-- .../framework/plugins/windows/privileges.py | 4 ++-- .../plugins/windows/processghosting.py | 4 ++-- .../framework/plugins/windows/pstree.py | 4 +++- .../framework/plugins/windows/psxview.py | 4 +++- .../windows/registry/getcellroutine.py | 6 +++-- .../plugins/windows/registry/hivelist.py | 14 ++++++------ .../plugins/windows/registry/hivescan.py | 4 +++- .../plugins/windows/registry/printkey.py | 6 ++--- .../plugins/windows/registry/userassist.py | 6 ++--- .../plugins/windows/scheduled_tasks.py | 8 ++++--- .../framework/plugins/windows/sessions.py | 4 ++-- .../framework/plugins/windows/shimcachemem.py | 22 ++++++++++++++----- .../plugins/windows/skeleton_key_check.py | 8 ++++--- volatility3/framework/plugins/windows/ssdt.py | 6 ++--- .../framework/plugins/windows/strings.py | 10 +++++---- .../plugins/windows/suspended_threads.py | 8 +++++-- .../plugins/windows/suspicious_threads.py | 4 ++-- .../framework/plugins/windows/svcdiff.py | 2 +- .../framework/plugins/windows/svclist.py | 6 ++--- .../framework/plugins/windows/svcscan.py | 14 +++++++----- .../framework/plugins/windows/threads.py | 4 ++-- .../framework/plugins/windows/timers.py | 4 ++-- .../plugins/windows/unhooked_system_calls.py | 8 +++---- .../plugins/windows/unloadedmodules.py | 8 +++++-- .../framework/plugins/windows/vadinfo.py | 4 ++-- .../framework/plugins/windows/vadregexscan.py | 4 ++-- .../framework/plugins/windows/vadwalk.py | 4 ++-- .../framework/plugins/windows/vadyarascan.py | 4 ++-- .../framework/plugins/windows/verinfo.py | 6 +++-- .../plugins/windows/windowstations.py | 22 ++++++++++--------- .../symbols/linux/extensions/__init__.py | 8 +++++-- .../symbols/windows/extensions/__init__.py | 12 +++++++--- .../symbols/windows/extensions/pool.py | 4 +++- .../plugins/windows/registry/certificates.py | 6 ++--- 72 files changed, 286 insertions(+), 192 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 6d96a76a1..48dd2b624 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -66,7 +66,7 @@ class RegistryHive(linear.LinearlyMappedLayer): # Win10 17063 introduced the Registry process to map most hives. Check # if it exists and update RegistryHive._base_layer for proc in pslist.PsList.list_processes( - self.context, self.config["kernel_module_name"] + context=self.context, kernel_module_name=self.config["kernel_module_name"] ): proc_name = proc.ImageFileName.cast( "string", max_length=proc.ImageFileName.vol.count, errors="replace" diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 8acfeb848..293c47224 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -46,7 +46,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self, tasks): vmlinux = self.context.modules[self.config["kernel"]] is_32bit = not symbols.symbol_table_is_64bit( - self.context, vmlinux.symbol_table_name + context=self.context, symbol_table_name=vmlinux.symbol_table_name ) if is_32bit: pack_format = "I" diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 297116890..8bbf3b89c 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -64,7 +64,7 @@ class Malfind(interfaces.plugins.PluginInterface): # determine if we're on a 32 or 64 bit kernel vmlinux = self.context.modules[self.config["kernel"]] is_32bit_arch = not symbols.symbol_table_is_64bit( - self.context, vmlinux.symbol_table_name + context=self.context, symbol_table_name=vmlinux.symbol_table_name ) for task in tasks: diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index ba68c4856..6c4c5eb35 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -84,7 +84,9 @@ class PsScan(interfaces.plugins.PluginInterface): vmlinux = context.modules[vmlinux_module_name] # check if this image is 32bit or 64bit - is_32bit = not symbols.symbol_table_is_64bit(context, vmlinux.symbol_table_name) + is_32bit = not symbols.symbol_table_is_64bit( + context=context, symbol_table_name=vmlinux.symbol_table_name + ) if is_32bit: pack_format = "I" else: diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index a52ae616a..5be5e74d6 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -44,7 +44,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self, tasks): darwin = self.context.modules[self.config["kernel"]] is_32bit = not symbols.symbol_table_is_64bit( - self.context, darwin.symbol_table_name + context=self.context, symbol_table_name=darwin.symbol_table_name ) if is_32bit: pack_format = "I" diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 2ce1ead02..133297de3 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -259,9 +259,11 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located.""" return next( hivelist.HiveList.list_hives( - context, - interfaces.configuration.path_join(config_path, "hivelist"), - kernel_module_name, + context=context, + base_config_path=interfaces.configuration.path_join( + config_path, "hivelist" + ), + kernel_module_name=kernel_module_name, filter_string="amcache", ), None, diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 5f5862e36..ef4096b42 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -171,9 +171,9 @@ class Cachedump(interfaces.plugins.PluginInterface): syshive = sechive = None for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 035ed9091..08e343ec7 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -187,7 +187,9 @@ class Callbacks(interfaces.plugins.PluginInterface): The name of the constructed symbol table """ native_types = context.symbol_space[nt_symbol_table].natives - is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=nt_symbol_table + ) table_mapping = {"nt_symbols": nt_symbol_table} if is_64bit: @@ -691,7 +693,8 @@ class Callbacks(interfaces.plugins.PluginInterface): ) collection = ssdt.SSDT.build_module_collection( - self.context, self.config["kernel"] + context=self.context, + kernel_module_name=self.config["kernel"], ) callback_methods = ( diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index dbfac35bf..c095cff9e 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -106,8 +106,8 @@ class CmdLine(interfaces.plugins.PluginInterface): [("PID", int), ("Process", str), ("Args", str)], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index fd0dd76b9..be955374b 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -286,11 +286,11 @@ class CmdScan(interfaces.plugins.PluginInterface): if no_registry is False: max_history, _ = consoles.Consoles.get_console_settings_from_registry( - self.context, - self.config_path, - self.config["kernel"], - max_history, - [], + context=self.context, + config_path=self.config_path, + kernel_module_name=self.config["kernel"], + max_history=max_history, + max_buffers=[], ) vollog.debug(f"Possible CommandHistorySize values: {max_history}") @@ -370,8 +370,8 @@ class CmdScan(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=self._conhost_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index a4003956f..ff5875354 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -149,7 +149,9 @@ class Consoles(interfaces.plugins.PluginInterface): The filename of the symbol table to use and the associated class types. """ - is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=nt_symbol_table + ) if is_64bit: arch = "x64" @@ -824,9 +826,9 @@ class Consoles(interfaces.plugins.PluginInterface): ) for hive in hivelist.HiveList.list_hives( - context, - config_path, - kernel_module_name, + context=context, + base_config_path=config_path, + kernel_module_name=kernel_module_name, hive_offsets=None, ): try: @@ -943,8 +945,8 @@ class Consoles(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=self._conhost_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 394c30e25..d1404b69f 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -117,7 +117,9 @@ class DebugRegisters(interfaces.plugins.PluginInterface): proc_modules = None - procs = pslist.PsList.list_processes(self.context, self.config["kernel"]) + procs = pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) for proc in procs: for thread in threads.Threads.list_threads(kernel, proc): diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index eaf35e842..9d5b81507 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -354,12 +354,12 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_module_name] is_32bit_arch = not symbols.symbol_table_is_64bit( - context, kernel.symbol_table_name + context=context, symbol_table_name=kernel.symbol_table_name ) for proc in pslist.PsList.list_processes( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): proc_name = utility.array_to_string(proc.ImageFileName) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index b609b4fc3..7efc8a7eb 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -13,7 +13,7 @@ from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins import timeliner -from volatility3.plugins.windows import info, pslist, psscan, pedump +from volatility3.plugins.windows import info, pedump, pslist, psscan vollog = logging.getLogger(__name__) @@ -192,7 +192,9 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def generate_timeline(self): for row in self._generator( - pslist.PsList.list_processes(self.context, self.config["kernel"]) + pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) ): _depth, row_data = row if not isinstance(row_data[6], datetime.datetime): @@ -217,8 +219,8 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) else: procs = pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 2fc699e79..20d8ac170 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -71,11 +71,13 @@ class DriverIrp(interfaces.plugins.PluginInterface): def _generator(self): collection = ssdt.SSDT.build_module_collection( - self.context, self.config["kernel"] + context=self.context, + kernel_module_name=self.config["kernel"], ) kernel_space_start = modules.Modules.get_kernel_space_start( - self.context, self.config["kernel"] + context=self.context, + module_name=self.config["kernel"], ) for driver in driverscan.DriverScan.scan_drivers( diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index 9b4c78ae8..97e9e5b3c 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -43,7 +43,8 @@ class DriverModule(interfaces.plugins.PluginInterface): which allows us to detect the disconnect between a malicious driver and its hidden module. """ collection = ssdt.SSDT.build_module_collection( - self.context, self.config["kernel"] + context=self.context, + kernel_module_name=self.config["kernel"], ) kernel_space_start = modules.Modules.get_kernel_space_start( diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index 74a328f78..e89b99275 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -371,8 +371,8 @@ class DumpFiles(interfaces.plugins.PluginInterface): [self.config.get("pid", None)] ) procs = pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index f390c09d5..6f0f8fec1 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -60,9 +60,9 @@ class Envars(interfaces.plugins.PluginInterface): values = [] for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=None, ): ## The global variables @@ -225,8 +225,8 @@ class Envars(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index c222d55b1..6c0040b98 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -76,9 +76,9 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): def _generator(self): # Get the system hive for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], filter_string="machine\\system", hive_offsets=None, ): diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index ba1820a30..710b98bb6 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -104,9 +104,9 @@ class GetSIDs(interfaces.plugins.PluginInterface): sids = {} for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], filter_string="config\\software", hive_offsets=None, ): @@ -220,8 +220,8 @@ class GetSIDs(interfaces.plugins.PluginInterface): [("PID", int), ("Process", str), ("SID", str), ("Name", str)], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index d9e97c1b5..4d21cc9d9 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -78,7 +78,7 @@ class Handles(interfaces.plugins.PluginInterface): except AttributeError: # starting with windows 8 is_64bit = symbols.symbol_table_is_64bit( - self.context, kernel.symbol_table_name + context=self.context, symbol_table_name=kernel.symbol_table_name ) if is_64bit: @@ -393,8 +393,8 @@ class Handles(interfaces.plugins.PluginInterface): ) else: procs = pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 5fdfd549f..fa4081366 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -594,9 +594,9 @@ class Hashdump(interfaces.plugins.PluginInterface): syshive = None samhive = None for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/hollowprocesses.py b/volatility3/framework/plugins/windows/hollowprocesses.py index 7990cb112..af559bfbc 100644 --- a/volatility3/framework/plugins/windows/hollowprocesses.py +++ b/volatility3/framework/plugins/windows/hollowprocesses.py @@ -214,8 +214,8 @@ class HollowProcesses(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index 0fe39e685..701db5734 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -137,8 +137,8 @@ class IAT(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=pslist.PsList.create_pid_filter( self.config.get("pid", None) ), diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index efaf1f737..e20af8114 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -207,7 +207,14 @@ class Info(plugins.PluginInterface): yield (0, ("Symbols", table.config["isf_url"])) yield ( 0, - ("Is64Bit", str(symbols.symbol_table_is_64bit(self.context, symbol_table))), + ( + "Is64Bit", + str( + symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=symbol_table + ) + ), + ), ) yield ( 0, diff --git a/volatility3/framework/plugins/windows/joblinks.py b/volatility3/framework/plugins/windows/joblinks.py index f6a59d7d1..a7fa4e709 100644 --- a/volatility3/framework/plugins/windows/joblinks.py +++ b/volatility3/framework/plugins/windows/joblinks.py @@ -46,8 +46,8 @@ class JobLinks(interfaces.plugins.PluginInterface): memory = self.context.layers[kernel.layer_name] for proc in pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], ): try: if not self.config["physical"]: diff --git a/volatility3/framework/plugins/windows/ldrmodules.py b/volatility3/framework/plugins/windows/ldrmodules.py index e1eb14599..32432c44e 100644 --- a/volatility3/framework/plugins/windows/ldrmodules.py +++ b/volatility3/framework/plugins/windows/ldrmodules.py @@ -120,8 +120,8 @@ class LdrModules(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index eb83352e0..ac2b678f6 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -211,9 +211,9 @@ class Lsadump(interfaces.plugins.PluginInterface): syshive = sechive = None for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=None if offset is None else [offset], ): if hive.get_name().split("\\")[-1].upper() == "SYSTEM": diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 9d79be9dd..33a20ee51 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -172,7 +172,7 @@ class Malfind(interfaces.plugins.PluginInterface): } is_32bit_arch = not symbols.symbol_table_is_64bit( - self.context, kernel.symbol_table_name + context=self.context, symbol_table_name=kernel.symbol_table_name ) for proc in procs: @@ -256,8 +256,8 @@ class Malfind(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index e58ca8c24..4d5198181 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -53,7 +53,9 @@ class MBRScan(interfaces.plugins.PluginInterface): layer = self.context.layers[physical_layer_name] architecture = ( "intel" - if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name) + if not symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=kernel.symbol_table_name + ) else "intel64" ) diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index 790c37aab..5a7bd1b9a 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -108,8 +108,8 @@ class Memmap(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index ee42b665b..6ec16af1b 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -92,7 +92,7 @@ class Modules(interfaces.plugins.PluginInterface): session_layers = list( self.get_session_layers( - self.context, + context=self.context, kernel_module_name=self.config["kernel"], ) ) @@ -140,7 +140,9 @@ class Modules(interfaces.plugins.PluginInterface): module = context.modules[module_name] # default is used if/when MmSystemRangeStart is paged out - if symbols.symbol_table_is_64bit(context, module.symbol_table_name): + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=module.symbol_table_name + ): object_type = "unsigned long long" default_start = 0xFFFF800000000000 else: @@ -188,8 +190,8 @@ class Modules(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_module_name] for proc in pslist.PsList.list_processes( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): proc_id = "Unknown" diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index c30792908..6f98547d7 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -137,7 +137,9 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # therefore we determine the version based on the kernel version as testing # with several windows versions has showed this to work out correctly. - is_64bit = symbols.symbol_table_is_64bit(context, nt_symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=nt_symbol_table + ) is_18363_or_later = versions.is_win10_18363_or_later( context=context, symbol_table=nt_symbol_table diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 5b5b56ae3..5daa6cc79 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -319,7 +319,9 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Returns: The list of TCP endpoint objects from the `layer_name` layer's `PartitionTable` """ - if symbols.symbol_table_is_64bit(context, net_symbol_table): + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=net_symbol_table + ): alignment = 0x10 else: alignment = 8 diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index bae1160d6..151fe88c9 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -60,8 +60,8 @@ class Threads(thrdscan.ThrdScan): A generator of thread objects of orphaned threads """ collection = ssdt.SSDT.build_module_collection( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, ) kernel_space_start = modules.Modules.get_kernel_space_start( diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 555010ac9..270c6a174 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -803,7 +803,9 @@ class PESymbols(interfaces.plugins.PluginInterface): filter_modules_check = None session_layers = list( - modules.Modules.get_session_layers(context, kernel_module_name) + modules.Modules.get_session_layers( + context=context, kernel_module_name=kernel_module_name + ) ) # special handling for the kernel @@ -917,7 +919,9 @@ class PESymbols(interfaces.plugins.PluginInterface): Args: Generator[Tuple[interfaces.objects.ObjectInterface, str, ranges_type]]: Yields tuple of process objects, layers, and VADs mapping files """ - procs = pslist.PsList.list_processes(context, kernel_module_name) + procs = pslist.PsList.list_processes( + context=context, kernel_module_name=kernel_module_name + ) for proc in procs: try: diff --git a/volatility3/framework/plugins/windows/pedump.py b/volatility3/framework/plugins/windows/pedump.py index 5f2a1d737..9f125410c 100644 --- a/volatility3/framework/plugins/windows/pedump.py +++ b/volatility3/framework/plugins/windows/pedump.py @@ -161,7 +161,9 @@ class PEDump(interfaces.plugins.PluginInterface): """ Extracts a PE file from kernel memory at the given base address """ - session_layers = modules.Modules.get_session_layers(context, kernel_module_name) + session_layers = modules.Modules.get_session_layers( + context=context, kernel_module_name=kernel_module_name + ) session_layer_name = modules.Modules.find_session_layer( context, session_layers, base @@ -195,8 +197,7 @@ class PEDump(interfaces.plugins.PluginInterface): for proc in pslist.PsList.list_processes( context=context, - layer_name=kernel.layer_name, - symbol_table_name=kernel.symbol_table_name, + kernel_module_name=kernel.name, filter_func=filter_func, ): pid = proc.UniqueProcessId @@ -237,11 +238,11 @@ class PEDump(interfaces.plugins.PluginInterface): if self.config["kernel_module"]: pe_files = self.dump_kernel_pe_at_base( - self.context, - self.config["kernel"], - pe_table_name, - self.open, - self.config["base"], + context=self.context, + kernel_module_name=self.config["kernel"], + pe_table_name=pe_table_name, + open_method=self.open, + base=self.config["base"], ) else: filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 050a86c58..af19cd035 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -417,7 +417,9 @@ class PoolScanner(plugins.PluginInterface): if not is_windows_10: scan_layer = context.layers[scan_layer].config["memory_layer"] - if symbols.symbol_table_is_64bit(context, kernel_symbol_table_name): + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel_symbol_table_name + ): alignment = 0x10 else: alignment = 8 @@ -565,7 +567,9 @@ class PoolScanner(plugins.PluginInterface): except exceptions.SymbolError: # We have to manually load a symbol table - if symbols.symbol_table_is_64bit(context, symbol_table): + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ): is_win_7 = versions.is_windows_7(context, symbol_table) if is_win_7: pool_header_json_filename = "poolheader-x64-win7" diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index a0282e8c8..e41915442 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -119,8 +119,8 @@ class Privs(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index b94adee47..5bc6bc5a3 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -94,8 +94,8 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index d0cea43ff..24f7e2356 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -84,7 +84,9 @@ class PsTree(interfaces.plugins.PluginInterface): """Generates the Tree of processes.""" kernel = self.context.modules[self.config["kernel"]] - for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]): + for proc in pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ): if not self.config.get("physical", pslist.PsList.PHYSICAL_DEFAULT): offset = proc.vol.offset else: diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index f7df979a8..89ef897cb 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -182,7 +182,9 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter kernel = self.context.modules[self.config["kernel"]] kdbg_list_processes = list( - pslist.PsList.list_processes(self.context, self.config["kernel"]) + pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) ) # get processes from each source diff --git a/volatility3/framework/plugins/windows/registry/getcellroutine.py b/volatility3/framework/plugins/windows/registry/getcellroutine.py index 724ed1c9d..5be4254ba 100644 --- a/volatility3/framework/plugins/windows/registry/getcellroutine.py +++ b/volatility3/framework/plugins/windows/registry/getcellroutine.py @@ -37,13 +37,15 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): def _generator(self): collection = ssdt.SSDT.build_module_collection( - self.context, self.config["kernel"] + context=self.context, kernel_module_name=self.config["kernel"] ) # walk each hive and validate that the GetCellRoutine handler # is inside of the kernel (ntoskrnl) for hive_object in hivelist.HiveList.list_hives( - self.context, self.config_path, self.config["kernel"] + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], ): hive = hive_object.hive diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index 60ac0445e..fefd24b67 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -95,9 +95,9 @@ class HiveList(interfaces.plugins.PluginInterface): # Construct the hive hive = next( self.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=[hive_object.vol.offset], ) ) @@ -162,10 +162,10 @@ class HiveList(interfaces.plugins.PluginInterface): hive_offsets = [ hive.vol.offset for hive in cls.list_hive_objects( - context, - kernel.layer_name, - kernel.symbol_table_name, - filter_string, + context=context, + layer_name=kernel.layer_name, + symbol_table=kernel.symbol_table_name, + filter_string=filter_string, ) ] except ImportError: diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index 58ed63b4e..d91eeafc2 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -50,7 +50,9 @@ class HiveScan(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_name] - is_64bit = symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) is_windows_8_1_or_later = versions.is_windows_8_1_or_later( context=context, symbol_table=kernel.symbol_table_name ) diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index c14fcf507..71a54040c 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -245,9 +245,9 @@ class PrintKey(interfaces.plugins.PluginInterface): recurse: bool = False, ): for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], hive_offsets=hive_offsets, ): try: diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 0e5d3c90c..e2e1436a8 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -302,9 +302,9 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac # get all the user hive offsets or use the one specified for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], filter_string="ntuser.dat", hive_offsets=hive_offsets, ): diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 67b88d8fc..c437d8654 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -1140,9 +1140,11 @@ information about triggers, actions, run times, and creation times.""" """Retrieves the `Amcache.hve` registry hive from the kernel module, if it can be located.""" return next( hivelist.HiveList.list_hives( - context, - interfaces.configuration.path_join(config_path, "hivelist"), - kernel_module_name, + context=context, + base_config_path=interfaces.configuration.path_join( + config_path, "hivelist" + ), + kernel_module_name=kernel_module_name, filter_string="SOFTWARE", ), None, diff --git a/volatility3/framework/plugins/windows/sessions.py b/volatility3/framework/plugins/windows/sessions.py index 99a3cf335..73a537cd4 100644 --- a/volatility3/framework/plugins/windows/sessions.py +++ b/volatility3/framework/plugins/windows/sessions.py @@ -45,8 +45,8 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) sessions = {} for proc in pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ): session_id = proc.get_session_id() diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 46045087f..f26bf3d6b 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -93,7 +93,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf The name of the constructed shimcache table """ native_types = context.symbol_space[symbol_table_name].natives - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table_name + ) table_mapping = {"nt_symbols": symbol_table_name} try: @@ -260,7 +262,11 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf mod_page_offset, mod_page_size = mod_page addr_size = ( - 8 if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) else 4 + 8 + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) + else 4 ) shim_head = None @@ -322,7 +328,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf ).size ersrc_alignment = ( 0x20 - if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) else 0x10 # 0x20 if context.symbol_space.get_type("pointer").size == 8 else 0x10 ) @@ -420,7 +428,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf data_sec_offset + data_sec_size, ( 8 - if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) else 4 ), ): @@ -448,7 +458,9 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf # On Windows 8 x64, the first cache contains the shim cache. # On Windows 8 x86, 8.1 x86/x64, and 10, the second cache contains the shim cache. if ( - not symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) + not symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) and not is_8_1_or_later ): valid_head = shim_heads[1] diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index b57683f04..bd32d1987 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -568,7 +568,9 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): """ kernel = self.context.modules[self.config["kernel"]] - if not symbols.symbol_table_is_64bit(self.context, kernel.symbol_table_name): + if not symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=kernel.symbol_table_name + ): vollog.info("This plugin only supports 64bit Windows memory samples") return None @@ -670,8 +672,8 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=self._lsass_proc_filter, ) ), diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index 471dc9e18..ed7d1310d 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -83,8 +83,8 @@ class SSDT(plugins.PluginInterface): kernel = self.context.modules[self.config["kernel"]] collection = self.build_module_collection( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], ) ntkrnlmp = kernel @@ -101,7 +101,7 @@ class SSDT(plugins.PluginInterface): # on 64-bit systems the indexes are also 32-bits but they're offsets from the # base address of the table and can be negative, so we need a signed data type is_kernel_64 = symbols.symbol_table_is_64bit( - self.context, kernel.symbol_table_name + context=self.context, symbol_table_name=kernel.symbol_table_name ) if is_kernel_64: array_subtype = "long" diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index b5a2b7145..0ec07d719 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -73,8 +73,8 @@ class Strings(interfaces.plugins.PluginInterface): line = strings_fp.readline() revmap = self.generate_mapping( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], progress_callback=self._progress_callback, pid_list=self.config["pid"], ) @@ -161,9 +161,11 @@ class Strings(interfaces.plugins.PluginInterface): # TODO: Include kernel modules - for process in pslist.PsList.list_processes(context, kernel_module_name): + for process in pslist.PsList.list_processes( + context=context, kernel_module_name=kernel_module_name + ): if not filter(process): - proc_id = "Unknown" + kernel_module_name = proc_id = "Unknown" try: proc_id = process.UniqueProcessId proc_layer_name = process.add_process_layer() diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 2c3d584df..f83a201b5 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -61,7 +61,9 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): proc_modules = None # walk the threads of each process checking for suspended threads - for proc in pslist.PsList.list_processes(self.context, self.config["kernel"]): + for proc in pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ): for thread in threads.Threads.list_threads(kernel, proc): try: # we only care if the thread is suspended @@ -92,7 +94,9 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): # will not have suspended threads if not proc_modules: proc_modules = pe_symbols.PESymbols.get_process_modules( - self.context, self.config["kernel"], None + context=self.context, + kernel_module_name=self.config["kernel"], + filter_modules=None, ) path_and_symbol = functools.partial( diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index 938c6a940..41affcbc7 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -138,8 +138,8 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for proc in pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ): ranges = self._get_ranges(kernel, all_ranges, proc) diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py index ca9bcfb75..d2c3da3d3 100644 --- a/volatility3/framework/plugins/windows/svcdiff.py +++ b/volatility3/framework/plugins/windows/svcdiff.py @@ -65,7 +65,7 @@ class SvcDiff(svcscan.SvcScan): kernel = context.modules[kernel_module_name] if not symbols.symbol_table_is_64bit( - context, kernel.symbol_table_name + context=context, symbol_table_name=kernel.symbol_table_name ) or not versions.is_win10_15063_or_later( context=context, symbol_table=kernel.symbol_table_name ): diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index 00782c543..00d4aa647 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -70,7 +70,7 @@ class SvcList(svcscan.SvcScan): kernel = context.modules[kernel_module_name] if not symbols.symbol_table_is_64bit( - context, kernel.symbol_table_name + context=context, symbol_table_name=kernel.symbol_table_name ) or not versions.is_win10_15063_or_later( context=context, symbol_table=kernel.symbol_table_name ): @@ -80,8 +80,8 @@ class SvcList(svcscan.SvcScan): return for proc in pslist.PsList.list_processes( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): try: diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 602e7fbd5..653995f90 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -121,7 +121,9 @@ class SvcScan(interfaces.plugins.PluginInterface): A symbol table containing the symbols necessary for services """ native_types = context.symbol_space[symbol_table_name].natives - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table_name + ) try: symbol_filename = next( @@ -148,9 +150,11 @@ class SvcScan(interfaces.plugins.PluginInterface): ) -> Optional[objects.StructType]: for hive in hivelist.HiveList.list_hives( - context, - interfaces.configuration.path_join(config_path, "hivelist"), - kernel_module_name, + context=context, + base_config_path=interfaces.configuration.path_join( + config_path, "hivelist" + ), + kernel_module_name=kernel_module_name, filter_string="machine\\system", ): # Get ControlSet\Services. @@ -300,7 +304,7 @@ class SvcScan(interfaces.plugins.PluginInterface): for task in pslist.PsList.list_processes( context, - kernel_module_name, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): proc_id = "Unknown" diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 806caaa52..f6d542357 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -69,8 +69,8 @@ class Threads(thrdscan.ThrdScan): filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None)) for proc in pslist.PsList.list_processes( - context, - kernel_module_name, + context=context, + kernel_module_name=kernel_module_name, filter_func=filter_func, ): yield from cls.list_threads(module, proc) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index 4bf574143..d08bc59dd 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -124,8 +124,8 @@ class Timers(interfaces.plugins.PluginInterface): kernel = self.context.modules[self.config["kernel"]] collection = ssdt.SSDT.build_module_collection( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], ) # FIXME - the list_timers API is gross. Fix after GUI merge diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index c941ff768..8882ff46f 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -151,10 +151,10 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]: found_symbols = pe_symbols.PESymbols.addresses_for_process_symbols( - self.context, - self.config_path, - self.config["kernel"], - unhooked_system_calls.system_calls, + context=self.context, + config_path=self.config_path, + kernel_module_name=self.config["kernel"], + symbols=unhooked_system_calls.system_calls, ) # code_bytes[dll_name][func_name][func_bytes] diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index 178fe65c5..90ad0fdb5 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -52,7 +52,9 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt The name of the constructed unloaded modules table """ native_types = context.symbol_space[symbol_table].natives - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ) table_mapping = {"nt_symbols": symbol_table} if is_64bit: @@ -100,7 +102,9 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt offset=unloadedmodules_offset, subtype="array", ) - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) + is_64bit = symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ) if is_64bit: unloaded_count_type = "unsigned long long" diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 46afcaca8..2b1d3f4bc 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -292,8 +292,8 @@ class VadInfo(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 0d9b6a72e..5d2356f54 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -112,8 +112,8 @@ class VadRegExScan(plugins.PluginInterface): def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) procs = pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) return renderers.TreeGrid( diff --git a/volatility3/framework/plugins/windows/vadwalk.py b/volatility3/framework/plugins/windows/vadwalk.py index 0d6a8b245..cc8105e0c 100644 --- a/volatility3/framework/plugins/windows/vadwalk.py +++ b/volatility3/framework/plugins/windows/vadwalk.py @@ -83,8 +83,8 @@ class VadWalk(interfaces.plugins.PluginInterface): ], self._generator( pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ) ), diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 2dd2dec26..a19206e22 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -60,8 +60,8 @@ class VadYaraScan(interfaces.plugins.PluginInterface): sanity_check = 1024 * 1024 * 1024 # 1 GB for task in pslist.PsList.list_processes( - self.context, - self.config["kernel"], + context=self.context, + kernel_module_name=self.config["kernel"], filter_func=filter_func, ): layer_name = task.add_process_layer() diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 63a0d9ece..fa7d4e113 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -253,13 +253,15 @@ class VerInfo(interfaces.plugins.PluginInterface): ) def run(self): - procs = pslist.PsList.list_processes(self.context, self.config["kernel"]) + procs = pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) mods = modules.Modules.list_modules(self.context, self.config["kernel"]) # populate the session layers for kernel modules session_layers = modules.Modules.get_session_layers( - self.context, self.config["kernel"] + context=self.context, kernel_module_name=self.config["kernel"] ) return renderers.TreeGrid( diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index 6dac484f5..b9c6932f9 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -67,7 +67,9 @@ class WindowStations(interfaces.plugins.PluginInterface): native_types = intermed.native.x64NativeTable - if not symbols.symbol_table_is_64bit(context, symbol_table): + if not symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ): raise NotImplementedError( "This plugin only supports x64 versions of Windows" ) @@ -86,10 +88,10 @@ class WindowStations(interfaces.plugins.PluginInterface): vollog.debug(f"Using GUI table {symbol_filename}") return intermed.IntermediateSymbolTable.create( - context, - config_path, - os.path.join("windows", "gui"), - symbol_filename, + context=context, + config_path=config_path, + sub_path=os.path.join("windows", "gui"), + filename=symbol_filename, class_types=gui.class_types, native_types=native_types, table_mapping=table_mapping, @@ -152,11 +154,11 @@ class WindowStations(interfaces.plugins.PluginInterface): session_map = cls.get_session_map(context, kernel_module_name, gui_table_name) for result in poolscanner.PoolScanner.generate_pool_scan_extended( - context, - kernel.layer_name, - kernel.symbol_table_name, - gui_table_name, - constraints, + context=context, + kernel_layer_name=kernel.layer_name, + kernel_symbol_table_name=kernel.symbol_table_name, + object_symbol_table_name=gui_table_name, + constraints=constraints, ): _constraint, mem_object, _header = result diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index d5528a8b5..39605cf52 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -237,7 +237,9 @@ class module(generic.GenericIntelProcess): elf_table_name = self.get_elf_table_name() symbol_table_name = self.get_symbol_table_name() - is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ) sym_name = "Elf64_Sym" if is_64bit else "Elf32_Sym" sym_type = self._context.symbol_space.get_type( elf_table_name + constants.BANG + sym_name @@ -280,7 +282,9 @@ class module(generic.GenericIntelProcess): elf_table_name = self.get_elf_table_name() symbol_table_name = self.get_symbol_table_name() - is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ) sym_name = "Elf64_Sym" if is_64bit else "Elf32_Sym" sym_type = self._context.symbol_space.get_type( elf_table_name + constants.BANG + sym_name diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index e852de0da..933178c91 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -53,7 +53,9 @@ class MMVAD_SHORT(objects.StructType): # the offset is different on 32 and 64 bits symbol_table_name = self.vol.type_name.split(constants.BANG)[0] - if not symbols.symbol_table_is_64bit(self._context, symbol_table_name): + if not symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ): vad_address -= 4 else: vad_address -= 12 @@ -389,7 +391,9 @@ class EX_FAST_REF(objects.StructType): # the mask value is different on 32 and 64 bits symbol_table_name = self.vol.type_name.split(constants.BANG)[0] - if not symbols.symbol_table_is_64bit(self._context, symbol_table_name): + if not symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ): max_fast_ref = 7 else: max_fast_ref = 15 @@ -1406,7 +1410,9 @@ class CONTROL_AREA(objects.StructType): ) mmpte_size = mmpte_type.size subsection = self.get_subsection() - is_64bit = symbols.symbol_table_is_64bit(self._context, symbol_table_name) + is_64bit = symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ) is_pae = self._context.layers[self.vol.layer_name].metadata.get("pae", False) # the sector_size is used as a multiplier to the StartingSector diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index 5427e3773..b0c480d19 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -78,7 +78,9 @@ class POOL_HEADER(objects.StructType): # otherwise we have an executive object in the pool else: - if symbols.symbol_table_is_64bit(self._context, symbol_table_name): + if symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=symbol_table_name + ): alignment = 16 else: alignment = 8 diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index 3cbeb3e7c..eea05548b 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -70,9 +70,9 @@ class Certificates(interfaces.plugins.PluginInterface): def _generator(self) -> Iterator[Tuple[int, Tuple[str, str, str, str]]]: for hive in hivelist.HiveList.list_hives( - self.context, - self.config_path, - self.config["kernel"], + context=self.context, + base_config_path=self.config_path, + kernel_module_name=self.config["kernel"], ): for top_key in [ "Microsoft\\SystemCertificates", From 7964ca07e401b75d17ccd87d6022388eb0d38d7b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 17:34:36 -0600 Subject: [PATCH 0700/1352] Code Review: PluginRequirement -> VersionRequirement Code Review: PluginRequirement -> Version Requirement --- .../framework/plugins/windows/debugregisters.py | 4 ++-- .../framework/plugins/windows/suspicious_threads.py | 12 ++++++------ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index d1404b69f..0f6655c78 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -37,8 +37,8 @@ class DebugRegisters(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="threads", plugin=threads.Threads, version=(2, 0, 0) + requirements.VersionRequirement( + name="threads", component=threads.Threads, version=(2, 0, 0) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index 41affcbc7..f83f3efc9 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -34,14 +34,14 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): element_type=int, optional=True, ), - requirements.PluginRequirement( - name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) + requirements.VersionRequirement( + name="thrdscan", component=thrdscan.ThrdScan, version=(1, 1, 0) ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="threads", plugin=threads.Threads, version=(2, 0, 0) + requirements.VersionRequirement( + name="threads", component=threads.Threads, version=(2, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) From 456d7b7db5e6ec34b83e05aeb58877a76ae844ea Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 18:14:53 -0600 Subject: [PATCH 0701/1352] CodeQL Fix: Unused variable Also underscores an unused unpacked tuple value --- volatility3/framework/plugins/windows/strings.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index 0ec07d719..46784e48a 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -165,7 +165,7 @@ class Strings(interfaces.plugins.PluginInterface): context=context, kernel_module_name=kernel_module_name ): if not filter(process): - kernel_module_name = proc_id = "Unknown" + proc_id = "Unknown" try: proc_id = process.UniqueProcessId proc_layer_name = process.add_process_layer() @@ -180,7 +180,7 @@ class Strings(interfaces.plugins.PluginInterface): for mapval in proc_layer.mapping( 0x0, proc_layer.maximum_address, ignore_errors=True ): - mapped_offset, _, offset, mapped_size, maplayer = mapval + mapped_offset, _, offset, mapped_size, _maplayer = mapval for val in range( mapped_offset, mapped_offset + mapped_size, 0x1000 ): From a192546eb055029f068d6da73a5b69033f84d519 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 19:02:17 -0600 Subject: [PATCH 0702/1352] Framework: Minor version bump There are a lot of things going into this so we're doing a minor framework version bump. --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 255b8fc3d..aa8e8936f 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 22 # Number of changes that only add to the interface +VERSION_MINOR = 23 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From 76cceb93cb585e2ca2d16f22fea02b719f924eea Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 19:25:43 -0600 Subject: [PATCH 0703/1352] Code Review: Get rid of 'kvo' in favor of kernel.offset --- volatility3/framework/plugins/windows/modules.py | 6 +----- volatility3/framework/plugins/windows/pslist.py | 6 +----- 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 6ec16af1b..e1a0f4cf1 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -322,11 +322,7 @@ class Modules(interfaces.plugins.PluginInterface): """ kernel = context.modules[kernel_module_name] - - kvo = context.layers[kernel.layer_name].config.get( - "kernel_virtual_offset", None - ) - if not kvo: + if not kernel.offset: raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 7909945a1..2fc7612a9 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -228,11 +228,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kernel = context.modules[kernel_module_name] - # We only use the object factory to demonstrate how to use one - kvo = context.layers[kernel.layer_name].config.get( - "kernel_virtual_offset", None - ) - if not kvo: + if not kernel.offset: raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) From 77d6bf25b079223e8aa017a8aa938bb2573b9a2d Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 17:55:18 -0600 Subject: [PATCH 0704/1352] Code Review: Remove redundant kernel module reconstruction --- volatility3/framework/plugins/windows/modules.py | 13 +++++-------- volatility3/framework/plugins/windows/pslist.py | 11 ++++------- 2 files changed, 9 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index e1a0f4cf1..1ec965737 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -326,22 +326,19 @@ class Modules(interfaces.plugins.PluginInterface): raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) - ntkrnlmp = context.module( - kernel.symbol_table_name, layer_name=kernel.layer_name, offset=kvo - ) try: # use this type if its available (starting with windows 10) - ldr_entry_type = ntkrnlmp.get_type("_KLDR_DATA_TABLE_ENTRY") + ldr_entry_type = kernel.get_type("_KLDR_DATA_TABLE_ENTRY") except exceptions.SymbolError: - ldr_entry_type = ntkrnlmp.get_type("_LDR_DATA_TABLE_ENTRY") + ldr_entry_type = kernel.get_type("_LDR_DATA_TABLE_ENTRY") type_name = ldr_entry_type.type_name.split(constants.BANG)[1] - list_head = ntkrnlmp.get_symbol("PsLoadedModuleList").address - list_entry = ntkrnlmp.object(object_type="_LIST_ENTRY", offset=list_head) + list_head = kernel.get_symbol("PsLoadedModuleList").address + list_entry = kernel.object(object_type="_LIST_ENTRY", offset=list_head) reloff = ldr_entry_type.relative_child_offset("InLoadOrderLinks") - module = ntkrnlmp.object( + module = kernel.object( object_type=type_name, offset=list_entry.vol.offset - reloff, absolute=True ) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 2fc7612a9..1cb2c6356 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -232,12 +232,9 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): raise ValueError( "Intel layer does not have an associated kernel virtual offset, failing" ) - ntkrnlmp = context.module( - kernel.symbol_table_name, layer_name=kernel.layer_name, offset=kvo - ) - ps_aph_offset = ntkrnlmp.get_symbol("PsActiveProcessHead").address - list_entry = ntkrnlmp.object(object_type="_LIST_ENTRY", offset=ps_aph_offset) + ps_aph_offset = kernel.get_symbol("PsActiveProcessHead").address + list_entry = kernel.object(object_type="_LIST_ENTRY", offset=ps_aph_offset) # This is example code to demonstrate how to use symbol_space directly, rather than through a module: # @@ -250,10 +247,10 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Note: "nt_symbols!_EPROCESS" could have been used, but would rely on the "nt_symbols" symbol table not already # having been present. Strictly, the value of the requirement should be joined with the BANG character # defined in the constants file - reloff = ntkrnlmp.get_type("_EPROCESS").relative_child_offset( + reloff = kernel.get_type("_EPROCESS").relative_child_offset( "ActiveProcessLinks" ) - eproc = ntkrnlmp.object( + eproc = kernel.object( object_type="_EPROCESS", offset=list_entry.vol.offset - reloff, absolute=True, From e8ec7b1bf75d19b4629f29a9cc32c83d5ff959d0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Feb 2025 20:16:25 -0600 Subject: [PATCH 0705/1352] Code Review: Remove unneeded kernel module reconstruction --- .../framework/plugins/windows/handles.py | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 4d21cc9d9..6ab465439 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -223,24 +223,17 @@ class Handles(interfaces.plugins.PluginInterface): kernel = self.context.modules[self.config["kernel"]] - virtual = kernel.layer_name - kvo = kernel.offset - - ntkrnlmp = self.context.module( - kernel.symbol_table_name, layer_name=virtual, offset=kvo - ) - if level > 0: - subtype = ntkrnlmp.get_type("pointer") + subtype = kernel.get_type("pointer") count = 0x1000 / subtype.size else: - subtype = ntkrnlmp.get_type("_HANDLE_TABLE_ENTRY") + subtype = kernel.get_type("_HANDLE_TABLE_ENTRY") count = 0x1000 / subtype.size - if not self.context.layers[virtual].is_valid(offset): + if not self.context.layers[kernel.layer_name].is_valid(offset): return None - table = ntkrnlmp.object( + table = kernel.object( object_type="array", offset=offset, subtype=subtype, @@ -248,7 +241,7 @@ class Handles(interfaces.plugins.PluginInterface): absolute=True, ) - layer_object = self.context.layers[virtual] + layer_object = self.context.layers[kernel.layer_name] masked_offset = offset & layer_object.maximum_address for i in range(len(table)): @@ -262,7 +255,7 @@ class Handles(interfaces.plugins.PluginInterface): # The code above this calls `is_valid` on the `offset` # It is sent but then does not validate `entry` before # sending it to `_get_item` - if not self.context.layers[virtual].is_valid(entry.vol.offset): + if not self.context.layers[kernel.layer_name].is_valid(entry.vol.offset): continue if level > 0: From dc53afb217b59c704ed4fba96162660282ae391d Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 5 Mar 2025 16:25:53 -0600 Subject: [PATCH 0706/1352] Code Review: Don't use to-be-deprecated static natives This was originally done to solve a problem where `f32` wasn't available in the native types from every kernel version. However, it ended up not being necessary - we can just omit `native_types` from the method call, and it will construct the types as-needed using the definition for `float` in `base_types` from the JSON files. --- volatility3/framework/plugins/windows/windowstations.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index b9c6932f9..a077ef2fc 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -65,8 +65,6 @@ class WindowStations(interfaces.plugins.PluginInterface): The name of the constructed GUI table """ - native_types = intermed.native.x64NativeTable - if not symbols.symbol_table_is_64bit( context=context, symbol_table_name=symbol_table ): @@ -93,7 +91,6 @@ class WindowStations(interfaces.plugins.PluginInterface): sub_path=os.path.join("windows", "gui"), filename=symbol_filename, class_types=gui.class_types, - native_types=native_types, table_mapping=table_mapping, ) From 7e00f2c4c409bcdb08b20dc89e8b8b501ee14e02 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 5 Mar 2025 17:42:09 -0600 Subject: [PATCH 0707/1352] Windows Versions: Fix broken OSDistinguisher Something happened when picking _EPROCESS members before that caused this to not function properly. This one relies on a more stable type removal instead of _EPROCESS members. --- volatility3/framework/symbols/windows/versions.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py index b00892cbc..28b7edfdf 100644 --- a/volatility3/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -152,8 +152,8 @@ is_win10 = OsDistinguisher( is_win10_10586_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 10586), fallback_checks=[ - ("_EPROCESS", "SecurityDomain", False), - ("_EPROCESS", "ImageFilePointer", False), + ("_UNLOADED_DRIVERS", None, False), + ("ObHeaderCookie", None, True), ], ) From 557b200f0749b2c08d78c7a21a4bb2d26990a46d Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 6 Mar 2025 17:36:24 +0000 Subject: [PATCH 0708/1352] Fix several bugs found in the tracing plugins during mass testing --- .../framework/plugins/linux/tracing/ftrace.py | 11 ++++--- .../plugins/linux/tracing/tracepoints.py | 32 +++++++++++++------ 2 files changed, 29 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 6690769b7..02b5a61f1 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -114,21 +114,24 @@ class CheckFtrace(interfaces.plugins.PluginInterface): An iterable of ftrace_func_entry structs """ + if hasattr(ftrace_ops, "func_hash"): + ftrace_hash = ftrace_ops.func_hash.filter_hash + else: + ftrace_hash = ftrace_ops.filter_hash + try: - current_bucket_ptr = ftrace_ops.func_hash.filter_hash.buckets.first + current_bucket_ptr = ftrace_hash.buckets.first except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VV, f"ftrace_func_entry list of ftrace_ops@{ftrace_ops.vol.offset:#x} is empty/invalid. Skipping it...", ) - return [] + return while current_bucket_ptr.is_readable(): yield current_bucket_ptr.dereference().cast("ftrace_func_entry") current_bucket_ptr = current_bucket_ptr.next - return None - @classmethod def parse_ftrace_ops( cls, diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 247e139d5..4af80b545 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -10,7 +10,7 @@ from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.plugins.linux import hidden_modules, modxview -from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, NotAvailableValue, TreeGrid from volatility3.framework.symbols.linux import extensions @@ -116,18 +116,25 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): known_modules: A dict of known modules, used to locate callbacks origin. Typically obtained through modxview.run_modules_scanners(). tracepoint: The tracepoint struct to parse run_hidden_modules: Whether to run the hidden_modules plugin or not. Note: it won't be run, even if specified, \ -if the "hidden_modules" key is present in known_modules. + if the "hidden_modules" key is present in known_modules. Yields: An iterable of ParsedTracepointFunc dataclasses, containing a selection of useful fields related to a tracepoint struct """ - kernel = context.modules[kernel_name] kernel_layer = context.layers[kernel.layer_name] for tracepoint_func in cls.iterate_tracepoint_funcs( context, kernel_layer.name, tracepoint ): + try: + tracepoint_name = utility.pointer_to_string(tracepoint.name, count=512) + except exceptions.InvalidAddressException: + vollog.debug( + f"Tracepoint function at {tracepoint.vol.offset:#x} is smeared." + ) + continue + probe_handler_address = tracepoint_func.func probe_handler_symbol = module_address = module_name = None @@ -183,16 +190,21 @@ if the "hidden_modules" key is present in known_modules. probe_handler_address ) else: - vollog.warning( + vollog.debug( f"Could not determine tracepoint@{tracepoint.vol.offset:#x} probe handler {probe_handler_address:#x} module origin.", ) + if hasattr(tracepoint_func, "prio"): + prio = tracepoint_func.prio + else: + prio = renderers.NotAvailableValue() + yield ParsedTracepointFunc( - utility.pointer_to_string(tracepoint.name, count=512), + tracepoint_name, tracepoint.vol.offset, probe_handler_symbol, probe_handler_address, - tracepoint_func.prio, + prio, module_name, module_address, ) @@ -258,11 +270,11 @@ if the "hidden_modules" key is present in known_modules. kernel_layer = self.context.layers[kernel.layer_name] if not kernel.has_symbol("__start___tracepoints_ptrs"): - raise exceptions.SymbolError( - "__start___tracepoints_ptrs", - self.vmlinux.symbol_table_name, - 'The provided symbol table does not include the "__start___tracepoints_ptrs" symbol. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupted.', + vollog.error( + 'The provided symbol table does not include the "__start___tracepoints_ptrs" symbol.' + "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupted." ) + return known_modules = modxview.Modxview.run_modules_scanners( self.context, kernel_name, run_hidden_modules=False From 14778cdf5c75b9fe10a28af2fa60c7ff5efe793f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 6 Mar 2025 18:10:38 +0000 Subject: [PATCH 0709/1352] Address feedback --- .../framework/plugins/linux/tracing/ftrace.py | 14 ++++++-------- .../framework/plugins/linux/tracing/tracepoints.py | 6 +++--- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 02b5a61f1..59168d5bc 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -5,7 +5,7 @@ # Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf import logging -from typing import Dict, List, Iterable, Optional +from typing import Dict, List, Generator from enum import Enum from dataclasses import dataclass @@ -67,7 +67,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged to hook kernel functions and modify their behaviour.""" - _version = (1, 0, 0) + _version = (2, 0, 0) _required_framework_version = (2, 19, 0) @classmethod @@ -103,14 +103,14 @@ class CheckFtrace(interfaces.plugins.PluginInterface): def extract_hash_table_filters( cls, ftrace_ops: interfaces.objects.ObjectInterface, - ) -> Optional[Iterable[interfaces.objects.ObjectInterface]]: + ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Wrap the process of walking to every ftrace_func_entry of an ftrace_ops. Those are stored in a hash table of filters that indicates the addresses hooked. Args: ftrace_ops: The ftrace_ops struct to walk through - Returns: + Return, None, None: An iterable of ftrace_func_entry structs """ @@ -140,7 +140,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): known_modules: Dict[str, List[extensions.module]], ftrace_ops: interfaces.objects.ObjectInterface, run_hidden_modules: bool = True, - ) -> Optional[Iterable[ParsedFtraceOps]]: + ) -> Generator[ParsedFtraceOps, None, None]: """Parse an ftrace_ops struct to highlight ftrace kernel hooking. Iterates over embedded ftrace_func_entry entries, which point to hooked memory areas. @@ -237,12 +237,10 @@ if the "hidden_modules" key is present in known_modules. formatted_ftrace_flags, ) - return None - @classmethod def iterate_ftrace_ops_list( cls, context: interfaces.context.ContextInterface, kernel_name: str - ) -> Optional[Iterable[interfaces.objects.ObjectInterface]]: + ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Iterate over (ftrace_ops *)ftrace_ops_list. Returns: diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 4af80b545..f8edcc5b7 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -10,7 +10,7 @@ from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.plugins.linux import hidden_modules, modxview -from volatility3.framework import constants, exceptions, interfaces, renderers +from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, NotAvailableValue, TreeGrid from volatility3.framework.symbols.linux import extensions @@ -197,7 +197,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): if hasattr(tracepoint_func, "prio"): prio = tracepoint_func.prio else: - prio = renderers.NotAvailableValue() + prio = None yield ParsedTracepointFunc( tracepoint_name, @@ -293,7 +293,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): format_hints.Hex(tracepoint_parsed.tracepoint_address), tracepoint_parsed.probe_name or NotAvailableValue(), format_hints.Hex(tracepoint_parsed.probe_address), - tracepoint_parsed.probe_priority, + tracepoint_parsed.probe_priority or NotAvailableValue(), tracepoint_parsed.module_name or NotAvailableValue(), ( format_hints.Hex(tracepoint_parsed.module_address) From 134a3bc6862939e1901bf493dd744a04b8ca3c4d Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 6 Mar 2025 15:19:23 -0600 Subject: [PATCH 0710/1352] Pdbconv: Make symbol server URL constant This removes the hard-coded symbol server URL from `PdbRetreiver.retrieve_pdb` and defines it as a constant within the `constants` module. --- volatility3/framework/constants/__init__.py | 2 ++ volatility3/framework/symbols/windows/pdbconv.py | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/constants/__init__.py b/volatility3/framework/constants/__init__.py index 429b79c3c..689ef122b 100644 --- a/volatility3/framework/constants/__init__.py +++ b/volatility3/framework/constants/__init__.py @@ -40,6 +40,8 @@ SYMBOL_BASEPATHS = [ ISF_EXTENSIONS = [".json", ".json.xz", ".json.gz", ".json.bz2"] """List of accepted extensions for ISF files""" +SYMBOL_SERVER_URL = "http://msdl.microsoft.com/download/symbols" + if hasattr(sys, "frozen") and sys.frozen: # Ensure we include the executable's directory as the base for plugins and symbols PLUGINS_PATH = [ diff --git a/volatility3/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py index 248ef7d0c..c23ffb350 100644 --- a/volatility3/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -950,7 +950,7 @@ class PdbRetreiver: ) -> Optional[str]: vollog.info("Download PDB file...") file_name = ".".join(file_name.split(".")[:-1] + ["pdb"]) - for sym_url in ["http://msdl.microsoft.com/download/symbols"]: + for sym_url in [constants.SYMBOL_SERVER_URL]: url = sym_url + f"/{file_name}/{guid}/" result = None From aac0566c903af72cbc81a423d67b2ca94c2ba659 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 03:17:52 +0000 Subject: [PATCH 0711/1352] Change the type information reported for missing attributes --- volatility3/framework/interfaces/objects.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 12cd1d988..62c31481b 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -133,7 +133,7 @@ class ObjectInterface(metaclass=abc.ABCMeta): def __getattr__(self, attr: str) -> Any: """Method for ensuring volatility members can be returned.""" - raise AttributeError(f"Unable to find {attr} for type {self.vol.type_name}") + raise AttributeError(f"Unable to find {attr} for type {type(self)}") @property def vol(self) -> ReadOnlyMapping: From bb3b0ada5c2dbd590414e02cb9a0972f45d36c6e Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 03:42:32 +0000 Subject: [PATCH 0712/1352] Fix how the task name is reported in getsids error path --- volatility3/framework/plugins/windows/getsids.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 710b98bb6..12b16bebc 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -176,12 +176,14 @@ class GetSIDs(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: token = False + task_name = objects.utility.array_to_string(task.ImageFileName) + if not token or not isinstance(token, interfaces.objects.ObjectInterface): yield ( 0, [ int(task.UniqueProcessId), - str(task.ImageFileName), + task_name, "Token unreadable", "", ], @@ -207,7 +209,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): 0, ( task.UniqueProcessId, - objects.utility.array_to_string(task.ImageFileName), + task_name, sid_string, sid_name, ), From f6aa6d87e84fc593ad22fe0653bf60750ae8a1f5 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 04:19:28 +0000 Subject: [PATCH 0713/1352] Add --tmpfs-only flag to RecoverFs to replace tmpfs plugin of Volatility 2 --- .../framework/plugins/linux/pagecache.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 7a1cf2506..3d2db7fd7 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -639,7 +639,7 @@ class RecoverFs(plugins.PluginInterface): Troubleshooting: to fix extraction errors related to long paths, please consider using https://github.com/mxmlnkn/ratarmount. """ - _version = (1, 0, 0) + _version = (1, 0, 1) _required_framework_version = (2, 21, 0) @classmethod @@ -656,6 +656,12 @@ class RecoverFs(plugins.PluginInterface): requirements.PluginRequirement( name="inodepages", plugin=InodePages, version=(3, 0, 0) ), + requirements.BooleanRequirement( + name="tmpfs_only", + description="Extracts only files from tmpfs file systems", + default=False, + optional=True, + ), requirements.ChoiceRequirement( name="compression_format", description="Compression format (default: gz)", @@ -805,6 +811,17 @@ class RecoverFs(plugins.PluginInterface): ) continue + sb_type = inode_in.superblock.get_type() + if not sb_type: + vollog.debug( + f"Unable to read superblock type for inode at {inode_in.inode.vol.offset}" + ) + continue + + if self.config["tmpfs_only"] and sb_type != "tmpfs": + vollog.debug(f"Skipping non-tmpfs filesystem {sb_type}") + continue + # Construct the output path if uuid_as_prefix: prefix = f"/{inode_in.superblock.uuid}" From 45fe8f69ddb96af065a84074b2848b0486191fd4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 05:05:23 +0000 Subject: [PATCH 0714/1352] Fix unloaded modules bugs. Change API to fit current formats --- .../plugins/windows/unloadedmodules.py | 87 ++++++++++++------- 1 file changed, 58 insertions(+), 29 deletions(-) diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index 90ad0fdb5..cadacf4ff 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -4,7 +4,7 @@ import logging import datetime -from typing import List, Iterable +from typing import List, Generator, Tuple from volatility3.framework import constants from volatility3.framework import interfaces, symbols, exceptions @@ -14,6 +14,7 @@ from volatility3.framework.interfaces import configuration from volatility3.framework.renderers import format_hints, conversion from volatility3.framework.symbols import intermed from volatility3.plugins import timeliner +from volatility3.plugins.windows import modules vollog = logging.getLogger(__name__) @@ -22,7 +23,7 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt """Lists the unloaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 2) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -75,10 +76,9 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt def list_unloadedmodules( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, unloadedmodule_table_name: str, - ) -> Iterable[interfaces.objects.ObjectInterface]: + ) -> Generator[Tuple[str, int, int, datetime.datetime], None, None]: """Lists all the unloaded modules in the primary layer. Args: @@ -90,12 +90,8 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt A list of Unloaded Modules as retrieved from MmUnloadedDrivers """ - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] + unloadedmodules_offset = ntkrnlmp.get_symbol("MmUnloadedDrivers").address unloadedmodules = ntkrnlmp.object( object_type="pointer", @@ -103,7 +99,7 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt subtype="array", ) is_64bit = symbols.symbol_table_is_64bit( - context=context, symbol_table_name=symbol_table + context=context, symbol_table_name=ntkrnlmp.symbol_table_name ) if is_64bit: @@ -116,53 +112,86 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt object_type=unloaded_count_type, offset=last_unloadedmodule_offset ) + # Bring down to default when smear present. Some samples had this completely broken + if unloaded_count > 1024: + vollog.warning( + f"Smeared array count found {unloaded_count}. Defaulting to 1024 elements." + ) + unloaded_count = 1024 + unloadedmodules_array = context.object( object_type=unloadedmodule_table_name + constants.BANG + "_UNLOADED_DRIVERS", - layer_name=layer_name, + layer_name=ntkrnlmp.layer_name, offset=unloadedmodules, ) unloadedmodules_array.UnloadedDrivers.count = unloaded_count + kernel_space_start = modules.Modules.get_kernel_space_start( + context, kernel_module_name + ) + + address_mask = context.layers[ntkrnlmp.layer_name].address_mask + for driver in unloadedmodules_array.UnloadedDrivers: # Mass testing led to dozens of samples backtracing on this plugin when # accessing members of modules coming out this list # Given how often temporary drivers load and unload on Win10+, I # assume the chance for smear is very high try: - driver.StartAddress - driver.EndAddress - driver.CurrentTime - yield driver + start_address = driver.StartAddress & address_mask + end_address = driver.EndAddress & address_mask + current_time = driver.CurrentTime + driver_name = driver.Name.String except exceptions.InvalidAddressException: continue + if ( + current_time > 1024 + and start_address > kernel_space_start + and start_address & 0xFFF == 0x0 + and end_address & 0xFFF == 0x0 + and end_address > kernel_space_start + ): + yield driver_name, start_address, end_address, current_time + def _generator(self): kernel = self.context.modules[self.config["kernel"]] + if not kernel.has_symbol("MmUnloadedDrivers"): + vollog.error( + "The symbol table for this sample is missing the `MmUnloadedDrivers` symbol. Cannot proceed." + ) + return + + if not kernel.has_symbol("MmLastUnloadedDriver"): + vollog.error( + "The symbol table for this sample is missing the `MmLastUnloadededDriver` symbol. Cannot proceed." + ) + return + unloadedmodule_table_name = self.create_unloadedmodules_table( self.context, kernel.symbol_table_name, self.config_path ) - for mod in self.list_unloadedmodules( + for ( + driver_name, + start_address, + end_address, + current_time, + ) in self.list_unloadedmodules( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], unloadedmodule_table_name, ): - try: - name = mod.Name.String - except exceptions.InvalidAddressException: - name = renderers.UnreadableValue() - yield ( 0, ( - name, - format_hints.Hex(mod.StartAddress), - format_hints.Hex(mod.EndAddress), - conversion.wintime_to_datetime(mod.CurrentTime), + driver_name, + format_hints.Hex(start_address), + format_hints.Hex(end_address), + conversion.wintime_to_datetime(current_time), ), ) From 460f1307ac19748c8f018624a057773ebd594637 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 7 Mar 2025 16:43:44 +0100 Subject: [PATCH 0715/1352] improve secret readability --- volatility3/framework/plugins/windows/lsadump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 50f4da30d..22a1a62e1 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -204,7 +204,7 @@ class Lsadump(interfaces.plugins.PluginInterface): else: secret = self.decrypt_aes(enc_secret, lsakey) - yield (0, (key.get_name(), secret.decode("latin1"), secret)) + yield (0, (key.get_name(), str(secret), secret)) def run(self): offset = self.config.get("offset", None) From f0235279a91287af60af165ef97beee520346028 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 7 Mar 2025 16:44:07 +0100 Subject: [PATCH 0716/1352] Bump: 1.0.0->1.0.1 --- volatility3/framework/plugins/windows/lsadump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 22a1a62e1..051e55afe 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -22,7 +22,7 @@ class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): From e8db2f03bb5eddf5e7b15d9c282f4802fa6ccbb8 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 1 Mar 2025 10:31:47 -0600 Subject: [PATCH 0717/1352] Add complete smear protection to linux.pstree --- volatility3/framework/plugins/linux/pstree.py | 39 +++++++++++++++++-- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index fd28fcbbd..dc4fef4f3 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -52,19 +52,38 @@ class PsTree(interfaces.plugins.PluginInterface): Args: pid: PID to find the level in the hierarchy """ - seen = set([pid]) + seen_ppids = set() + seen_offsets = set() + level = 0 proc = self._tasks.get(pid) - while proc and proc.get_parent_pid() not in seen: + + while proc: + # we don't want swapper in the tree + if proc.pid == 0: + break + if proc.is_thread_group_leader: parent_pid = proc.get_parent_pid() else: parent_pid = proc.tgid + if parent_pid in seen_ppids or proc.vol.offset in seen_offsets: + break + + # only pid 1 (init/systemd) or 2 (kthreadd) should have swapper as a parent + # any other process with a ppid of 0 is smeared or terminated + if parent_pid == 0 and proc.pid > 2: + break + + seen_ppids.add(parent_pid) + seen_offsets.add(proc.vol.offset) + child_list = self._children.setdefault(parent_pid, set()) child_list.add(proc.pid) proc = self._tasks.get(parent_pid) + level += 1 self._levels[pid] = level @@ -110,12 +129,26 @@ class PsTree(interfaces.plugins.PluginInterface): ) yield (self._levels[task_fields.user_tid] - 1, fields) + seen_children = set() + for child_pid in sorted(self._children.get(task_fields.user_tid, [])): + if child_pid in seen_children: + break + seen_children.add(child_pid) + yield from yield_processes(child_pid) + seen_processes = set() + for pid, level in self._levels.items(): if level == 1: - yield from yield_processes(pid) + for fields in yield_processes(pid): + pid = fields[1] + if pid in seen_processes: + break + seen_processes.add(pid) + + yield fields def run(self): filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) From 1daf62ab4e68d860e33ea8b8ef59bad32799a6fb Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 17:18:45 +0000 Subject: [PATCH 0718/1352] Add debug statement when a process is skipped --- volatility3/framework/plugins/linux/pstree.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index dc4fef4f3..c5290774b 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -2,11 +2,15 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging + from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.linux import pslist +vollog = logging.getLogger(__name__) + class PsTree(interfaces.plugins.PluginInterface): """Plugin for listing processes in a tree based on their parent process ID.""" @@ -74,6 +78,9 @@ class PsTree(interfaces.plugins.PluginInterface): # only pid 1 (init/systemd) or 2 (kthreadd) should have swapper as a parent # any other process with a ppid of 0 is smeared or terminated if parent_pid == 0 and proc.pid > 2: + vollog.debug( + "Smeared process with parent PID of 0 and PID greater than 2 ({proc.pid}) is being skipped." + ) break seen_ppids.add(parent_pid) From 9e01666319b5d4168f5623678e5ef58e9d187117 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 18:24:53 +0000 Subject: [PATCH 0719/1352] Fix timers and kpcrs bugs, missing smear checks, and API. Closes #1642 --- .../framework/plugins/windows/kpcrs.py | 58 +++++++++++-------- .../framework/plugins/windows/timers.py | 36 +++++------- 2 files changed, 49 insertions(+), 45 deletions(-) diff --git a/volatility3/framework/plugins/windows/kpcrs.py b/volatility3/framework/plugins/windows/kpcrs.py index 558ea844c..213e3833c 100644 --- a/volatility3/framework/plugins/windows/kpcrs.py +++ b/volatility3/framework/plugins/windows/kpcrs.py @@ -4,7 +4,7 @@ import logging -from typing import Iterator, List, Tuple +from typing import Iterator, Generator, List, Tuple from volatility3.framework import ( renderers, @@ -22,7 +22,7 @@ class KPCRs(interfaces.plugins.PluginInterface): """Print KPCR structure for each processor""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -39,60 +39,70 @@ class KPCRs(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, kernel_module_name: str, - layer_name: str, - symbol_table: str, - ) -> interfaces.objects.ObjectInterface: + ) -> Generator[Tuple[interfaces.objects.ObjectInterface, int], None, None]: """Returns the KPCR structure for each processor Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the kernel module on which to operate - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols Returns: The _KPCR structure for each processor """ kernel = context.modules[kernel_module_name] + kernel_layer = context.layers[kernel.layer_name] + + kpcr_type = kernel.get_type("_KPCR") + + reloff = kpcr_type.relative_child_offset("Prcb") + + if kpcr_type.has_member("CurrentPrcb"): + kpcr_member = "CurrentPrcb" + else: + kpcr_member = "Prcb" + cpu_count_offset = kernel.get_symbol("KeNumberProcessors").address + cpu_count = kernel.object( - object_type="unsigned int", layer_name=layer_name, offset=cpu_count_offset + object_type="unsigned int", + layer_name=kernel_layer.name, + offset=cpu_count_offset, ) + processor_block = kernel.object( object_type="pointer", - layer_name=layer_name, + layer_name=kernel_layer.name, offset=kernel.get_symbol("KiProcessorBlock").address, ) + processor_pointers = utility.array_of_pointers( context=context, array=processor_block, count=cpu_count, - subtype=symbol_table + constants.BANG + "_KPRCB", + subtype=kernel.symbol_table_name + constants.BANG + "_KPRCB", ) + for pointer in processor_pointers: kprcb = pointer.dereference() - reloff = kernel.get_type("_KPCR").relative_child_offset("Prcb") - kpcr = context.object( - symbol_table + constants.BANG + "_KPCR", - offset=kprcb.vol.offset - reloff, - layer_name=layer_name, - ) - yield kpcr + + object_address = kprcb.vol.offset - reloff + + if not kernel_layer.is_valid(kprcb.vol.offset): + continue + + kpcr = kernel.object("_KPCR", offset=object_address, absolute=True) + + yield kpcr, kpcr.member(kpcr_member) def _generator(self) -> Iterator[Tuple]: - kernel = self.context.modules[self.config["kernel"]] - layer_name = kernel.layer_name - symbol_table = kernel.symbol_table_name - for kpcr in self.list_kpcrs( - self.context, self.config["kernel"], layer_name, symbol_table - ): + for kpcr, current_prcb in self.list_kpcrs(self.context, self.config["kernel"]): yield ( 0, ( format_hints.Hex(kpcr.vol.offset), - format_hints.Hex(kpcr.CurrentPrcb), + format_hints.Hex(current_prcb), ), ) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index d08bc59dd..1f100bf1c 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -38,7 +38,7 @@ class Timers(interfaces.plugins.PluginInterface): name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( - name="kpcrs", plugin=kpcrs.KPCRs, version=(1, 0, 0) + name="kpcrs", plugin=kpcrs.KPCRs, version=(2, 0, 0) ), ] @@ -47,16 +47,12 @@ class Timers(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, kernel_module_name: str, - layer_name: str, - symbol_table: str, ) -> Iterable[extensions.KTIMER]: """Lists all kernel timers. Args: context: The context to retrieve required elements (layers, symbol tables) from kernel_module_name: The name of the kernel module on which to operate - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols Yields: A _KTIMER entry @@ -64,19 +60,19 @@ class Timers(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_module_name] if versions.is_windows_7( - context=context, symbol_table=symbol_table - ) or versions.is_windows_8_or_later(context=context, symbol_table=symbol_table): + context=context, symbol_table=kernel.symbol_table_name + ) or versions.is_windows_8_or_later( + context=context, symbol_table=kernel.symbol_table_name + ): # Starting with Windows 7, there is no more KiTimerTableListHead. The list is # at _KPCR.PrcbData.TimerTable.TimerEntries # See http://pastebin.com/FiRsGW3f - for kpcr in kpcrs.KPCRs.list_kpcrs( - context, kernel_module_name, layer_name, symbol_table - ): + for kpcr, _ in kpcrs.KPCRs.list_kpcrs(context, kernel_module_name): if hasattr(kpcr.Prcb.TimerTable, "TableState"): for timer_entries in kpcr.Prcb.TimerTable.TimerEntries: for timer_entry in timer_entries: for timer in timer_entry.Entry.to_list( - symbol_table + constants.BANG + "_KTIMER", + kernel.symbol_table_name + constants.BANG + "_KTIMER", "TimerListEntry", ): yield timer @@ -84,17 +80,19 @@ class Timers(interfaces.plugins.PluginInterface): else: for timer_entries in kpcr.Prcb.TimerTable.TimerEntries: for timer in timer_entries.Entry.to_list( - symbol_table + constants.BANG + "_KTIMER", + kernel.symbol_table_name + constants.BANG + "_KTIMER", "TimerListEntry", ): yield timer elif versions.is_xp_or_2003( - context=context, symbol_table=symbol_table - ) or versions.is_vista_or_later(context=context, symbol_table=symbol_table): - is_64bit = symbols.symbol_table_is_64bit(context, symbol_table) + context=context, symbol_table=kernel.symbol_table_name + ) or versions.is_vista_or_later( + context=context, symbol_table=kernel.symbol_table_name + ): + is_64bit = symbols.symbol_table_is_64bit(context, kernel.symbol_table_name) if is_64bit or versions.is_vista_or_later( - context=context, symbol_table=symbol_table + context=context, symbol_table=kernel.symbol_table_name ): # On XP x64, Windows 2003 SP1-SP2, and Vista SP0-SP2, KiTimerTableListHead # is an array of 512 _KTIMER_TABLE_ENTRY structs. @@ -112,7 +110,7 @@ class Timers(interfaces.plugins.PluginInterface): ) for table in timer_table_list_head: for timer in table.to_list( - symbol_table + constants.BANG + "_KTIMER", + kernel.symbol_table_name + constants.BANG + "_KTIMER", "TimerListEntry", ): yield timer @@ -121,8 +119,6 @@ class Timers(interfaces.plugins.PluginInterface): raise NotImplementedError("This version of Windows is not supported!") def _generator(self) -> Iterator[Tuple]: - kernel = self.context.modules[self.config["kernel"]] - collection = ssdt.SSDT.build_module_collection( context=self.context, kernel_module_name=self.config["kernel"], @@ -132,8 +128,6 @@ class Timers(interfaces.plugins.PluginInterface): for timer in self.list_timers( self.context, self.config["kernel"], - kernel.layer_name, - kernel.symbol_table_name, ): if not timer.valid_type(): continue From 4f946156448f4cc8427c44e47e57ffb218575c35 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 22:42:58 +0000 Subject: [PATCH 0720/1352] Bring hash dumping plugins up to current coding standards and error checking patterns. Fix bugs and typing --- .../framework/plugins/windows/cachedump.py | 6 +-- .../framework/plugins/windows/hashdump.py | 34 +++++++++++++---- .../framework/plugins/windows/lsadump.py | 37 +++++++++++-------- 3 files changed, 51 insertions(+), 26 deletions(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index ef4096b42..bcc1fac7f 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -22,7 +22,7 @@ class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -36,10 +36,10 @@ class Cachedump(interfaces.plugins.PluginInterface): name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="lsadump", plugin=lsadump.Lsadump, version=(1, 0, 0) + name="lsadump", plugin=lsadump.Lsadump, version=(2, 0, 0) ), requirements.PluginRequirement( - name="hashdump", plugin=hashdump.Hashdump, version=(1, 1, 0) + name="hashdump", plugin=hashdump.Hashdump, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index fa4081366..9577326ae 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -9,7 +9,7 @@ from typing import List, Optional, Tuple from Crypto.Cipher import AES, ARC4, DES -from volatility3.framework import interfaces, renderers +from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist @@ -21,7 +21,7 @@ class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 1, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -326,7 +326,9 @@ class Hashdump(interfaces.plugins.PluginInterface): empty_nt = b"\x31\xd6\xcf\xe0\xd1\x6a\xe9\x31\xb7\x3c\x59\xd7\xe0\xc0\x89\xc0" @classmethod - def get_hive_key(cls, hive: registry.RegistryHive, key: str): + def get_hive_key( + cls, hive: registry.RegistryHive, key: str + ) -> Optional["registry.CM_KEY_NODE"]: result = None try: if hive: @@ -351,6 +353,9 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_bootkey(cls, syshive: registry.RegistryHive) -> Optional[bytes]: + """ + Returns the scrambled bootkey necesary to decrypt hashes + """ cs = 1 lsa_base = f"ControlSet{cs:03}" + "\\Control\\Lsa" lsa_keys = ["JD", "Skew1", "GBG", "Data"] @@ -366,7 +371,10 @@ class Hashdump(interfaces.plugins.PluginInterface): key = cls.get_hive_key(syshive, lsa_base + "\\" + lk) class_data = None if key: - class_data = syshive.read(key.Class + 4, key.ClassLength) + try: + class_data = syshive.read(key.Class + 4, key.ClassLength) + except exceptions.InvalidAddressException: + return None if class_data is None: return None @@ -394,7 +402,11 @@ class Hashdump(interfaces.plugins.PluginInterface): sam_data = None for v in sam_account_key.get_values(): if v.get_name() == "F": - sam_data = samhive.read(v.Data + 4, v.DataLength) + try: + sam_data = samhive.read(v.Data + 4, v.DataLength) + except exceptions.InvalidAddressException: + return None + if not sam_data: return None @@ -444,7 +456,11 @@ class Hashdump(interfaces.plugins.PluginInterface): sam_data = None for v in user.get_values(): if v.get_name() == "V": - sam_data = samhive.read(v.Data + 4, v.DataLength) + try: + sam_data = samhive.read(v.Data + 4, v.DataLength) + except exceptions.InvalidAddressException: + return None + if not sam_data: return None @@ -546,7 +562,11 @@ class Hashdump(interfaces.plugins.PluginInterface): value = None for v in user.get_values(): if v.get_name() == "V": - value = samhive.read(v.Data + 4, v.DataLength) + try: + value = samhive.read(v.Data + 4, v.DataLength) + except exceptions.InvalidAddressException: + return None + if not value: return None diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index ac2b678f6..0d23dda0a 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -22,7 +22,7 @@ class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -33,7 +33,7 @@ class Lsadump(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="hashdump", component=hashdump.Hashdump, version=(1, 1, 0) + name="hashdump", component=hashdump.Hashdump, version=(2, 0, 0) ), requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) @@ -76,8 +76,7 @@ class Lsadump(interfaces.plugins.PluginInterface): enc_reg_key = hashdump.Hashdump.get_hive_key(sechive, "Policy\\" + policy_key) if not enc_reg_key: return None - enc_reg_value = next(enc_reg_key.get_values()) - + enc_reg_value = next(enc_reg_key.get_values(), None) if not enc_reg_value: return None @@ -112,18 +111,22 @@ class Lsadump(interfaces.plugins.PluginInterface): name: str, lsakey: bytes, is_vista_or_later: bool, - ): + ) -> Optional[bytes]: enc_secret_key = hashdump.Hashdump.get_hive_key( sechive, "Policy\\Secrets\\" + name + "\\CurrVal" ) secret = None if enc_secret_key: - enc_secret_value = next(enc_secret_key.get_values()) + enc_secret_value = next(enc_secret_key.get_values(), None) if enc_secret_value: - enc_secret = sechive.read( - enc_secret_value.Data + 4, enc_secret_value.DataLength - ) + try: + enc_secret = sechive.read( + enc_secret_value.Data + 4, enc_secret_value.DataLength + ) + except exceptions.InvalidAddressExceptions: + return None + if enc_secret: if not is_vista_or_later: secret = cls.decrypt_secret(enc_secret[0xC:], lsakey) @@ -133,7 +136,7 @@ class Lsadump(interfaces.plugins.PluginInterface): return secret @classmethod - def decrypt_secret(cls, secret: bytes, key: bytes): + def decrypt_secret(cls, secret: bytes, key: bytes) -> bytes: """Python implementation of SystemFunction005. Decrypts a block of data with DES using given key. @@ -168,11 +171,11 @@ class Lsadump(interfaces.plugins.PluginInterface): ) bootkey = hashdump.Hashdump.get_bootkey(syshive) - lsakey = self.get_lsa_key(sechive, bootkey, vista_or_later) if not bootkey: vollog.warning("Unable to find bootkey") return None + lsakey = self.get_lsa_key(sechive, bootkey, vista_or_later) if not lsakey: vollog.warning("Unable to find lsa key") return None @@ -190,15 +193,17 @@ class Lsadump(interfaces.plugins.PluginInterface): if not sec_val_key: continue - enc_secret_value = next(sec_val_key.get_values()) + enc_secret_value = next(sec_val_key.get_values(), None) if not enc_secret_value: continue - enc_secret = sechive.read( - enc_secret_value.Data + 4, enc_secret_value.DataLength - ) - if not enc_secret: + try: + enc_secret = sechive.read( + enc_secret_value.Data + 4, enc_secret_value.DataLength + ) + except exceptions.InvalidAddressExceptions: continue + if not vista_or_later: secret = self.decrypt_secret(enc_secret[0xC:], lsakey) else: From 74df8dc1ee87afe07d7ccee89097af3bd8fcb2f3 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 23:36:45 +0000 Subject: [PATCH 0721/1352] Fix version changes --- volatility3/framework/plugins/windows/cachedump.py | 4 ++-- volatility3/framework/plugins/windows/lsadump.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index bcc1fac7f..745fb8be4 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -22,7 +22,7 @@ class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -36,7 +36,7 @@ class Cachedump(interfaces.plugins.PluginInterface): name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), requirements.PluginRequirement( - name="lsadump", plugin=lsadump.Lsadump, version=(2, 0, 0) + name="lsadump", plugin=lsadump.Lsadump, version=(1, 0, 0) ), requirements.PluginRequirement( name="hashdump", plugin=hashdump.Hashdump, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 0d23dda0a..afae77e0d 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -22,7 +22,7 @@ class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (1, 0, 0) @classmethod def get_requirements(cls): From 24a53b4f68e0e219907840b28ae094fa0cf8498c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 00:22:07 +0000 Subject: [PATCH 0722/1352] Prevent truecrypt from throwing a backtrace when the module isn't found and print a warning --- .../framework/plugins/windows/truecrypt.py | 21 ++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/truecrypt.py b/volatility3/framework/plugins/windows/truecrypt.py index 158fc995d..aaab49d20 100644 --- a/volatility3/framework/plugins/windows/truecrypt.py +++ b/volatility3/framework/plugins/windows/truecrypt.py @@ -2,6 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging + from typing import Iterable, Generator, List, Tuple from volatility3.framework import constants, interfaces, renderers @@ -17,6 +19,8 @@ from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins.windows import modules +vollog = logging.getLogger(__name__) + class Passphrase(interfaces.plugins.PluginInterface): """TrueCrypt Cached Passphrase Finder""" @@ -123,11 +127,18 @@ class Passphrase(interfaces.plugins.PluginInterface): mods: Iterable[ObjectInterface] = modules.Modules.list_modules( self.context, self.config["kernel"] ) - truecrypt_module_base = next( - mod.DllBase - for mod in mods - if mod.BaseDllName.get_string().lower() == "truecrypt.sys" - ) + try: + truecrypt_module_base = next( + mod.DllBase + for mod in mods + if mod.BaseDllName.get_string().lower() == "truecrypt.sys" + ) + except StopIteration: + vollog.warning( + "Truecrypt module not found in the modules list. Unable to proceed." + ) + return + for offset, password in self.scan_module( truecrypt_module_base, kernel.layer_name ): From 9fe4092e9f9c18ddb6be452faecba476496dfbf1 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 03:34:26 +0000 Subject: [PATCH 0723/1352] Update the list_threads API to current standards and update current callers to new form --- .../framework/plugins/windows/debugregisters.py | 8 ++++---- .../framework/plugins/windows/suspended_threads.py | 8 ++++---- .../plugins/windows/suspicious_threads.py | 6 ++++-- volatility3/framework/plugins/windows/threads.py | 14 ++++++++------ 4 files changed, 20 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 0f6655c78..38b0cb97e 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -38,7 +38,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(2, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 0) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) @@ -111,8 +111,6 @@ class DebugRegisters(interfaces.plugins.PluginInterface): None, None, ]: - kernel = self.context.modules[self.config["kernel"]] - vads_cache: Dict[int, pe_symbols.ranges_type] = {} proc_modules = None @@ -122,7 +120,9 @@ class DebugRegisters(interfaces.plugins.PluginInterface): ) for proc in procs: - for thread in threads.Threads.list_threads(kernel, proc): + for thread in threads.Threads.list_threads( + self.context, self.config["kernel"], proc + ): debug_info = self._get_debug_info(thread) if not debug_info: continue diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index f83a201b5..f8f5027d4 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -36,7 +36,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(2, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 0) ), ] @@ -54,8 +54,6 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf """ - kernel = self.context.modules[self.config["kernel"]] - vads_cache: Dict[int, pe_symbols.PESymbols.ranges_type] = {} proc_modules = None @@ -64,7 +62,9 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): for proc in pslist.PsList.list_processes( context=self.context, kernel_module_name=self.config["kernel"] ): - for thread in threads.Threads.list_threads(kernel, proc): + for thread in threads.Threads.list_threads( + self.context, self.config["kernel"], proc + ): try: # we only care if the thread is suspended if thread.Tcb.SuspendCount == 0: diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index f83f3efc9..c98b06792 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -41,7 +41,7 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(2, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) @@ -169,7 +169,9 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): # there is no benefit to checking the same address more than once per process checked = set() - for thread in threads.Threads.list_threads(kernel, proc): + for thread in threads.Threads.list_threads( + self.context, self.config["kernel"], proc + ): # do not process if a thread is exited or terminated (4 = Terminated) if thread.ExitTime.QuadPart > 0 or thread.Tcb.State == 4: continue diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index f6d542357..e7150bbe4 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (2, 0, 0) + _version = (3, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -36,9 +36,11 @@ class Threads(thrdscan.ThrdScan): ), ] - @classmethod + @staticmethod def list_threads( - cls, kernel, proc: interfaces.objects.ObjectInterface + context: interfaces.context.ContextInterface, + kernel_module_name: str, + proc: interfaces.objects.ObjectInterface, ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Lists the Threads of a specific process. @@ -48,6 +50,8 @@ class Threads(thrdscan.ThrdScan): Returns: A list of threads based on the process and filtered based on the filter function """ + kernel = context.modules[kernel_module_name] + seen = set() for thread in proc.ThreadListHead.to_list( f"{kernel.symbol_table_name}{constants.BANG}_ETHREAD", "ThreadListEntry" @@ -64,8 +68,6 @@ class Threads(thrdscan.ThrdScan): kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Runs through all processes and lists threads for each process""" - module = context.modules[kernel_module_name] - filter_func = pslist.PsList.create_pid_filter(context.config.get("pid", None)) for proc in pslist.PsList.list_processes( @@ -73,4 +75,4 @@ class Threads(thrdscan.ThrdScan): kernel_module_name=kernel_module_name, filter_func=filter_func, ): - yield from cls.list_threads(module, proc) + yield from cls.list_threads(context, kernel_module_name, proc) From 7342f1e27e864df4b7d710b69d993c643feaa978 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 18:25:35 -0600 Subject: [PATCH 0724/1352] Apply suggestions from code review convert from static back to classmethod Co-authored-by: ikelos --- volatility3/framework/plugins/windows/threads.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index e7150bbe4..77062e8c6 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -36,8 +36,9 @@ class Threads(thrdscan.ThrdScan): ), ] - @staticmethod + @classmethod def list_threads( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str, proc: interfaces.objects.ObjectInterface, From bcf038bfd5ff981f673e23426b96ec79d3d8c19c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 00:30:06 +0000 Subject: [PATCH 0725/1352] Fix versioning again --- volatility3/framework/plugins/windows/cachedump.py | 4 ++-- volatility3/framework/plugins/windows/hashdump.py | 2 +- volatility3/framework/plugins/windows/lsadump.py | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 745fb8be4..cdb1d3c91 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -22,7 +22,7 @@ class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 1, 1) @classmethod def get_requirements(cls): @@ -39,7 +39,7 @@ class Cachedump(interfaces.plugins.PluginInterface): name="lsadump", plugin=lsadump.Lsadump, version=(1, 0, 0) ), requirements.PluginRequirement( - name="hashdump", plugin=hashdump.Hashdump, version=(2, 0, 0) + name="hashdump", plugin=hashdump.Hashdump, version=(1, 1, 0) ), ] diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 9577326ae..3346807d6 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -21,7 +21,7 @@ class Hashdump(interfaces.plugins.PluginInterface): """Dumps user hashes from memory""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (1, 1, 1) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index afae77e0d..325c8e381 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -33,7 +33,7 @@ class Lsadump(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="hashdump", component=hashdump.Hashdump, version=(2, 0, 0) + name="hashdump", component=hashdump.Hashdump, version=(1, 1, 0) ), requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) From 9e7ac650deeb26bf2382446a59814dec9433db0b Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 00:30:53 +0000 Subject: [PATCH 0726/1352] Fix versioning again --- volatility3/framework/plugins/windows/cachedump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index cdb1d3c91..ef4096b42 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -22,7 +22,7 @@ class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 1, 1) + _version = (1, 0, 1) @classmethod def get_requirements(cls): From f85c3a2d97136ea2acbc438c03120eda202ebee7 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 00:31:57 +0000 Subject: [PATCH 0727/1352] Fix versioning again --- volatility3/framework/plugins/windows/lsadump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 325c8e381..041a653f4 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -22,7 +22,7 @@ class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): From 3800ef37c7a29d9af6338b0dada091afc58a53c6 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 00:32:47 +0000 Subject: [PATCH 0728/1352] Fix versioning again --- volatility3/framework/plugins/windows/cachedump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index ef4096b42..7bc35945a 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -22,7 +22,7 @@ class Cachedump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls): From 3b7317971de4891817bc50f463ba8a78d4ad765b Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 19:55:28 +0000 Subject: [PATCH 0729/1352] Fix error handling and reporting around PE reconstruction calls --- volatility3/framework/plugins/windows/iat.py | 20 +++++++++++++++---- .../framework/plugins/windows/pe_symbols.py | 2 +- .../framework/plugins/windows/verinfo.py | 7 ++++++- 3 files changed, 23 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index 701db5734..acd3aaea2 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -69,11 +69,23 @@ class IAT(interfaces.plugins.PluginInterface): layer_name=proc_layer_name, ) - for offset, data in dos_header.reconstruct(): - pe_data.seek(offset) - pe_data.write(data) + try: + for offset, data in dos_header.reconstruct(): + pe_data.seek(offset) + pe_data.write(data) + except (exceptions.InvalidAddressException, ValueError) as excp: + vollog.debug( + f"Exception triggered when reconstructing PE file for process {proc.UniqueProcessId} at address {peb.ImageBaseAddress:#x} due to {excp}. Output file may be corrupt and/or truncated." + ) + + try: + pe_obj = pefile.PE(data=pe_data.getvalue(), fast_load=True) + except pefile.PEFormatError as excp: + vollog.debug( + f"Exception triggered when creating PE file object for process {proc.UniqueProcessId} at address {peb.ImageBaseAddress:#x} due to {excp}. Unable to extract file." + ) + continue - pe_obj = pefile.PE(data=pe_data.getvalue(), fast_load=True) pe_obj.parse_data_directories( [pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_IMPORT"]] ) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 270c6a174..0faf4a698 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -327,7 +327,7 @@ class PESymbols(interfaces.plugins.PluginInterface): pe_ret = pefile.PE(data=pe_data.getvalue(), fast_load=True) - except exceptions.InvalidAddressException: + except (exceptions.InvalidAddressException, ValueError): pe_ret = None return pe_ret diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index fa7d4e113..49bf0b212 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -176,7 +176,12 @@ class VerInfo(interfaces.plugins.PluginInterface): (major, minor, product, build) = self.get_version_information( self._context, pe_table_name, session_layer_name, mod.DllBase ) - except (exceptions.InvalidAddressException, TypeError, AttributeError): + except ( + exceptions.InvalidAddressException, + ValueError, + TypeError, + AttributeError, + ): (major, minor, product, build) = [renderers.UnreadableValue()] * 4 if ( not isinstance(BaseDllName, renderers.UnreadableValue) From 0d3b155766ce4803ab718bfcb2e296bc7ba0dd41 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 00:50:51 +0000 Subject: [PATCH 0730/1352] Change debug to warning to always notify user --- volatility3/framework/plugins/windows/iat.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/iat.py b/volatility3/framework/plugins/windows/iat.py index acd3aaea2..f2ba8e576 100644 --- a/volatility3/framework/plugins/windows/iat.py +++ b/volatility3/framework/plugins/windows/iat.py @@ -74,7 +74,7 @@ class IAT(interfaces.plugins.PluginInterface): pe_data.seek(offset) pe_data.write(data) except (exceptions.InvalidAddressException, ValueError) as excp: - vollog.debug( + vollog.warning( f"Exception triggered when reconstructing PE file for process {proc.UniqueProcessId} at address {peb.ImageBaseAddress:#x} due to {excp}. Output file may be corrupt and/or truncated." ) From 7f87f8eee0d0bf1fb481dc137e835dbf67d77d1a Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 8 Mar 2025 08:27:01 +0000 Subject: [PATCH 0731/1352] Tweak complex plugin documentation --- doc/source/complex-plugin.rst | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/doc/source/complex-plugin.rst b/doc/source/complex-plugin.rst index 8ab8a5186..07071f9a7 100644 --- a/doc/source/complex-plugin.rst +++ b/doc/source/complex-plugin.rst @@ -13,7 +13,7 @@ There is scope for this, in order to run multiple plugins (see `Writing plugins is to provide a parameterized `classmethod` within the plugin, which will allow the method to yield whatever kind of output it will generate and take whatever parameters it might need. -This is how processes are listed, which is an often used function. The code lives within the +As an example, an often used function is listing processes. The code lives within the :py:class:`~volatility3.plugins.windows.pslist.PsList` plugin but can be used by other plugins by providing the appropriate parameters (see :py:meth:`~volatility3.plugins.windows.pslist.PsList.list_processes`). @@ -36,8 +36,8 @@ each plugin in order to populate the context's configuration correctly based on between plugins). Once the automagics have been constructed, the plugin can be instantiated using the helper function :py:func:`~volatility3.framework.plugins.construct_plugin` providing: - * the base context (containing the configuration and any already loaded layers or symbol tables), - * the plugin class to run, + * the base context (containing the configuration and any already loaded layers or symbol tables)0l + * the plugin class to run * the configuration path within the context for the plugin * any callback to determine progress in lengthy operations * an open method for the plugin to create files during the run @@ -58,7 +58,7 @@ ContextManager, so it can be used by the python `with` keyword). This is set on that can be set on the filename, and a :py:class:`~volatility3.framework.interfaces.plugins.FileHandlerInterface` is the result. This mimics an `IO[bytes]` object, which closely mimics a standard python file-like object. -As such code for outputting to a file would be expected to look something like: +As such, code for outputting to a file would be expected to look something like: .. code-block:: python @@ -76,8 +76,7 @@ Writing Scanners Scanners are objects that adhere to the :py:class:`~volatility3.framework.interfaces.layers.ScannerInterface`. They are passed to the :py:meth:`~volatility3.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will divide the provided range of sections (or the entire layer -if none are provided) and call the :py:meth:`~volatility3.framework.interfaces.layers.ScannerInterface`'s call method -method with each chunk as a parameter, ensuring a suitable amount of overlap (as defined by the scanner). +if none are provided) and call the :py:meth:`~volatility3.framework.interfaces.layers.ScannerInterface`'s call method with each chunk as a parameter, ensuring a suitable amount of overlap (as defined by the scanner). The offset of the chunk, within the layer, is also provided as a parameter. Scanners can technically maintain state, but it is not recommended since the ordering that the chunks are scanned is @@ -92,18 +91,18 @@ Empirically it was found that scanners are typically not the most time intensive extensive scanning) and so parallelism does not offer significant gains. As such, parallelism is not enabled by default but interfaces can easily enable parallelism when desired. -Writing/Using Intermediate Symbol Format Files ----------------------------------------------- +Writing / Using Intermediate Symbol Format Files +------------------------------------------------ It can occasionally be useful to create a data file containing the static structures that can create a :py:class:`~volatility3.framework.interfaces.objects.Template` to be instantiated on a layer. Volatility has all the machinery necessary to construct these for you from properly formatted JSON data. -The JSON format is documented by the JSON schema files located in schemas. These are versioned using standard .so +The JSON format is documented by the JSON schema files located in the schemas directory. These are versioned using standard .so library versioning, so they may not increment as expected. Each schema lists an available version that can be used, which specifies five different sections: -* Base_types - These are the basic type names that will make up the native/primitive types +* Base_types - These are the basic type names that will make up the native / primitive types * User_types - These are the standard definitions of type structures, most will go here * Symbols - These list offsets that are associated with specific names (and can be associated with specific type names) * Enums - Enumerations that offer a number of choices @@ -180,7 +179,7 @@ of data. Each chunk contains the following information, in order: **layer_name** the layer that this data comes from -An example (and the most common layer encountered in memory forensics) would be an Intel layer, which models the intel +An example (and the most common layer encountered in memory forensics) would be an Intel layer, which models the Intel page mapping system. Based on a series of tables stored within the layer itself, an intel layer can convert a virtual address to a physical address. It should be noted that intel layers allow multiple virtual addresses to map to the same physical address (but a single virtual address cannot ever map to more than one physical address). @@ -195,7 +194,7 @@ like `abcdr`, requesting `mapping(5, 4)` would return: (7,2,0,2, 'physical_layer') ] -This mapping mechanism allows for great flexibility in that chunks making up a virtual layer can come from multiple +This mapping mechanism allows for great flexibility because chunks making up a virtual layer can come from multiple different range layers, allowing for swap space to be used to construct the virtual layer, for example. Also, by defining the mapping method, the read and write methods (which read and write into the domain layer) are defined for you to write to the lower layers (which in turn can write to layers even lower than that) until eventually they arrive at a @@ -264,7 +263,7 @@ so it therefore populates the `metadata` property. This is defined as a read-on includes data from every underlying layer. As such, CrashDumpLayer would actually specify this value by setting it in the protected dictionary by `self._direct_metadata['page_map_offset']`. -There is, unfortunately, no easy way to form consensus between a particular layer may want and what a particular layer +There is, unfortunately, no easy way to form consensus between what a particular layer may want and what a particular layer may be able to provide. At the moment, the main information that layers may populate are: * `os` with values of `Windows`, `Linux`, `Mac` or `unknown` From 0dbd8c0ec103dbee97d192995b465a7d76079546 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 8 Mar 2025 08:30:41 +0000 Subject: [PATCH 0732/1352] Tweak complex plugin documentation --- doc/source/complex-plugin.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/complex-plugin.rst b/doc/source/complex-plugin.rst index 07071f9a7..8a35887ec 100644 --- a/doc/source/complex-plugin.rst +++ b/doc/source/complex-plugin.rst @@ -36,7 +36,7 @@ each plugin in order to populate the context's configuration correctly based on between plugins). Once the automagics have been constructed, the plugin can be instantiated using the helper function :py:func:`~volatility3.framework.plugins.construct_plugin` providing: - * the base context (containing the configuration and any already loaded layers or symbol tables)0l + * the base context (containing the configuration and any already loaded layers or symbol tables) * the plugin class to run * the configuration path within the context for the plugin * any callback to determine progress in lengthy operations From 603ecbb48602d92d473f7437b153991a02457169 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 8 Mar 2025 12:29:34 +0100 Subject: [PATCH 0733/1352] render secret with HexBytes --- volatility3/framework/plugins/windows/lsadump.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 051e55afe..a3bf9300f 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -14,6 +14,7 @@ from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows import hashdump from volatility3.plugins.windows.registry import hivelist +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -204,7 +205,7 @@ class Lsadump(interfaces.plugins.PluginInterface): else: secret = self.decrypt_aes(enc_secret, lsakey) - yield (0, (key.get_name(), str(secret), secret)) + yield (0, (key.get_name(), format_hints.HexBytes(secret), secret)) def run(self): offset = self.config.get("offset", None) @@ -224,6 +225,6 @@ class Lsadump(interfaces.plugins.PluginInterface): sechive = hive return renderers.TreeGrid( - [("Key", str), ("Secret", str), ("Hex", bytes)], + [("Key", str), ("Secret", format_hints.HexBytes), ("Hex", bytes)], self._generator(syshive, sechive), ) From 475c1e163cfd0e31486f897651a92a4ce6d8c314 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 8 Mar 2025 12:58:25 +0000 Subject: [PATCH 0734/1352] Tweak complex plugin documentation --- doc/source/complex-plugin.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/doc/source/complex-plugin.rst b/doc/source/complex-plugin.rst index 8a35887ec..3db204081 100644 --- a/doc/source/complex-plugin.rst +++ b/doc/source/complex-plugin.rst @@ -76,7 +76,8 @@ Writing Scanners Scanners are objects that adhere to the :py:class:`~volatility3.framework.interfaces.layers.ScannerInterface`. They are passed to the :py:meth:`~volatility3.framework.interfaces.layers.TranslationLayerInterface.scan` method on layers which will divide the provided range of sections (or the entire layer -if none are provided) and call the :py:meth:`~volatility3.framework.interfaces.layers.ScannerInterface`'s call method with each chunk as a parameter, ensuring a suitable amount of overlap (as defined by the scanner). +if none are provided) and call the :py:meth:`~volatility3.framework.interfaces.layers.ScannerInterface`'s call method +with each chunk as a parameter, ensuring a suitable amount of overlap (as defined by the scanner). The offset of the chunk, within the layer, is also provided as a parameter. Scanners can technically maintain state, but it is not recommended since the ordering that the chunks are scanned is From f69b00b48c07328b618efaad6aa1e14cb3a5c3eb Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 17:21:27 +0000 Subject: [PATCH 0735/1352] Convert poolscanning APIs to new coding standards --- .../framework/plugins/windows/bigpools.py | 34 ++--- .../framework/plugins/windows/callbacks.py | 126 +++++++----------- .../framework/plugins/windows/cmdscan.py | 17 +-- .../framework/plugins/windows/consoles.py | 50 +++---- .../framework/plugins/windows/dlllist.py | 13 +- .../framework/plugins/windows/driverscan.py | 12 +- .../framework/plugins/windows/filescan.py | 22 ++- .../framework/plugins/windows/handles.py | 5 +- .../plugins/windows/indirect_system_calls.py | 2 +- volatility3/framework/plugins/windows/info.py | 70 +++++----- .../framework/plugins/windows/modscan.py | 4 +- .../framework/plugins/windows/mutantscan.py | 21 ++- .../framework/plugins/windows/netscan.py | 52 ++++---- .../framework/plugins/windows/netstat.py | 6 +- .../framework/plugins/windows/poolscanner.py | 43 +++--- .../framework/plugins/windows/psscan.py | 58 ++++---- .../framework/plugins/windows/psxview.py | 32 ++--- .../plugins/windows/registry/hivescan.py | 9 +- .../framework/plugins/windows/svcscan.py | 5 +- .../framework/plugins/windows/symlinkscan.py | 20 +-- .../framework/plugins/windows/thrdscan.py | 10 +- .../plugins/windows/windowstations.py | 9 +- 22 files changed, 262 insertions(+), 358 deletions(-) diff --git a/volatility3/framework/plugins/windows/bigpools.py b/volatility3/framework/plugins/windows/bigpools.py index 9da702ae0..fabdd4306 100644 --- a/volatility3/framework/plugins/windows/bigpools.py +++ b/volatility3/framework/plugins/windows/bigpools.py @@ -21,7 +21,7 @@ class BigPools(interfaces.plugins.PluginInterface): """List big page pools.""" _required_framework_version = (2, 0, 0) - _version = (1, 1, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -50,8 +50,7 @@ class BigPools(interfaces.plugins.PluginInterface): def list_big_pools( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, tags: Optional[list] = None, show_free: bool = False, ): @@ -59,19 +58,13 @@ class BigPools(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel tags: An optional list of pool tags to filter big page pool tags by Yields: A big page pool object """ - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] big_page_table_offset = ntkrnlmp.get_symbol("PoolBigPageTable").address big_page_table = ntkrnlmp.object( @@ -87,8 +80,10 @@ class BigPools(interfaces.plugins.PluginInterface): big_page_table_type = ntkrnlmp.get_type("_POOL_TRACKER_BIG_PAGES") except exceptions.SymbolError: # We have to manually load a symbol table - is_vista_or_later = versions.is_vista_or_later(context, symbol_table) - is_win10 = versions.is_win10(context, symbol_table) + is_vista_or_later = versions.is_vista_or_later( + context, ntkrnlmp.symbol_table_name + ) + is_win10 = versions.is_win10(context, ntkrnlmp.symbol_table_name) if is_win10: big_pools_json_filename = "bigpools-win10" elif is_vista_or_later: @@ -96,7 +91,7 @@ class BigPools(interfaces.plugins.PluginInterface): else: big_pools_json_filename = "bigpools" - if symbols.symbol_table_is_64bit(context, symbol_table): + if symbols.symbol_table_is_64bit(context, ntkrnlmp.symbol_table_name): big_pools_json_filename += "-x64" else: big_pools_json_filename += "-x86" @@ -104,16 +99,17 @@ class BigPools(interfaces.plugins.PluginInterface): new_table_name = intermed.IntermediateSymbolTable.create( context=context, config_path=configuration.path_join( - context.symbol_space[symbol_table].config_path, "bigpools" + context.symbol_space[ntkrnlmp.symbol_table_name].config_path, + "bigpools", ), sub_path=os.path.join("windows", "bigpools"), filename=big_pools_json_filename, - table_mapping={"nt_symbols": symbol_table}, + table_mapping={"nt_symbols": ntkrnlmp.symbol_table_name}, class_types={ "_POOL_TRACKER_BIG_PAGES": extensions.pool.POOL_TRACKER_BIG_PAGES }, ) - module = context.module(new_table_name, layer_name, offset=0) + module = context.module(new_table_name, ntkrnlmp.layer_name, offset=0) big_page_table_type = module.get_type("_POOL_TRACKER_BIG_PAGES") big_pools = ntkrnlmp.object( @@ -136,12 +132,10 @@ class BigPools(interfaces.plugins.PluginInterface): tags = [tag for tag in self.config["tags"].split(",")] else: tags = None - kernel = self.context.modules[self.config["kernel"]] for big_pool in self.list_big_pools( context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + kernel_module_name=self.config["kernel"], tags=tags, show_free=self.config.get("show-free"), ): diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 08e343ec7..c832df66a 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -28,7 +28,7 @@ class Callbacks(interfaces.plugins.PluginInterface): """Lists kernel callbacks and notification routines.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + _version = (3, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -42,7 +42,7 @@ class Callbacks(interfaces.plugins.PluginInterface): name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) ), requirements.PluginRequirement( name="driverirp", plugin=driverirp.DriverIrp, version=(1, 0, 0) @@ -211,8 +211,7 @@ class Callbacks(interfaces.plugins.PluginInterface): def scan( cls, context: interfaces.context.ContextInterface, - layer_name: str, - nt_symbol_table: str, + kernel_module_name: str, callback_symbol_table: str, ) -> Iterable[ Tuple[ @@ -225,18 +224,21 @@ class Callbacks(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - nt_symbol_table: The name of the table containing the kernel symbols + kernel_module_name: Name of the module for the kernel callback_symbol_table: The name of the table containing the callback object symbols (_SHUTDOWN_PACKET etc.) Returns: A list of callback objects found by scanning the `layer_name` layer for callback pool signatures """ + kernel = context.modules[kernel_module_name] + is_vista_or_later = versions.is_vista_or_later( - context=context, symbol_table=nt_symbol_table + context=context, symbol_table=kernel.symbol_table_name ) - type_map = handles.Handles.get_type_map(context, layer_name, nt_symbol_table) + type_map = handles.Handles.get_type_map( + context, kernel.layer_name, kernel.symbol_table_name + ) constraints = cls.create_callback_scan_constraints( context, callback_symbol_table, is_vista_or_later @@ -247,7 +249,7 @@ class Callbacks(interfaces.plugins.PluginInterface): mem_object, _header, ) in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, nt_symbol_table, constraints + context, kernel_module_name, constraints ): try: if isinstance(mem_object, callbacks._SHUTDOWN_PACKET): @@ -347,31 +349,24 @@ class Callbacks(interfaces.plugins.PluginInterface): def list_notify_routines( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, callback_table_name: str, ) -> Iterable[Tuple[str, int, Optional[str]]]: """Lists all kernel notification routines. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module of the kernel callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string """ - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] is_vista_or_later = versions.is_vista_or_later( - context=context, symbol_table=symbol_table + context=context, symbol_table=ntkrnlmp.symbol_table_name ) full_type_name = callback_table_name + constants.BANG + "_GENERIC_CALLBACK" @@ -416,20 +411,14 @@ class Callbacks(interfaces.plugins.PluginInterface): def _list_registry_callbacks_legacy( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, callback_table_name: str, ) -> Iterable[Tuple[str, int, None]]: """ Lists all registry callbacks from the old format via the CmpCallBackVector. """ - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] full_type_name = ( callback_table_name + constants.BANG + "_EX_CALLBACK_ROUTINE_BLOCK" ) @@ -467,20 +456,13 @@ class Callbacks(interfaces.plugins.PluginInterface): def _list_registry_callbacks_new( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, callback_table_name: str, ) -> Iterable[Tuple[str, int, Optional[str]]]: """ Lists all registry callbacks via the CallbackListHead. """ - - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] full_type_name = callback_table_name + constants.BANG + "_CM_CALLBACK_ENTRY" symbol_offset = ntkrnlmp.get_symbol("CallbackListHead").address @@ -504,40 +486,33 @@ class Callbacks(interfaces.plugins.PluginInterface): def list_registry_callbacks( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, callback_table_name: str, ) -> Iterable[Tuple[str, int, Optional[str]]]: """Lists all registry callbacks. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module of the kernel callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string """ - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] if ntkrnlmp.has_symbol("CmpCallBackVector") and ntkrnlmp.has_symbol( "CmpCallBackCount" ): yield from cls._list_registry_callbacks_legacy( - context, layer_name, symbol_table, callback_table_name + context, kernel_module_name, callback_table_name ) elif ntkrnlmp.has_symbol("CallbackListHead") and ntkrnlmp.has_symbol( "CmpCallBackCount" ): yield from cls._list_registry_callbacks_new( - context, layer_name, symbol_table, callback_table_name + context, kernel_module_name, callback_table_name ) else: symbols_to_check = [ @@ -552,14 +527,11 @@ class Callbacks(interfaces.plugins.PluginInterface): symbol_status = "exists" vollog.debug(f"symbol {symbol_name} {symbol_status}.") - return None - @classmethod def list_bugcheck_reason_callbacks( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, callback_table_name: str, ) -> Iterable[ Tuple[ @@ -572,20 +544,14 @@ class Callbacks(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module of the kernel callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string """ - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] try: list_offset = ntkrnlmp.get_symbol( @@ -599,11 +565,15 @@ class Callbacks(interfaces.plugins.PluginInterface): callback_table_name + constants.BANG + "_KBUGCHECK_REASON_CALLBACK_RECORD" ) callback_record = context.object( - object_type=full_type_name, offset=kvo + list_offset, layer_name=layer_name + object_type=full_type_name, + offset=ntkrnlmp.offset + list_offset, + layer_name=ntkrnlmp.layer_name, ) for callback in callback_record.Entry: - if not context.layers[layer_name].is_valid(callback.CallbackRoutine, 64): + if not context.layers[ntkrnlmp.layer_name].is_valid( + callback.CallbackRoutine, 64 + ): continue try: @@ -626,8 +596,7 @@ class Callbacks(interfaces.plugins.PluginInterface): def list_bugcheck_callbacks( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, callback_table_name: str, ) -> Iterable[ Tuple[ @@ -640,20 +609,13 @@ class Callbacks(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module of the kernel callback_table_name: The name of the table containing the callback symbols Yields: A name, location and optional detail string """ - - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] try: list_offset = ntkrnlmp.get_symbol("KeBugCheckCallbackListHead").address @@ -665,17 +627,20 @@ class Callbacks(interfaces.plugins.PluginInterface): callback_table_name + constants.BANG + "_KBUGCHECK_CALLBACK_RECORD" ) callback_record = context.object( - full_type_name, offset=kvo + list_offset, layer_name=layer_name + full_type_name, + offset=ntkrnlmp.offset + list_offset, + layer_name=ntkrnlmp.layer_name, ) for callback in callback_record.Entry: - if not context.layers[layer_name].is_valid(callback.CallbackRoutine, 64): + if not context.layers[ntkrnlmp.layer_name].is_valid( + callback.CallbackRoutine, 64 + ): continue try: - component = context.object( - symbol_table + constants.BANG + "string", - layer_name=layer_name, + component = ntkrnlmp.object( + "string", offset=callback.Component, max_length=64, errors="replace", @@ -708,8 +673,7 @@ class Callbacks(interfaces.plugins.PluginInterface): for callback_method in callback_methods: for callback_type, callback_address, callback_detail in callback_method( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], callback_symbol_table, ): if callback_detail is None: diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index be955374b..b7eab79fb 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -24,7 +24,7 @@ class CmdScan(interfaces.plugins.PluginInterface): """Looks for Windows Command History lists""" _required_framework_version = (2, 4, 0) - _version = (1, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -39,7 +39,7 @@ class CmdScan(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( - name="consoles", plugin=consoles.Consoles, version=(2, 0, 0) + name="consoles", plugin=consoles.Consoles, version=(3, 0, 0) ), requirements.BooleanRequirement( name="no_registry", @@ -83,9 +83,8 @@ class CmdScan(interfaces.plugins.PluginInterface): def get_command_history( cls, context: interfaces.context.ContextInterface, - kernel_layer_name: str, - kernel_symbol_table_name: str, config_path: str, + kernel_module_name: str, procs: Generator[interfaces.objects.ObjectInterface, None, None], max_history: Set[int], ) -> Tuple[ @@ -97,8 +96,6 @@ class CmdScan(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - kernel_layer_name: The name of the layer on which to operate - kernel_symbol_table_name: The name of the table containing the kernel symbols config_path: The config path where to find symbol files procs: List of process objects max_history: An initial set of CommandHistorySize values @@ -135,9 +132,8 @@ class CmdScan(interfaces.plugins.PluginInterface): if conhost_symbol_table is None: conhost_symbol_table = consoles.Consoles.create_conhost_symbol_table( context, - kernel_layer_name, - kernel_symbol_table_name, config_path, + kernel_module_name, proc_layer_name, conhostexe_base, ) @@ -279,8 +275,6 @@ class CmdScan(interfaces.plugins.PluginInterface): procs: the process list filtered to conhost.exe instances """ - kernel = self.context.modules[self.config["kernel"]] - max_history = set(self.config.get("max_history", [50])) no_registry = self.config.get("no_registry") @@ -302,9 +296,8 @@ class CmdScan(interfaces.plugins.PluginInterface): command_history_properties, ) in self.get_command_history( self.context, - kernel.layer_name, - kernel.symbol_table_name, self.config_path, + self.config["kernel"], procs, max_history, ): diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index ff5875354..8236d87be 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -31,7 +31,7 @@ class Consoles(interfaces.plugins.PluginInterface): _required_framework_version = (2, 4, 0) # 2.0.0 - change the signature of `get_console_settings_from_registry` - _version = (2, 0, 0) + _version = (3, 0, 0) @classmethod def get_requirements(cls): @@ -128,9 +128,8 @@ class Consoles(interfaces.plugins.PluginInterface): def determine_conhost_version( cls, context: interfaces.context.ContextInterface, - layer_name: str, - nt_symbol_table: str, config_path: str, + kernel_module_name: str, conhost_layer_name: str, conhost_base: int, ) -> Tuple[Optional[str], Dict[str, Type]]: @@ -139,9 +138,8 @@ class Consoles(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - nt_symbol_table: The name of the table containing the kernel symbols config_path: The config path where to find symbol files + kernel_module_name: The name of the module for the kernel conhost_layer_name: The name of the conhot process memory layer conhost_base: the base address of conhost.exe @@ -149,8 +147,10 @@ class Consoles(interfaces.plugins.PluginInterface): The filename of the symbol table to use and the associated class types. """ + kernel = context.modules[kernel_module_name] + is_64bit = symbols.symbol_table_is_64bit( - context=context, symbol_table_name=nt_symbol_table + context=context, symbol_table_name=kernel.symbol_table_name ) if is_64bit: @@ -158,9 +158,9 @@ class Consoles(interfaces.plugins.PluginInterface): else: arch = "x86" - vers = info.Info.get_version_structure(context, layer_name, nt_symbol_table) + vers = info.Info.get_version_structure(context, kernel_module_name) - kuser = info.Info.get_kuser_structure(context, layer_name, nt_symbol_table) + kuser = info.Info.get_kuser_structure(context, kernel_module_name) try: vers_minor_version = int(vers.MinorVersion) @@ -247,7 +247,7 @@ class Consoles(interfaces.plugins.PluginInterface): ) except (exceptions.InvalidAddressException, TypeError, AttributeError): # the following is IntelLayer specific and might need to be adapted to other architectures. - physical_layer_name = context.layers[layer_name].config.get( + physical_layer_name = context.layers[kernel.layer_name].config.get( "memory_layer", None ) if physical_layer_name: @@ -318,9 +318,8 @@ class Consoles(interfaces.plugins.PluginInterface): def create_conhost_symbol_table( cls, context: interfaces.context.ContextInterface, - layer_name: str, - nt_symbol_table: str, config_path: str, + kernel_module_name: str, conhost_layer_name: str, conhost_base: int, ) -> str: @@ -328,20 +327,20 @@ class Consoles(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - nt_symbol_table: The name of the table containing the kernel symbols config_path: The config path where to find symbol files + kernel_module_name: The name of the module of the kernel Returns: The name of the constructed symbol table """ - table_mapping = {"nt_symbols": nt_symbol_table} + kernel = context.modules[kernel_module_name] + + table_mapping = {"nt_symbols": kernel.symbol_table_name} symbol_filename, class_types = cls.determine_conhost_version( context, - layer_name, - nt_symbol_table, config_path, + kernel_module_name, conhost_layer_name, conhost_base, ) @@ -366,9 +365,8 @@ class Consoles(interfaces.plugins.PluginInterface): def get_console_info( cls, context: interfaces.context.ContextInterface, - kernel_layer_name: str, - kernel_table_name: str, config_path: str, + kernel_module_name: str, procs: Generator[interfaces.objects.ObjectInterface, None, None], max_history: Set[int], max_buffers: Set[int], @@ -385,9 +383,8 @@ class Consoles(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - kernel_layer_name: The name of the layer on which to operate - kernel_table_name: The name of the table containing the kernel symbols config_path: The config path where to find symbol files + kernel_module_name: The name of the module for the kernel procs: list of process objects max_history: an initial set of CommandHistorySize values max_buffers: an initial list of HistoryBufferMax values @@ -427,9 +424,8 @@ class Consoles(interfaces.plugins.PluginInterface): if conhost_symbol_table is None: conhost_symbol_table = cls.create_conhost_symbol_table( context, - kernel_layer_name, - kernel_table_name, config_path, + kernel_module_name, proc_layer_name, conhostexe_base, ) @@ -486,7 +482,7 @@ class Consoles(interfaces.plugins.PluginInterface): console_properties.append( { "level": 1, - "name": "_CONSOLE_INFORMATION.ScreenX", + "kernel_module_nameme": "_CONSOLE_INFORMATION.ScreenX", "address": console_info.ScreenX.vol.offset, "data": console_info.ScreenX, } @@ -810,8 +806,7 @@ class Consoles(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from config_path: The config path where to find symbol files - kernel_layer_name: The name of the layer on which to operate - kernel_symbol_table_name: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel max_history: an initial set of CommandHistorySize values max_buffers: an initial list of HistoryBufferMax values @@ -853,8 +848,6 @@ class Consoles(interfaces.plugins.PluginInterface): procs: the process list filtered to conhost.exe instances """ - kernel = self.context.modules[self.config["kernel"]] - max_history = set(self.config.get("max_history", [50])) max_buffers = set(self.config.get("max_buffers", [4])) no_registry = self.config.get("no_registry") @@ -874,9 +867,8 @@ class Consoles(interfaces.plugins.PluginInterface): proc = None for proc, console_info, console_properties in self.get_console_info( self.context, - kernel.layer_name, - kernel.symbol_table_name, self.config_path, + self.config["kernel"], procs, max_history, max_buffers, diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 7efc8a7eb..b1c6f2f05 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -37,13 +37,13 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="psscan", component=psscan.PsScan, version=(1, 1, 0) + name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="pedump", component=pedump.PEDump, version=(2, 0, 0) ), requirements.VersionRequirement( - name="info", component=info.Info, version=(1, 0, 0) + name="info", component=info.Info, version=(2, 0, 0) ), requirements.ListRequirement( name="pid", @@ -85,11 +85,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): self.context, self.config_path, "windows", "pe", class_types=pe.class_types ) - kernel = self.context.modules[self.config["kernel"]] - - kuser = info.Info.get_kuser_structure( - self.context, kernel.layer_name, kernel.symbol_table_name - ) + kuser = info.Info.get_kuser_structure(self.context, self.config["kernel"]) nt_major_version = int(kuser.NtMajorVersion) nt_minor_version = int(kuser.NtMinorVersion) @@ -209,8 +205,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): if self.config["offset"]: procs = psscan.PsScan.scan_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=psscan.PsScan.create_offset_filter( self.context, kernel.layer_name, diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index f179ff548..86db8d72b 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -25,7 +25,7 @@ class DriverScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) ), ] @@ -48,15 +48,11 @@ class DriverScan(interfaces.plugins.PluginInterface): kernel = context.modules[kernel_module_name] - symbol_table_name = kernel.symbol_table_name - layer_name = kernel.layer_name - constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table_name, [b"Dri\xf6", b"Driv"] + kernel.symbol_table_name, [b"Dri\xf6", b"Driv"] ) - module = context.module(symbol_table_name, layer_name, 0) - driver_start_offset = module.get_type("_DRIVER_OBJECT").relative_child_offset( + driver_start_offset = kernel.get_type("_DRIVER_OBJECT").relative_child_offset( "DriverStart" ) @@ -65,7 +61,7 @@ class DriverScan(interfaces.plugins.PluginInterface): ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table_name, constraints + context, kernel_module_name, constraints ): _constraint, mem_object, _header = result diff --git a/volatility3/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py index 82566361d..abec2a92e 100644 --- a/volatility3/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -14,7 +14,7 @@ class FileScan(interfaces.plugins.PluginInterface): """Scans for file objects present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -25,7 +25,7 @@ class FileScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) ), ] @@ -33,36 +33,32 @@ class FileScan(interfaces.plugins.PluginInterface): def scan_files( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for file objects using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel Returns: A list of File objects as found from the `layer_name` layer based on File pool signatures """ + kernel = context.modules[kernel_module_name] + constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"Fil\xe5", b"File"] + kernel.symbol_table_name, [b"Fil\xe5", b"File"] ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, kernel_module_name, constraints ): _constraint, mem_object, _header = result yield mem_object def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - - for fileobj in self.scan_files( - self.context, kernel.layer_name, kernel.symbol_table_name - ): + for fileobj in self.scan_files(self.context, self.config["kernel"]): try: file_name = fileobj.FileName.String except exceptions.InvalidAddressException: diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 6ab465439..e39c23a30 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -39,7 +39,7 @@ class Handles(interfaces.plugins.PluginInterface): name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="psscan", component=psscan.PsScan, version=(1, 1, 0) + name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), requirements.ListRequirement( name="pid", @@ -376,8 +376,7 @@ class Handles(interfaces.plugins.PluginInterface): if self.config["offset"]: procs = psscan.PsScan.scan_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=psscan.PsScan.create_offset_filter( self.context, kernel.layer_name, diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index c241a9b67..9f3fc4359 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -52,7 +52,7 @@ class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): requirements.PluginRequirement( name="direct_system_calls", plugin=direct_system_calls.DirectSystemCalls, - version=(1, 0, 0), + version=(2, 0, 0), ), ] diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index e20af8114..a2e438c3f 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -17,7 +17,7 @@ class Info(plugins.PluginInterface): """Show OS & kernel details of the memory sample being analyzed.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -56,6 +56,9 @@ class Info(plugins.PluginInterface): # FileLayer won't have dependencies pass + # FIXME - this needs to be deprecated. This is exactly the same + # as getting it from context.modules + # Deprecation warning will go once the API is overhauled @classmethod def get_kernel_module( cls, @@ -80,13 +83,12 @@ class Info(plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, config_path: str, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> interfaces.objects.ObjectInterface: """Returns the KDDEBUGGER_DATA64 structure for a kernel""" - ntkrnlmp = cls.get_kernel_module(context, layer_name, symbol_table) + ntkrnlmp = context.modules[kernel_module_name] - native_types = context.symbol_space[symbol_table].natives + native_types = context.symbol_space[ntkrnlmp.symbol_table_name].natives kdbg_offset = ntkrnlmp.get_symbol("KdDebuggerDataBlock").address @@ -102,7 +104,7 @@ class Info(plugins.PluginInterface): kdbg_obj = context.object( kdbg_table_name + constants.BANG + "_KDDEBUGGER_DATA64", offset=ntkrnlmp.offset + kdbg_offset, - layer_name=layer_name, + layer_name=ntkrnlmp.layer_name, ) return kdbg_obj @@ -111,16 +113,15 @@ class Info(plugins.PluginInterface): def get_kuser_structure( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> interfaces.objects.ObjectInterface: """Returns the _KUSER_SHARED_DATA structure for a kernel""" - virtual_layer = context.layers[layer_name] + ntkrnlmp = context.modules[kernel_module_name] + + virtual_layer = context.layers[ntkrnlmp.layer_name] if not isinstance(virtual_layer, layers.intel.Intel): raise TypeError("Virtual Layer is not an intel layer") - ntkrnlmp = cls.get_kernel_module(context, layer_name, symbol_table) - # this is a hard-coded address in the Windows OS if virtual_layer.bits_per_register == 32: kuser_addr = 0xFFDF0000 @@ -129,7 +130,6 @@ class Info(plugins.PluginInterface): kuser = ntkrnlmp.object( object_type="_KUSER_SHARED_DATA", - layer_name=layer_name, offset=kuser_addr, absolute=True, ) @@ -140,17 +140,15 @@ class Info(plugins.PluginInterface): def get_version_structure( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> interfaces.objects.ObjectInterface: """Returns the KdVersionBlock information from a kernel""" - ntkrnlmp = cls.get_kernel_module(context, layer_name, symbol_table) + ntkrnlmp = context.modules[kernel_module_name] vers_offset = ntkrnlmp.get_symbol("KdVersionBlock").address vers = ntkrnlmp.object( object_type="_DBGKD_GET_VERSION64", - layer_name=layer_name, offset=vers_offset, ) @@ -193,35 +191,38 @@ class Info(plugins.PluginInterface): def _generator(self): kernel = self.context.modules[self.config["kernel"]] - layer_name = kernel.layer_name - symbol_table = kernel.symbol_table_name - layer = self.context.layers[layer_name] - table = self.context.symbol_space[symbol_table] + kernel_layer = self.context.layers[kernel.layer_name] + symbol_table = self.context.symbol_space[kernel.symbol_table_name] kdbg = self.get_kdbg_structure( - self.context, self.config_path, layer_name, symbol_table + self.context, + self.config_path, + self.config["kernel"], ) - yield (0, ("Kernel Base", hex(layer.config["kernel_virtual_offset"]))) - yield (0, ("DTB", hex(layer.config["page_map_offset"]))) - yield (0, ("Symbols", table.config["isf_url"])) + yield (0, ("Kernel Base", hex(kernel_layer.config["kernel_virtual_offset"]))) + yield (0, ("DTB", hex(kernel_layer.config["page_map_offset"]))) + yield (0, ("Symbols", symbol_table.config["isf_url"])) yield ( 0, ( "Is64Bit", str( symbols.symbol_table_is_64bit( - context=self.context, symbol_table_name=symbol_table + context=self.context, symbol_table_name=kernel.symbol_table_name ) ), ), ) yield ( 0, - ("IsPAE", str(self.context.layers[layer_name].metadata.get("pae", False))), + ( + "IsPAE", + str(self.context.layers[kernel.layer_name].metadata.get("pae", False)), + ), ) - for i, layer in self.get_depends(self.context, layer_name): + for i, layer in self.get_depends(self.context, kernel.layer_name): yield (0, (layer.name, f"{i} {layer.__class__.__name__}")) if kdbg.Header.OwnerTag == 0x4742444B: @@ -229,23 +230,22 @@ class Info(plugins.PluginInterface): yield (0, ("NTBuildLab", kdbg.get_build_lab())) yield (0, ("CSDVersion", str(kdbg.get_csdversion()))) - vers = self.get_version_structure(self.context, layer_name, symbol_table) + vers = self.get_version_structure(self.context, self.config["kernel"]) yield (0, ("KdVersionBlock", hex(vers.vol.offset))) yield (0, ("Major/Minor", f"{vers.MajorVersion}.{vers.MinorVersion}")) yield (0, ("MachineType", str(vers.MachineType))) - ntkrnlmp = self.get_kernel_module(self.context, layer_name, symbol_table) + cpu_count_offset = kernel.get_symbol("KeNumberProcessors").address - cpu_count_offset = ntkrnlmp.get_symbol("KeNumberProcessors").address - - cpu_count = ntkrnlmp.object( - object_type="unsigned int", layer_name=layer_name, offset=cpu_count_offset + cpu_count = kernel.object( + object_type="unsigned int", + offset=cpu_count_offset, ) yield (0, ("KeNumberProcessors", str(cpu_count))) - kuser = self.get_kuser_structure(self.context, layer_name, symbol_table) + kuser = self.get_kuser_structure(self.context, self.config["kernel"]) yield (0, ("SystemTime", str(kuser.SystemTime.get_time()))) yield ( @@ -266,7 +266,7 @@ class Info(plugins.PluginInterface): # yield (0, ("SafeBootMode", "True" if kuser.SafeBootMode else "False")) nt_header = self.get_ntheader_structure( - self.context, self.config_path, layer_name + self.context, self.config_path, kernel.layer_name ) yield ( diff --git a/volatility3/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py index ab1383ddf..7330b2cb4 100644 --- a/volatility3/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -32,7 +32,7 @@ class ModScan(modules.Modules): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="poolscanner", component=poolscanner.PoolScanner, version=(1, 0, 0) + name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) ), requirements.VersionRequirement( name="modules", component=modules.Modules, version=(3, 0, 0) @@ -81,7 +81,7 @@ class ModScan(modules.Modules): ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, kernel.layer_name, kernel.symbol_table_name, constraints + context, kernel_module_name, constraints ): _constraint, mem_object, _header = result yield mem_object diff --git a/volatility3/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py index 64d3b5470..ca6e26157 100644 --- a/volatility3/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -14,6 +14,7 @@ class MutantScan(interfaces.plugins.PluginInterface): """Scans for mutexes present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -24,7 +25,7 @@ class MutantScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) ), ] @@ -32,36 +33,32 @@ class MutantScan(interfaces.plugins.PluginInterface): def scan_mutants( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for mutants using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel Returns: A list of Mutant objects found by scanning memory for the Mutant pool signatures """ + kernel = context.modules[kernel_module_name] + constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"Mut\xe1", b"Muta"] + kernel.symbol_table_name, [b"Mut\xe1", b"Muta"] ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, kernel_module_name, constraints ): _constraint, mem_object, _header = result yield mem_object def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - - for mutant in self.scan_mutants( - self.context, kernel.layer_name, kernel.symbol_table_name - ): + for mutant in self.scan_mutants(self.context, self.config["kernel"]): try: name = mutant.get_name() except (ValueError, exceptions.InvalidAddressException): diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index 6f98547d7..0c8523cce 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -23,7 +23,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for network objects present in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -34,10 +34,10 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="poolscanner", component=poolscanner.PoolScanner, version=(1, 0, 0) + name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) ), requirements.VersionRequirement( - name="info", component=info.Info, version=(1, 0, 0) + name="info", component=info.Info, version=(2, 0, 0) ), requirements.VersionRequirement( name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) @@ -117,15 +117,13 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def determine_tcpip_version( cls, context: interfaces.context.ContextInterface, - layer_name: str, - nt_symbol_table: str, + kernel_module_name: str, ) -> Tuple[str, Type]: """Tries to determine which symbol filename to use for the image's tcpip driver. The logic is partially taken from the info plugin. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - nt_symbol_table: The name of the table containing the kernel symbols + kernel_module_name: Name of the module for the kernel Returns: The filename of the symbol table to use. @@ -137,12 +135,14 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # therefore we determine the version based on the kernel version as testing # with several windows versions has showed this to work out correctly. + kernel = context.modules[kernel_module_name] + is_64bit = symbols.symbol_table_is_64bit( - context=context, symbol_table_name=nt_symbol_table + context=context, symbol_table_name=kernel.symbol_table_name ) is_18363_or_later = versions.is_win10_18363_or_later( - context=context, symbol_table=nt_symbol_table + context=context, symbol_table=kernel.symbol_table_name ) if is_64bit: @@ -150,9 +150,9 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): else: arch = "x86" - vers = info.Info.get_version_structure(context, layer_name, nt_symbol_table) + vers = info.Info.get_version_structure(context, kernel_module_name) - kuser = info.Info.get_kuser_structure(context, layer_name, nt_symbol_table) + kuser = info.Info.get_kuser_structure(context, kernel_module_name) try: vers_minor_version = int(vers.MinorVersion) @@ -259,7 +259,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): "Requiring further version inspection due to OS version by checking tcpip.sys's FileVersion header" ) # the following is IntelLayer specific and might need to be adapted to other architectures. - physical_layer_name = context.layers[layer_name].config.get( + physical_layer_name = context.layers[kernel.layer_name].config.get( "memory_layer", None ) if physical_layer_name: @@ -322,27 +322,26 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def create_netscan_symbol_table( cls, context: interfaces.context.ContextInterface, - layer_name: str, - nt_symbol_table: str, + kernel_module_name: str, config_path: str, ) -> str: """Creates a symbol table for TCP Listeners and TCP/UDP Endpoints. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - nt_symbol_table: The name of the table containing the kernel symbols + kernel_module_name: Name of the module for the kernel config_path: The config path where to find symbol files Returns: The name of the constructed symbol table """ - table_mapping = {"nt_symbols": nt_symbol_table} + kernel = context.modules[kernel_module_name] + + table_mapping = {"nt_symbols": kernel.symbol_table_name} symbol_filename, class_types = cls.determine_tcpip_version( context, - layer_name, - nt_symbol_table, + kernel_module_name, ) return intermed.IntermediateSymbolTable.create( @@ -358,16 +357,14 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def scan( cls, context: interfaces.context.ContextInterface, - layer_name: str, - nt_symbol_table: str, + kernel_module_name: str, netscan_symbol_table: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for network objects using the poolscanner module and constraints. Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - nt_symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel netscan_symbol_table: The name of the table containing the network object symbols (_TCP_LISTENER etc.) Returns: @@ -377,7 +374,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): constraints = cls.create_netscan_constraints(context, netscan_symbol_table) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, nt_symbol_table, constraints + context, kernel_module_name, constraints ): _constraint, mem_object, _header = result yield mem_object @@ -385,16 +382,13 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self, show_corrupt_results: Optional[bool] = None): """Generates the network objects for use in rendering.""" - kernel = self.context.modules[self.config["kernel"]] - netscan_symbol_table = self.create_netscan_symbol_table( - self.context, kernel.layer_name, kernel.symbol_table_name, self.config_path + self.context, self.config["kernel"], self.config_path ) for netw_obj in self.scan( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], netscan_symbol_table, ): vollog.debug( diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 5daa6cc79..aaab4494c 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -34,7 +34,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="netscan", component=netscan.NetScan, version=(1, 0, 0) + name="netscan", component=netscan.NetScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="modules", component=modules.Modules, version=(3, 0, 0) @@ -43,7 +43,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) ), requirements.VersionRequirement( - name="info", component=info.Info, version=(1, 0, 0) + name="info", component=info.Info, version=(2, 0, 0) ), requirements.VersionRequirement( name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) @@ -629,7 +629,7 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): kernel = self.context.modules[self.config["kernel"]] netscan_symbol_table = netscan.NetScan.create_netscan_symbol_table( - self.context, kernel.layer_name, kernel.symbol_table_name, self.config_path + self.context, self.config["kernel"], self.config_path ) tcpip_module = self.get_tcpip_module(self.context, self.config["kernel"]) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index af19cd035..c78c47c43 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -129,7 +129,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _required_framework_version = (2, 0, 0) - _version = (1, 1, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -151,7 +151,7 @@ class PoolScanner(plugins.PluginInterface): constraints = self.builtin_constraints(symbol_table) for constraint, mem_object, header in self.generate_pool_scan( - self.context, kernel.layer_name, symbol_table, constraints + self.context, self.config["kernel"], constraints ): # generate some type-specific info for sanity checking if constraint.object_type == "Process": @@ -365,8 +365,7 @@ class PoolScanner(plugins.PluginInterface): def generate_pool_scan_extended( cls, context: interfaces.context.ContextInterface, - kernel_layer_name: str, - kernel_symbol_table_name: str, + kernel_module_name: str, object_symbol_table_name: str, constraints: List[PoolConstraint], ) -> Generator[ @@ -384,41 +383,42 @@ class PoolScanner(plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - kernel_layer_name: The name of the base kernel layer - kernel_symbol_table_name: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel object_symbol_table_name: The name of the symbol table for the object being scanned for constraints: List of pool constraints used to limit the scan results Returns: Iterable of tuples, containing the constraint that matched, the object from memory, the object header used to determine the object """ + kernel = context.modules[kernel_module_name] + # get the object type map type_map = handles.Handles.get_type_map( context=context, - layer_name=kernel_layer_name, - symbol_table=kernel_symbol_table_name, + layer_name=kernel.layer_name, + symbol_table=kernel.symbol_table_name, ) cookie = handles.Handles.find_cookie( context=context, - layer_name=kernel_layer_name, - symbol_table=kernel_symbol_table_name, + layer_name=kernel.layer_name, + symbol_table=kernel.symbol_table_name, ) - is_windows_10 = versions.is_windows_10(context, kernel_symbol_table_name) + is_windows_10 = versions.is_windows_10(context, kernel.symbol_table_name) is_windows_8_or_later = versions.is_windows_8_or_later( - context, kernel_symbol_table_name + context, kernel.symbol_table_name ) # start off with the primary virtual layer - scan_layer = kernel_layer_name + scan_layer = kernel.layer_name # switch to a non-virtual layer if necessary if not is_windows_10: scan_layer = context.layers[scan_layer].config["memory_layer"] if symbols.symbol_table_is_64bit( - context=context, symbol_table_name=kernel_symbol_table_name + context=context, symbol_table_name=kernel.symbol_table_name ): alignment = 0x10 else: @@ -433,12 +433,11 @@ class PoolScanner(plugins.PluginInterface): alignment=alignment, ): - # construct the object in its own layer, using its own types mem_objects = header.get_object( constraint=constraint, use_top_down=is_windows_8_or_later, - native_layer_name=kernel_layer_name, - kernel_symbol_table=kernel_symbol_table_name, + native_layer_name=kernel.layer_name, + kernel_symbol_table=kernel.symbol_table_name, ) for mem_object in mem_objects: @@ -472,8 +471,7 @@ class PoolScanner(plugins.PluginInterface): def generate_pool_scan( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, constraints: List[PoolConstraint], ) -> Generator[ Tuple[ @@ -489,17 +487,18 @@ class PoolScanner(plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel constraints: List of pool constraints used to limit the scan results Returns: Iterable of tuples, containing the constraint that matched, the object from memory, the object header used to determine the object """ + kernel = context.modules[kernel_module_name] + # repeat the symbol table to match the original `generate_pool_scan` behaviour yield from cls.generate_pool_scan_extended( - context, layer_name, symbol_table, symbol_table, constraints + context, kernel_module_name, kernel.symbol_table_name, constraints ) @classmethod diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index a19423029..45f935ceb 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -23,7 +23,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for processes present in a particular windows memory image.""" _required_framework_version = (2, 3, 1) - _version = (1, 1, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls): @@ -37,7 +37,10 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="info", component=info.Info, version=(1, 0, 0) + name="info", component=info.Info, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) ), requirements.ListRequirement( name="pid", @@ -141,8 +144,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def scan_processes( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, filter_func: Callable[ [interfaces.objects.ObjectInterface], bool ] = lambda _: False, @@ -151,19 +153,20 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module for the kernel Returns: A list of processes found by scanning the `layer_name` layer for process pool signatures """ + kernel = context.modules[kernel_module_name] + constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"Pro\xe3", b"Proc"] + kernel.symbol_table_name, [b"Pro\xe3", b"Proc"] ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, kernel_module_name, constraints ): _constraint, mem_object, _header = result if not filter_func(mem_object): @@ -173,16 +176,14 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def virtual_process_from_physical( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, proc: interfaces.objects.ObjectInterface, ) -> Optional[interfaces.objects.ObjectInterface]: """Returns a virtual process from a physical addressed one Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols + kernel_module_name: The name of the module inside the kernel proc: the process object with physical address Returns: @@ -190,16 +191,10 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """ - version = cls.get_osversion(context, layer_name, symbol_table) + ntkrnlmp = context.modules[kernel_module_name] + + version = cls.get_osversion(context, kernel_module_name) - # If it's WinXP->8.1 we have now a physical process address. - # We'll use the first thread to bounce back to the virtual process - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) tleoffset = ntkrnlmp.get_type("_ETHREAD").relative_child_offset( "ThreadListEntry" ) @@ -208,7 +203,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # If (and only if) we're dealing with 64-bit Windows 7 SP1 # then add the other commonly seen member offset to the list - bits = context.layers[layer_name].bits_per_register + bits = context.layers[ntkrnlmp.layer_name].bits_per_register if version == (6, 1, 7601) and bits == 64: offsets.append(tleoffset + 8) @@ -225,7 +220,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Sanity check the bounce. # This compares the original offset with the new one (translated from virtual layer) (_, _, ph_offset, _, _) = list( - context.layers[layer_name].mapping( + context.layers[ntkrnlmp.layer_name].mapping( offset=virtual_process.vol.offset, length=0 ) )[0] @@ -237,23 +232,20 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): def get_osversion( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Tuple[int, int, int]: """Returns the complete OS version (MAJ,MIN,BUILD) Args: context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - symbol_table: The name of the table containing the kernel symbols - + kernel_module_name: The name of the module for the kernel Returns: A tuple with (MAJ,MIN,BUILD) """ - kuser = info.Info.get_kuser_structure(context, layer_name, symbol_table) + kuser = info.Info.get_kuser_structure(context, kernel_module_name) nt_major_version = int(kuser.NtMajorVersion) nt_minor_version = int(kuser.NtMinorVersion) - vers = info.Info.get_version_structure(context, layer_name, symbol_table) + vers = info.Info.get_version_structure(context, kernel_module_name) build = vers.MinorVersion return (nt_major_version, nt_minor_version, build) @@ -268,8 +260,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): for proc in self.scan_processes( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], filter_func=pslist.PsList.create_pid_filter(self.config.get("pid", None)), ): file_output = "Disabled" @@ -281,8 +272,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): try: vproc = self.virtual_process_from_physical( self.context, - kernel.layer_name, - kernel.symbol_table_name, + self.config["kernel"], proc, ) except exceptions.PagedInvalidAddressException: diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 89ef897cb..3377163f7 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -11,7 +11,6 @@ from volatility3.framework.renderers import TreeGrid, format_hints from volatility3.framework.symbols.windows import extensions from volatility3.plugins.windows import ( handles, - info, pslist, psscan, thrdscan, @@ -49,14 +48,11 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.VersionRequirement( - name="info", component=info.Info, version=(1, 0, 0) - ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="psscan", component=psscan.PsScan, version=(1, 0, 0) + name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="thrdscan", component=thrdscan.ThrdScan, version=(1, 0, 0) @@ -114,10 +110,10 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter return self._proc_list_to_dict(tasks) def _check_psscan( - self, layer_name: str, symbol_table: str + self, ) -> Dict[int, extensions.EPROCESS]: res = psscan.PsScan.scan_processes( - context=self.context, layer_name=layer_name, symbol_table=symbol_table + context=self.context, kernel_module_name=self.config["kernel"] ) return self._proc_list_to_dict(res) @@ -144,20 +140,24 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter return self._proc_list_to_dict(ret) def _check_csrss_handles( - self, tasks: Iterable[extensions.EPROCESS], layer_name: str, symbol_table: str + self, tasks: Iterable[extensions.EPROCESS] ) -> Dict[int, extensions.EPROCESS]: ret: List[extensions.EPROCESS] = [] + kernel = self.context.modules[self.config["kernel"]] + handles_plugin = handles.Handles( context=self.context, config_path=self.config_path ) - type_map = handles_plugin.get_type_map(self.context, layer_name, symbol_table) + type_map = handles_plugin.get_type_map( + self.context, kernel.layer_name, kernel.symbol_table_name + ) cookie = handles_plugin.find_cookie( context=self.context, - layer_name=layer_name, - symbol_table=symbol_table, + layer_name=kernel.layer_name, + symbol_table=kernel.symbol_table_name, ) for p in tasks: @@ -179,8 +179,6 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter return self._proc_list_to_dict(ret) def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - kdbg_list_processes = list( pslist.PsList.list_processes( context=self.context, kernel_module_name=self.config["kernel"] @@ -191,13 +189,9 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter processes: Dict[str, Dict[int, extensions.EPROCESS]] = {} processes["pslist"] = self._check_pslist(kdbg_list_processes) - processes["psscan"] = self._check_psscan( - kernel.layer_name, kernel.symbol_table_name - ) + processes["psscan"] = self._check_psscan() processes["thrdscan"] = self._check_thrdscan() - processes["csrss"] = self._check_csrss_handles( - kdbg_list_processes, kernel.layer_name, kernel.symbol_table_name - ) + processes["csrss"] = self._check_csrss_handles(kdbg_list_processes) # Unique set of all offsets from all sources offsets = set(chain(*(mapping.keys() for mapping in processes.values()))) diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index d91eeafc2..a28ab19de 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -26,10 +26,10 @@ class HiveScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) ), requirements.PluginRequirement( - name="bigpools", plugin=bigpools.BigPools, version=(1, 0, 0) + name="bigpools", plugin=bigpools.BigPools, version=(2, 0, 0) ), ] @@ -62,8 +62,7 @@ class HiveScan(interfaces.plugins.PluginInterface): for pool in bigpools.BigPools.list_big_pools( context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + kernel_module_name=kernel_name, tags=["CM10"], ): cmhive = ntkrnlmp.object( @@ -77,7 +76,7 @@ class HiveScan(interfaces.plugins.PluginInterface): ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, kernel.layer_name, kernel.symbol_table_name, constraints + context, kernel_name, constraints ): _constraint, mem_object, _header = result yield mem_object diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 653995f90..915850574 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -20,7 +20,7 @@ from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import versions from volatility3.framework.symbols.windows.extensions import services as services_types -from volatility3.plugins.windows import poolscanner, pslist +from volatility3.plugins.windows import pslist from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -53,9 +53,6 @@ class SvcScan(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) - ), requirements.PluginRequirement( name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) ), diff --git a/volatility3/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py index 89fdf142e..459129843 100644 --- a/volatility3/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -17,6 +17,8 @@ class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfa _required_framework_version = (2, 0, 0) + _version = (2, 0, 0) + @classmethod def get_requirements(cls): return [ @@ -25,14 +27,16 @@ class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfa description="Windows kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) + ), ] @classmethod def scan_symlinks( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Iterable[interfaces.objects.ObjectInterface]: """Scans for links using the poolscanner module and constraints. @@ -45,22 +49,20 @@ class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfa A list of symlink objects found by scanning memory for the Symlink pool signatures """ + kernel = context.modules[kernel_module_name] + constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"Sym\xe2", b"Symb"] + kernel.symbol_table_name, [b"Sym\xe2", b"Symb"] ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, kernel_module_name, constraints ): _constraint, mem_object, _header = result yield mem_object def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - - for link in self.scan_symlinks( - self.context, kernel.layer_name, kernel.symbol_table_name - ): + for link in self.scan_symlinks(self.context, self.config["kernel"]): try: from_name = link.get_link_name() except (ValueError, exceptions.InvalidAddressException): diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index c0963e754..b43593401 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -34,7 +34,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(1, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) ), ] @@ -54,16 +54,14 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) A list of _ETHREAD objects found by scanning memory for the "Thre" / "Thr\\xE5" pool signatures """ - module = context.modules[module_name] - layer_name = module.layer_name - symbol_table = module.symbol_table_name + kernel = context.modules[module_name] constraints = poolscanner.PoolScanner.builtin_constraints( - symbol_table, [b"Thr\xe5", b"Thre"] + kernel.symbol_table_name, [b"Thr\xe5", b"Thre"] ) for result in poolscanner.PoolScanner.generate_pool_scan( - context, layer_name, symbol_table, constraints + context, module_name, constraints ): _constraint, mem_object, _header = result yield mem_object diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index a077ef2fc..9d666e3dd 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -46,6 +46,12 @@ class WindowStations(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) + ), ] @staticmethod @@ -152,8 +158,7 @@ class WindowStations(interfaces.plugins.PluginInterface): for result in poolscanner.PoolScanner.generate_pool_scan_extended( context=context, - kernel_layer_name=kernel.layer_name, - kernel_symbol_table_name=kernel.symbol_table_name, + kernel_module_name=kernel_module_name, object_symbol_table_name=gui_table_name, constraints=constraints, ): From 539a94117aa7697bc014e045f228bdcac6030a30 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 17:27:50 +0000 Subject: [PATCH 0736/1352] Add missing change --- volatility3/framework/plugins/windows/consoles.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 8236d87be..a63b044d9 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -482,7 +482,7 @@ class Consoles(interfaces.plugins.PluginInterface): console_properties.append( { "level": 1, - "kernel_module_nameme": "_CONSOLE_INFORMATION.ScreenX", + "name": "_CONSOLE_INFORMATION.ScreenX", "address": console_info.ScreenX.vol.offset, "data": console_info.ScreenX, } From 222554807915416c8089914ca28b65eb21907902 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 19:59:57 +0000 Subject: [PATCH 0737/1352] Remove deepcopy call in pe_symbols. Validate wanted symbol information passed through resolving functions --- .../plugins/windows/debugregisters.py | 2 +- .../framework/plugins/windows/pe_symbols.py | 59 +++++++++++++++++-- .../plugins/windows/skeleton_key_check.py | 2 +- .../plugins/windows/suspended_threads.py | 2 +- .../plugins/windows/unhooked_system_calls.py | 2 +- 5 files changed, 58 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 38b0cb97e..74434a3cc 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -41,7 +41,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): name="threads", component=threads.Threads, version=(3, 0, 0) ), requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) + name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 0faf4a698..f7d99a79b 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -1,7 +1,6 @@ # This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 -import copy import io import logging import ntpath @@ -11,7 +10,7 @@ from typing import Dict, Tuple, Optional, List, Generator, Union, Callable import pefile from volatility3.framework import interfaces, exceptions -from volatility3.framework import renderers, constants +from volatility3.framework import renderers, constants, objects from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed @@ -245,7 +244,8 @@ class PESymbols(interfaces.plugins.PluginInterface): _required_framework_version = (2, 7, 0) # 2.0.0 - changed signature of get_kernel_modules, get_all_vads_with_file_paths, addresses_for_process_symbols, get_process_modules - _version = (2, 0, 0) + # 3.0.0 - find_symbols wil now throw a ValueError if the provided wanted symbol information does not follow the spec + _version = (3, 0, 0) # used for special handling of the kernel PDB file. See later notes os_module_name = "ntoskrnl.exe" @@ -671,6 +671,52 @@ class PESymbols(interfaces.plugins.PluginInterface): else: yield symbol_key, value_index, symbol_value, wanted_value # type: ignore + @staticmethod + def _validate_wanted_modules( + wanted: PESymbolFinder.cached_module_lists, + ) -> Optional[PESymbolFinder.cached_module_lists]: + """ + Validates and makes a copy of the address(es) and/or name(s) wanted from a particular module + Throws ValueError if invalid values found + """ + remaining: PESymbolFinder.cached_module_lists = {} + + valid_name_types = [str] + valid_address_types = [int, objects.Pointer] + + for wanted_type, wanted_symbols in wanted.items(): + if wanted_type not in [ + wanted_names_identifier, + wanted_addresses_identifier, + ]: + raise ValueError( + f"The symbol type specified ({wanted_type}) is not valid. Values choices: {wanted_names_identifier}, {wanted_addresses_identifier}" + ) + + remaining[wanted_type] = [] + + # symbol_info will be a symbol name or address requested + for symbol_info in wanted_symbols: + if ( + wanted_type == wanted_names_identifier + and type(symbol_info) not in valid_name_types + ): + raise ValueError( + f"The requested symbol name has a type of {type(symbol_info)} which is not in the allowed set of {valid_name_types}" + ) + + elif ( + wanted_type == wanted_addresses_identifier + and type(symbol_info) not in valid_address_types + ): + raise ValueError( + f"The requested address has a type of {type(symbol_info)} which is not in the allowed set of {valid_address_types}" + ) + + remaining[wanted_type].append(symbol_info) + + return remaining + @staticmethod def _resolve_symbols_through_methods( context: interfaces.context.ContextInterface, @@ -700,8 +746,8 @@ class PESymbols(interfaces.plugins.PluginInterface): # the symbols wanted from this module by the caller wanted = wanted_modules[mod_name] - # make a copy to remove from inside this function for returning to the caller - remaining = copy.deepcopy(wanted) + # The ValueError will pass through to the caller + remaining = PESymbols._validate_wanted_modules(wanted) done_processing = False @@ -748,6 +794,8 @@ class PESymbols(interfaces.plugins.PluginInterface): Loops through each method of symbol analysis until each wanted symbol is found Returns the resolved symbols as a dictionary that includes the name and runtime address + `wanted_modules` must be correctly formatted or a ValueError will be thrown + Args: wanted_modules: the dictionary of modules and symbols to resolve. Modified to remove symbols as they are resolved. collected_modules: return value from `get_kernel_modules` or `get_process_modules` @@ -763,6 +811,7 @@ class PESymbols(interfaces.plugins.PluginInterface): module_instances = collected_modules[mod_name] + # The ValueError from an invalid wanted_modules will pass through to the caller # try to resolve the symbols for `mod_name` through each method (PDB and export table currently) ( found_in_module, diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index bd32d1987..4831362fd 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -61,7 +61,7 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) ), requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) + name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index f8f5027d4..82d44a6d7 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -33,7 +33,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(2, 0, 0) + name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), requirements.VersionRequirement( name="threads", component=threads.Threads, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index 8882ff46f..132cf4e4f 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -98,7 +98,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.PluginRequirement( - name="pe_symbols", plugin=pe_symbols.PESymbols, version=(2, 0, 0) + name="pe_symbols", plugin=pe_symbols.PESymbols, version=(3, 0, 0) ), ] From 5f8e7e58a449257e911f94dbfbc0ff646ba9b5f5 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 14:12:11 -0600 Subject: [PATCH 0738/1352] Update volatility3/framework/plugins/windows/pe_symbols.py Co-authored-by: ikelos --- volatility3/framework/plugins/windows/pe_symbols.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index f7d99a79b..b26e8d113 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -671,8 +671,9 @@ class PESymbols(interfaces.plugins.PluginInterface): else: yield symbol_key, value_index, symbol_value, wanted_value # type: ignore - @staticmethod + @classmethod def _validate_wanted_modules( + cls, wanted: PESymbolFinder.cached_module_lists, ) -> Optional[PESymbolFinder.cached_module_lists]: """ From 9919c1e6142a141330e93bb7fa751ed4709a4151 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 22:49:16 +0000 Subject: [PATCH 0739/1352] Fix handles API and callers. Bump version number and requirements --- .../framework/plugins/windows/callbacks.py | 4 +- .../framework/plugins/windows/dumpfiles.py | 8 ++- .../framework/plugins/windows/handles.py | 50 ++++++------------- .../framework/plugins/windows/poolscanner.py | 10 ++-- .../framework/plugins/windows/psxview.py | 10 ++-- 5 files changed, 27 insertions(+), 55 deletions(-) diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index c832df66a..24f25c38d 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -48,7 +48,7 @@ class Callbacks(interfaces.plugins.PluginInterface): name="driverirp", plugin=driverirp.DriverIrp, version=(1, 0, 0) ), requirements.PluginRequirement( - name="handles", plugin=handles.Handles, version=(2, 0, 0) + name="handles", plugin=handles.Handles, version=(3, 0, 0) ), ] @@ -237,7 +237,7 @@ class Callbacks(interfaces.plugins.PluginInterface): ) type_map = handles.Handles.get_type_map( - context, kernel.layer_name, kernel.symbol_table_name + context=context, kernel_module_name=kernel_module_name ) constraints = cls.create_callback_scan_constraints( diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index e89b99275..e0adad2b1 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -71,7 +71,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(2, 0, 0) + name="handles", component=handles.Handles, version=(3, 0, 0) ), ] @@ -231,13 +231,11 @@ class DumpFiles(interfaces.plugins.PluginInterface): ) type_map = handles_plugin.get_type_map( context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + kernel_module_name=self.config["kernel"], ) cookie = handles_plugin.find_cookie( context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + kernel_module_name=self.config["kernel"], ) dumped_files = set() diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index e39c23a30..9627b5caa 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -18,7 +18,7 @@ class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + _version = (3, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -121,8 +121,7 @@ class Handles(interfaces.plugins.PluginInterface): def get_type_map( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Dict[int, str]: """List the executive object types (_OBJECT_TYPE) using the ObTypeIndexTable or ObpObjectTypes symbol (differs per OS). This method @@ -144,21 +143,16 @@ class Handles(interfaces.plugins.PluginInterface): type_map: Dict[int, str] = {} - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - ntkrnlmp = context.module(symbol_table, layer_name=layer_name, offset=kvo) + ntkrnlmp = context.modules[kernel_module_name] try: table_addr = ntkrnlmp.get_symbol("ObTypeIndexTable").address except exceptions.SymbolError: table_addr = ntkrnlmp.get_symbol("ObpObjectTypes").address - trans_layer = context.layers[layer_name] + trans_layer = context.layers[ntkrnlmp.layer_name] - if not trans_layer.is_valid(kvo + table_addr): + if not trans_layer.is_valid(ntkrnlmp.offset + table_addr): return type_map ptrs = ntkrnlmp.object( @@ -176,7 +170,7 @@ class Handles(interfaces.plugins.PluginInterface): try: objt = ptr.dereference().cast( - symbol_table + constants.BANG + "_OBJECT_TYPE" + ntkrnlmp.symbol_table_name + constants.BANG + "_OBJECT_TYPE" ) type_name = objt.Name.String except exceptions.InvalidAddressException: @@ -194,27 +188,21 @@ class Handles(interfaces.plugins.PluginInterface): def find_cookie( cls, context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table: str, + kernel_module_name: str, ) -> Optional[interfaces.objects.ObjectInterface]: """Find the ObHeaderCookie value (if it exists)""" + kernel = context.modules[kernel_module_name] + try: - offset = context.symbol_space.get_symbol( - symbol_table + constants.BANG + "ObHeaderCookie" - ).address + symbol_offset = kernel.get_symbol("ObHeaderCookie").address except exceptions.SymbolError: + vollog.debug('Unable to get symbol information for "ObHeaderCookie"') return None - kvo = context.layers[layer_name].config.get("kernel_virtual_offset", None) - if not kvo: - raise ValueError( - "Intel layer does not have an associated kernel virtual offset, failing" - ) - return context.object( - symbol_table + constants.BANG + "unsigned int", - layer_name, - offset=kvo + offset, + return kernel.object( + "unsigned int", + offset=symbol_offset, ) def _make_handle_array(self, offset, level, depth=0): @@ -298,18 +286,12 @@ class Handles(interfaces.plugins.PluginInterface): yield from self._make_handle_array(TableCode, table_levels) def _generator(self, procs): - kernel = self.context.modules[self.config["kernel"]] - type_map = self.get_type_map( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + context=self.context, kernel_module_name=self.config["kernel"] ) cookie = self.find_cookie( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + context=self.context, kernel_module_name=self.config["kernel"] ) for proc in procs: diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index c78c47c43..5e75d9bbb 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -140,7 +140,7 @@ class PoolScanner(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="handles", plugin=handles.Handles, version=(2, 0, 0) + name="handles", plugin=handles.Handles, version=(3, 0, 0) ), ] @@ -394,15 +394,11 @@ class PoolScanner(plugins.PluginInterface): # get the object type map type_map = handles.Handles.get_type_map( - context=context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + context=context, kernel_module_name=kernel_module_name ) cookie = handles.Handles.find_cookie( - context=context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + context=context, kernel_module_name=kernel_module_name ) is_windows_10 = versions.is_windows_10(context, kernel.symbol_table_name) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 3377163f7..7329588cc 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -58,7 +58,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="thrdscan", component=thrdscan.ThrdScan, version=(1, 0, 0) ), requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(2, 0, 0) + name="handles", component=handles.Handles, version=(3, 0, 0) ), requirements.BooleanRequirement( name="physical-offsets", @@ -144,20 +144,16 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter ) -> Dict[int, extensions.EPROCESS]: ret: List[extensions.EPROCESS] = [] - kernel = self.context.modules[self.config["kernel"]] - handles_plugin = handles.Handles( context=self.context, config_path=self.config_path ) type_map = handles_plugin.get_type_map( - self.context, kernel.layer_name, kernel.symbol_table_name + context=self.context, kernel_module_name=self.config["kernel"] ) cookie = handles_plugin.find_cookie( - context=self.context, - layer_name=kernel.layer_name, - symbol_table=kernel.symbol_table_name, + context=self.context, kernel_module_name=self.config["kernel"] ) for p in tasks: From 5b088561dbce90b2933ce88d9cd1c87fe190982e Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 9 Mar 2025 08:55:15 +0000 Subject: [PATCH 0740/1352] Remove comment and handling of an empty pid_list These mypy issues are now closed. --- volatility3/framework/plugins/linux/pslist.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index b8fac4a8b..00d3b6cc5 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -85,8 +85,6 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Returns: Function which, when provided a process object, returns True if the process is to be filtered out of the list """ - # FIXME: mypy #4973 or #2608 - pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] if filter_list: From 2e56787bf2a2471fab2b9769b7b53e7bd5500bad Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 9 Mar 2025 09:21:20 +0000 Subject: [PATCH 0741/1352] Remove comment These mypy issues are now closed. --- volatility3/framework/plugins/linux/pslist.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 00d3b6cc5..4c42fc992 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -85,6 +85,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): Returns: Function which, when provided a process object, returns True if the process is to be filtered out of the list """ + pid_list = pid_list or [] filter_list = [x for x in pid_list if x is not None] if filter_list: From 2074b8fb2339829f5f2cdec4cf0fb1158f2ab0ae Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sun, 9 Mar 2025 10:47:51 +0000 Subject: [PATCH 0742/1352] Remove duplicate reference of capstone The capstone dependency under test is not needed, because test references volatility3[dev] which references volatility3[full,cloud], and full has the capstone dependency. --- pyproject.toml | 1 - 1 file changed, 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 742b4f771..abd2e79f7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -45,7 +45,6 @@ dev = [ test = [ "volatility3[dev]", "pytest>=8.3.3,<9", - "capstone>=5.0.3,<6", "yara-x>=0.10.0,<1", ] From bdc3443c135f96273213d030254be634c5aa1fdf Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 6 Mar 2025 23:55:36 +0000 Subject: [PATCH 0743/1352] Merge two Linux APIs for mapping kernel modules to pointers. Fix bugs in new API. Add deprecation warnings throughout old API. --- volatility3/framework/__init__.py | 13 + .../framework/plugins/linux/check_idt.py | 2 +- .../framework/plugins/linux/check_modules.py | 66 +-- .../framework/plugins/linux/hidden_modules.py | 158 ++---- .../plugins/linux/keyboard_notifiers.py | 2 +- .../framework/plugins/linux/kthreads.py | 2 +- volatility3/framework/plugins/linux/lsmod.py | 40 +- .../framework/plugins/linux/modxview.py | 106 ++-- .../framework/plugins/linux/netfilter.py | 2 +- .../framework/plugins/linux/tracing/ftrace.py | 96 +--- .../plugins/linux/tracing/tracepoints.py | 78 +-- .../framework/plugins/linux/tty_check.py | 2 +- .../framework/symbols/linux/__init__.py | 13 +- .../symbols/linux/utilities/modules.py | 475 ++++++++++++++++-- 14 files changed, 641 insertions(+), 414 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 60acb9465..333e7909f 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -69,6 +69,19 @@ def require_interface_version(*args) -> None: class Deprecation: """Deprecation related methods.""" + @staticmethod + def method_being_removed(message: str): + + def decorator(deprecated_func): + @functools.wraps(deprecated_func) + def wrapper(*args, **kwargs): + warnings.warn(f"This API ({deprecated_func.__module__}.{deprecated_func.__qualname__}) will be removed in a release very soon. {message}", FutureWarning) + return deprecated_func(*args, **kwargs) + + return wrapper + + return decorator + @staticmethod def deprecated_method( replacement: Callable, diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index 653ecc081..dbdb0e9be 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -34,7 +34,7 @@ class Check_idt(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(1, 0, 0), + version=(2, 0, 0), ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 23da29680..8d2d0c746 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -3,14 +3,15 @@ # import logging -from typing import List +from typing import List, Dict -from volatility3.framework import interfaces, renderers, exceptions, constants +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.framework import interfaces, renderers, Deprecation from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints -from volatility3.plugins.linux import lsmod +from volatility3.framework.symbols.linux import extensions vollog = logging.getLogger(__name__) @@ -18,7 +19,7 @@ vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" - _version = (1, 0, 0) + _version = (2, 0, 0) _required_framework_version = (2, 0, 0) @classmethod @@ -29,58 +30,33 @@ class Check_modules(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(2, 0, 0), ), ] @classmethod + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.get_kset_modules, + replacement_version=(2, 0, 0), + ) def get_kset_modules( cls, context: interfaces.context.ContextInterface, vmlinux_name: str - ): - vmlinux = context.modules[vmlinux_name] - - try: - module_kset = vmlinux.object_from_symbol("module_kset") - except exceptions.SymbolError: - module_kset = None - - if not module_kset: - raise TypeError( - "This plugin requires the module_kset structure. This structure is not present in the supplied symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." - ) - - ret = {} - - kobj_off = vmlinux.get_type("module_kobject").relative_child_offset("kobj") - - for kobj in module_kset.list.to_list( - vmlinux.symbol_table_name + constants.BANG + "kobject", "entry" - ): - mod_kobj = vmlinux.object( - object_type="module_kobject", - offset=kobj.vol.offset - kobj_off, - absolute=True, - ) - - mod = mod_kobj.mod - - try: - name = utility.pointer_to_string(kobj.name, 32) - except exceptions.InvalidAddressException: - continue - - if kobj.name and kobj.reference_count() > 2: - ret[name] = mod - - return ret + ) -> Dict[str, extensions.module]: + return linux_utilities_modules.Modules.get_kset_modules(context, vmlinux_name) def _generator(self): - kset_modules = self.get_kset_modules(self.context, self.config["kernel"]) + kset_modules = linux_utilities_modules.Modules.get_kset_modules( + self.context, self.config["kernel"] + ) lsmod_modules = set( str(utility.array_to_string(modules.name)) - for modules in lsmod.Lsmod.list_modules(self.context, self.config["kernel"]) + for modules in linux_utilities_modules.Modules.list_modules( + self.context, self.config["kernel"] + ) ) for mod_name in set(kset_modules.keys()).difference(lsmod_modules): diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index e1ba40926..0b93cfacc 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -3,7 +3,8 @@ # import logging from typing import List, Set, Tuple, Iterable -from volatility3.framework import renderers, interfaces, exceptions, objects +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.framework import renderers, interfaces, exceptions, Deprecation from volatility3.framework.constants import architectures from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements @@ -16,7 +17,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): """Carves memory to find hidden kernel modules""" _required_framework_version = (2, 10, 0) - _version = (1, 0, 1) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -29,46 +30,30 @@ class Hidden_modules(interfaces.plugins.PluginInterface): requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(2, 0, 0), + ), ] - @classmethod + @staticmethod + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, + replacement_version=(2, 0, 0), + ) def get_modules_memory_boundaries( - cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str, - ) -> Tuple[int]: - """Determine the boundaries of the module allocation area - - Args: - context: The context to retrieve required elements (layers, symbol tables) from - vmlinux_module_name: The name of the kernel module on which to operate - - Returns: - A tuple containing the minimum and maximum addresses for the module allocation area. - """ - vmlinux = context.modules[vmlinux_module_name] - if vmlinux.has_symbol("mod_tree"): - # Kernel >= 5.19 58d208de3e8d87dbe196caf0b57cc58c7a3836ca - mod_tree = vmlinux.object_from_symbol("mod_tree") - modules_addr_min = mod_tree.addr_min - modules_addr_max = mod_tree.addr_max - elif vmlinux.has_symbol("module_addr_min"): - # 2.6.27 <= kernel < 5.19 3a642e99babe0617febb6f402e1e063479f489db - modules_addr_min = vmlinux.object_from_symbol("module_addr_min") - modules_addr_max = vmlinux.object_from_symbol("module_addr_max") - - if isinstance(modules_addr_min, objects.Void): - raise exceptions.VolatilityException( - "Your ISF symbols lack type information. You may need to update the" - "ISF using the latest version of dwarf2json" - ) - else: - raise exceptions.VolatilityException( - "Cannot find the module memory allocation area. Unsupported kernel" - ) - - return modules_addr_min, modules_addr_max + ) -> Tuple[int, int]: + return linux_utilities_modules.Modules.get_modules_memory_boundaries( + context, vmlinux_module_name + ) + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.get_module_address_alignment, + replacement_version=(2, 0, 0), + ) @classmethod def _get_module_address_alignment( cls, @@ -88,27 +73,14 @@ class Hidden_modules(interfaces.plugins.PluginInterface): Returns: The struct module alignment """ - # FIXME: When dwarf2json/ISF supports type alignments. Read it directly from the type metadata - # Additionally, while 'context' and 'vmlinux_module_name' are currently unused, they will be - # essential for retrieving type metadata in the future. - return 64 - - @staticmethod - def _validate_alignment_patterns( - addresses: Iterable[int], - address_alignment: int, - ) -> bool: - """Check if the memory addresses meet our alignments patterns - - Args: - addresses: Iterable with the address values - address_alignment: Number of bytes for alignment validation - - Returns: - True if all the addresses meet the alignment - """ - return all(addr % address_alignment == 0 for addr in addresses) + return linux_utilities_modules.get_module_address_alignment( + context, vmlinux_module_name + ) + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.get_hidden_modules, + replacement_version=(2, 0, 0), + ) @classmethod def get_hidden_modules( cls, @@ -139,54 +111,31 @@ class Hidden_modules(interfaces.plugins.PluginInterface): Yields: module objects """ - vmlinux = context.modules[vmlinux_module_name] - vmlinux_layer = context.layers[vmlinux.layer_name] - - module_addr_min, module_addr_max = modules_memory_boundaries - module_address_alignment = cls._get_module_address_alignment( - context, vmlinux_module_name + return linux_utilities_modules.get_hidden_modules( + vmlinux_module_name, known_module_addresses, modules_memory_boundaries ) - if not cls._validate_alignment_patterns( - known_module_addresses, module_address_alignment - ): - vollog.warning( - f"Module addresses aren't aligned to {module_address_alignment} bytes. " - "Switching to 1 byte aligment scan method." - ) - module_address_alignment = 1 - mkobj_offset = vmlinux.get_type("module").relative_child_offset("mkobj") - mod_offset = vmlinux.get_type("module_kobject").relative_child_offset("mod") - offset_to_mkobj_mod = mkobj_offset + mod_offset - mod_member_template = vmlinux.get_type("module_kobject").child_template("mod") - mod_size = mod_member_template.size - mod_member_data_format = mod_member_template.data_format + @staticmethod + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.validate_alignment_patterns, + replacement_version=(2, 0, 0), + ) + def _validate_alignment_patterns( + addresses: Iterable[int], + address_alignment: int, + ) -> bool: + """Check if the memory addresses meet our alignments patterns - for module_addr in range( - module_addr_min, module_addr_max, module_address_alignment - ): - if module_addr in known_module_addresses: - continue + Args: + addresses: Iterable with the address values + address_alignment: Number of bytes for alignment validation - try: - # This is just a pre-filter. Module readability and consistency are verified in module.is_valid() - self_referential_bytes = vmlinux_layer.read( - module_addr + offset_to_mkobj_mod, mod_size - ) - self_referential = objects.convert_data_to_value( - self_referential_bytes, int, mod_member_data_format - ) - if self_referential != module_addr: - continue - except ( - exceptions.PagedInvalidAddressException, - exceptions.InvalidAddressException, - ): - continue - - module = vmlinux.object("module", offset=module_addr, absolute=True) - if module and module.is_valid(): - yield module + Returns: + True if all the addresses meet the alignment + """ + return linux_utilities_modules.validate_alignment_patterns( + addresses, address_alignment + ) @classmethod def get_lsmod_module_addresses( @@ -217,10 +166,13 @@ class Hidden_modules(interfaces.plugins.PluginInterface): known_module_addresses = self.get_lsmod_module_addresses( self.context, vmlinux_module_name ) - modules_memory_boundaries = self.get_modules_memory_boundaries( - self.context, vmlinux_module_name + modules_memory_boundaries = ( + linux_utilities_modules.Modules.get_modules_memory_boundaries( + self.context, vmlinux_module_name + ) ) - for module in self.get_hidden_modules( + + for module in linux_utilities_modules.Modules.get_hidden_modules( self.context, vmlinux_module_name, known_module_addresses, diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index 726280cbe..8fd2846c1 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -30,7 +30,7 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(1, 0, 0), + version=(2, 0, 0), ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index 674eae1e5..60d24f06e 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -34,7 +34,7 @@ class Kthreads(plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(1, 0, 0), + version=(2, 0, 0), ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index e9a2a7137..be3970a5b 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -6,7 +6,8 @@ import logging from typing import List, Iterable -from volatility3.framework import exceptions, renderers, constants, interfaces +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.framework import exceptions, renderers, interfaces, Deprecation from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -29,35 +30,30 @@ class Lsmod(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(2, 0, 0), + ), ] @classmethod + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.list_modules, + replacement_version=(2, 0, 0), + ) def list_modules( cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str ) -> Iterable[interfaces.objects.ObjectInterface]: - """Lists all the modules in the primary layer. - - Args: - context: The context to retrieve required elements (layers, symbol tables) from - layer_name: The name of the layer on which to operate - vmlinux_symbols: The name of the table containing the kernel symbols - - Yields: - The modules present in the `layer_name` layer's modules list - - This function will throw a SymbolError exception if kernel module support is not enabled. - """ - vmlinux = context.modules[vmlinux_module_name] - - modules = vmlinux.object_from_symbol(symbol_name="modules").cast("list_head") - - table_name = modules.vol.type_name.split(constants.BANG)[0] - - yield from modules.to_list(table_name + constants.BANG + "module", "list") + return linux_utilities_modules.Modules.list_modules( + context, vmlinux_module_name + ) def _generator(self): try: - for module in self.list_modules(self.context, self.config["kernel"]): + for module in linux_utilities_modules.Modules.list_modules( + self.context, self.config["kernel"] + ): mod_size = module.get_init_size() + module.get_core_size() mod_name = utility.array_to_string(module.name) @@ -65,7 +61,7 @@ class Lsmod(plugins.PluginInterface): yield 0, (format_hints.Hex(module.vol.offset), mod_name, mod_size) except exceptions.SymbolError: - vollog.debug( + vollog.warning( "The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis." ) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 0dd503829..d05f16458 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -3,8 +3,10 @@ # import logging from typing import List, Dict, Iterator -from volatility3.plugins.linux import lsmod, check_modules, hidden_modules -from volatility3.framework import interfaces + +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules + +from volatility3.framework import interfaces, Deprecation from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue from volatility3.framework.symbols.linux import extensions @@ -29,22 +31,14 @@ spot modules presence and taints.""" description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(2, 0, 0), + ), requirements.VersionRequirement( name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) - ), - requirements.PluginRequirement( - name="check_modules", - plugin=check_modules.Check_modules, - version=(1, 0, 0), - ), - requirements.PluginRequirement( - name="hidden_modules", - plugin=hidden_modules.Hidden_modules, - version=(1, 0, 0), - ), requirements.BooleanRequirement( name="plain_taints", description="Display the plain taints string for each module.", @@ -54,6 +48,10 @@ spot modules presence and taints.""" ] @classmethod + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.flatten_run_modules_results, + replacement_version=(2, 0, 0), + ) def flatten_run_modules_results( cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True ) -> Iterator[extensions.module]: @@ -67,15 +65,15 @@ spot modules presence and taints.""" Returns: Iterator of modules objects """ - seen_addresses = set() - for modules in run_results.values(): - for module in modules: - if deduplicate and module.vol.offset in seen_addresses: - continue - seen_addresses.add(module.vol.offset) - yield module + return linux_utilities_modules.Modules.flatten_run_modules_results( + run_results, deduplicate + ) @classmethod + @Deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.run_modules_scanners, + replacement_version=(2, 0, 0), + ) def run_modules_scanners( cls, context: interfaces.context.ContextInterface, @@ -83,67 +81,37 @@ spot modules presence and taints.""" run_hidden_modules: bool = True, ) -> Dict[str, List[extensions.module]]: """Run module scanning plugins and aggregate the results. It is designed - to not operate any inter-plugin results triage. - - Args: - run_hidden_modules: specify if the hidden_modules plugin should be run - Returns: - Dictionary mapping each plugin to its corresponding result - """ - - kernel = context.modules[kernel_name] - run_results = {} - # lsmod - run_results["lsmod"] = list(lsmod.Lsmod.list_modules(context, kernel_name)) - # check_modules - sysfs_modules: dict = check_modules.Check_modules.get_kset_modules( - context, kernel_name + to not operate any inter-plugin results triage.""" + return linux_utilities_modules.Modules.run_modules_scanners( + context, kernel_name, run_hidden_modules ) - ## Convert get_kset_modules() offsets back to module objects - run_results["check_modules"] = [ - kernel.object(object_type="module", offset=m_offset, absolute=True) - for m_offset in sysfs_modules.values() - ] - # hidden_modules - if run_hidden_modules: - known_modules_addresses = set( - context.layers[kernel.layer_name].canonicalize(module.vol.offset) - for module in run_results["lsmod"] + run_results["check_modules"] - ) - modules_memory_boundaries = ( - hidden_modules.Hidden_modules.get_modules_memory_boundaries( - context, kernel_name - ) - ) - run_results["hidden_modules"] = list( - hidden_modules.Hidden_modules.get_hidden_modules( - context, - kernel_name, - known_modules_addresses, - modules_memory_boundaries, - ) - ) - - return run_results def _generator(self): kernel_name = self.config["kernel"] - run_results = self.run_modules_scanners(self.context, kernel_name) + + kernel = self.context.modules[kernel_name] + + run_results = linux_utilities_modules.Modules.run_modules_scanners( + self.context, kernel_name, flatten=False + ) + aggregated_modules = {} # We want to be explicit on the plugins results we are interested in for plugin_name in ["lsmod", "check_modules", "hidden_modules"]: # Iterate over each recovered module - for module in run_results[plugin_name]: + for mod_info in run_results[plugin_name]: # Use offsets as unique keys, whether a module # appears in many plugin runs or not - if aggregated_modules.get(module.vol.offset, None) is not None: + if aggregated_modules.get(mod_info.offset, None) is not None: # Append the plugin to the list of originating plugins - aggregated_modules[module.vol.offset][1].append(plugin_name) + aggregated_modules[mod_info.offset].append(plugin_name) else: - aggregated_modules[module.vol.offset] = (module, [plugin_name]) + aggregated_modules[mod_info.offset] = [plugin_name] - for module_offset, (module, originating_plugins) in aggregated_modules.items(): + for module_offset, originating_plugins in aggregated_modules.items(): # Tainting parsing capabilities applied to the module + module = kernel.object("module", offset=module_offset, absolute=True) + if self.config.get("plain_taints"): taints = tainting.Tainting.get_taints_as_plain_string( self.context, diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index 9c8c9feb0..9c0055a54 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -726,7 +726,7 @@ class Netfilter(interfaces.plugins.PluginInterface): _version = (1, 1, 1) - _required_linux_utilities_modules_version = (1, 0, 0) + _required_linux_utilities_modules_version = (2, 0, 0) _required_linuxutils_version = (2, 1, 0) _required_lsmod_version = (2, 0, 0) _required_linuxnet_version = (1, 0, 0) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 59168d5bc..17766cc74 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -10,11 +10,9 @@ from enum import Enum from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.plugins.linux import hidden_modules, modxview from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue -from volatility3.framework.symbols.linux import extensions from volatility3.framework.constants import architectures vollog = logging.getLogger(__name__) @@ -67,7 +65,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged to hook kernel functions and modify their behaviour.""" - _version = (2, 0, 0) + _version = (3, 0, 0) _required_framework_version = (2, 19, 0) @classmethod @@ -81,15 +79,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(1, 1, 0), - ), - requirements.PluginRequirement( - name="modxview", plugin=modxview.Modxview, version=(1, 0, 0) - ), - requirements.PluginRequirement( - name="hidden_modules", - plugin=hidden_modules.Hidden_modules, - version=(1, 0, 0), + version=(2, 0, 0), ), requirements.BooleanRequirement( name="show_ftrace_flags", @@ -136,8 +126,8 @@ class CheckFtrace(interfaces.plugins.PluginInterface): def parse_ftrace_ops( cls, context: interfaces.context.ContextInterface, - kernel_name: str, - known_modules: Dict[str, List[extensions.module]], + kernel_module_name: str, + known_modules: Dict[str, List[linux_utilities_modules.Modules.ModuleInfo]], ftrace_ops: interfaces.objects.ObjectInterface, run_hidden_modules: bool = True, ) -> Generator[ParsedFtraceOps, None, None]: @@ -145,70 +135,33 @@ class CheckFtrace(interfaces.plugins.PluginInterface): Iterates over embedded ftrace_func_entry entries, which point to hooked memory areas. Args: - known_modules: A dict of known modules, used to locate callbacks origin. Typically obtained through modxview.run_modules_scanners(). + known_modules: A dict of known modules, used to locate callbacks origin. Typically obtained through run_modules_scanners(). ftrace_ops: The ftrace_ops struct to parse run_hidden_modules: Whether to run the hidden_modules plugin or not. Note: it won't be run, even if specified, \ -if the "hidden_modules" key is present in known_modules. + if the "hidden_modules" key is present in known_modules. Yields: An iterable of ParsedFtraceOps dataclasses, containing a selection of useful fields (callback, hook, module) related to an ftrace_ops struct """ - kernel = context.modules[kernel_name] - kernel_layer = context.layers[kernel.layer_name] + kernel = context.modules[kernel_module_name] callback = ftrace_ops.func - callback_symbol = module_address = module_name = None - # Try to lookup within the known modules if the callback address fits - module = linux_utilities_modules.Modules.module_lookup_by_address( - context, - kernel.layer_name, - modxview.Modxview.flatten_run_modules_results(known_modules), - callback, - ) - # Run hidden_modules plugin if a callback origin couldn't be determined (only done once, results are re-used afterwards) - if ( - module is None - and run_hidden_modules - and "hidden_modules" not in known_modules - ): - vollog.info( - "A callback module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", - ) - known_modules_addresses = set( - kernel_layer.canonicalize(module.vol.offset) - for module in modxview.Modxview.flatten_run_modules_results( - known_modules - ) - ) - modules_memory_boundaries = ( - hidden_modules.Hidden_modules.get_modules_memory_boundaries( - context, kernel_name - ) - ) - known_modules["hidden_modules"] = list( - hidden_modules.Hidden_modules.get_hidden_modules( - context, - kernel_name, - known_modules_addresses, - modules_memory_boundaries, - ) - ) - # Lookup the updated list to see if hidden_modules was able - # to find the missing module - module = linux_utilities_modules.Modules.module_lookup_by_address( + mod_info, callback_symbol = ( + linux_utilities_modules.Modules.module_lookup_by_address( context, - kernel.layer_name, - modxview.Modxview.flatten_run_modules_results(known_modules), + kernel_module_name, + known_modules, callback, ) + ) - # Fetch more information about the module - if module is not None: - module_address = module.vol.offset - module_name = module.get_name() - callback_symbol = module.get_symbol_by_address(callback) + if mod_info: + module_address = mod_info.start + module_name = mod_info.name else: - vollog.warning( + callback_symbol = module_address = module_name = None + + vollog.debug( f"Could not determine ftrace_ops@{ftrace_ops.vol.offset:#x} callback {callback:#x} module origin.", ) @@ -264,16 +217,15 @@ if the "hidden_modules" key is present in known_modules. kernel = self.context.modules[kernel_name] if not kernel.has_symbol("ftrace_ops_list"): - raise exceptions.SymbolError( - "ftrace_ops_list", - kernel.symbol_table_name, - 'The provided symbol table does not include the "ftrace_ops_list" symbol. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupted.', + vollog.error( + 'The provided symbol table does not include the "ftrace_ops_list" symbol. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupted.' ) + return - # Do not run hidden_modules by default, but only on failure to find a module - known_modules = modxview.Modxview.run_modules_scanners( - self.context, kernel_name, run_hidden_modules=False + known_modules = linux_utilities_modules.Modules.run_modules_scanners( + self.context, kernel_name, run_hidden_modules=True ) + for ftrace_ops in self.iterate_ftrace_ops_list(self.context, kernel_name): for ftrace_ops_parsed in self.parse_ftrace_ops( self.context, diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index f8edcc5b7..fe6d11af9 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -9,11 +9,9 @@ from typing import Dict, Iterable, List, Optional from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.plugins.linux import hidden_modules, modxview from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, NotAvailableValue, TreeGrid -from volatility3.framework.symbols.linux import extensions from volatility3.framework.objects import utility from volatility3.framework.constants import architectures @@ -54,15 +52,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(1, 1, 0), - ), - requirements.PluginRequirement( - name="modxview", plugin=modxview.Modxview, version=(1, 0, 0) - ), - requirements.PluginRequirement( - name="hidden_modules", - plugin=hidden_modules.Hidden_modules, - version=(1, 0, 0), + version=(2, 0, 0), ), ] @@ -105,15 +95,15 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): def parse_tracepoint( cls, context: interfaces.context.ContextInterface, - kernel_name: str, - known_modules: Dict[str, List[extensions.module]], + kernel_module_name: str, + known_modules: Dict[str, List[linux_utilities_modules.Modules.ModuleInfo]], tracepoint: interfaces.objects.ObjectInterface, run_hidden_modules: bool = True, ) -> Optional[Iterable[ParsedTracepointFunc]]: """Parse a tracepoint struct to highlight tracepoints kernel hooking. Args: - known_modules: A dict of known modules, used to locate callbacks origin. Typically obtained through modxview.run_modules_scanners(). + known_modules: A dict of known modules, used to locate callbacks origin. Typically obtained through run_modules_scanners(). tracepoint: The tracepoint struct to parse run_hidden_modules: Whether to run the hidden_modules plugin or not. Note: it won't be run, even if specified, \ if the "hidden_modules" key is present in known_modules. @@ -121,11 +111,10 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): Yields: An iterable of ParsedTracepointFunc dataclasses, containing a selection of useful fields related to a tracepoint struct """ - kernel = context.modules[kernel_name] - kernel_layer = context.layers[kernel.layer_name] + kernel = context.modules[kernel_module_name] for tracepoint_func in cls.iterate_tracepoint_funcs( - context, kernel_layer.name, tracepoint + context, kernel.layer_name, tracepoint ): try: tracepoint_name = utility.pointer_to_string(tracepoint.name, count=512) @@ -139,56 +128,19 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): probe_handler_symbol = module_address = module_name = None # Try to lookup within the known modules if the probe_handler address fits - module = linux_utilities_modules.Modules.module_lookup_by_address( - context, - kernel.layer_name, - modxview.Modxview.flatten_run_modules_results(known_modules), - probe_handler_address, - ) - # Run hidden_modules plugin if a probe handler origin couldn't be determined (only done once, results are re-used afterwards) - if ( - module is None - and run_hidden_modules - and "hidden_modules" not in known_modules - ): - vollog.info( - "A probe handler module origin could not be determined. hidden_modules plugin will be run to detect additional modules.", - ) - known_modules_addresses = set( - kernel_layer.canonicalize(module.vol.offset) - for module in modxview.Modxview.flatten_run_modules_results( - known_modules - ) - ) - modules_memory_boundaries = ( - hidden_modules.Hidden_modules.get_modules_memory_boundaries( - context, kernel_name - ) - ) - known_modules["hidden_modules"] = list( - hidden_modules.Hidden_modules.get_hidden_modules( - context, - kernel_name, - known_modules_addresses, - modules_memory_boundaries, - ) - ) - # Lookup the updated list to see if hidden_modules was able - # to find the missing module - module = linux_utilities_modules.Modules.module_lookup_by_address( + mod_info, probe_handler_symbol = ( + linux_utilities_modules.Modules.module_lookup_by_address( context, - kernel.layer_name, - modxview.Modxview.flatten_run_modules_results(known_modules), + kernel_module_name, + known_modules, probe_handler_address, ) + ) # Fetch more information about the module - if module is not None: - module_address = module.vol.offset - module_name = module.get_name() - probe_handler_symbol = module.get_symbol_by_address( - probe_handler_address - ) + if mod_info is not None: + module_address = mod_info.offset + module_name = mod_info.name else: vollog.debug( f"Could not determine tracepoint@{tracepoint.vol.offset:#x} probe handler {probe_handler_address:#x} module origin.", @@ -276,7 +228,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): ) return - known_modules = modxview.Modxview.run_modules_scanners( + known_modules = linux_utilities_modules.Modules.run_modules_scanners( self.context, kernel_name, run_hidden_modules=False ) tracepoints = self.iterate_tracepoints_array(self.context, kernel_name) diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index 742bacb0b..281d46eda 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -33,7 +33,7 @@ class tty_check(plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(1, 0, 0), + version=(2, 0, 0), ), requirements.PluginRequirement( name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index c443c37e1..8d7cbcae1 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -1,6 +1,7 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # + import math import string import contextlib @@ -367,9 +368,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): yield fd_num, filp, full_path @classmethod - @Deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.mask_mods_list, - replacement_version=(1, 0, 0), + @Deprecation.method_being_removed( + "This method is not needed. The correct API for mapping kernel pointers to modules is `linux_utilities_modules.Modules.run_module_scanners`" ) def mask_mods_list( cls, @@ -385,6 +385,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return linux_utilities_modules.Modules.mask_mods_list(context, layer_name, mods) @classmethod + @Deprecation.method_being_removed( + "The correct API for mapping kernel pointers to modules is `linux_utilities_modules.Modules.run_module_scanners`" + ) def generate_kernel_handler_info( cls, context: interfaces.context.ContextInterface, @@ -392,6 +395,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): mods_list: Iterator[interfaces.objects.ObjectInterface], ) -> List[Tuple[str, int, int]]: """ + This method is being deprecated. Use `linux_utilities_modules.Modules.run_module_scanners` to map kernel pointers to modules") + A helper function that gets the beginning and end address of the kernel module """ @@ -414,7 +419,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @Deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.lookup_module_address, - replacement_version=(1, 0, 0), + replacement_version=(2, 0, 0), ) def lookup_module_address( cls, diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index d03e76c88..8f242a169 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -1,32 +1,54 @@ +import logging import warnings -from typing import Iterable, Iterator, List, Optional, Tuple +from typing import Iterable, Iterator, List, Optional, Tuple, NamedTuple, Dict, Set from volatility3 import framework -from volatility3.framework import constants, interfaces +from volatility3.framework import ( + constants, + interfaces, + Deprecation, + exceptions, + objects, +) from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions +vollog = logging.getLogger(__name__) + class Modules(interfaces.configuration.VersionableInterface): """Kernel modules related utilities.""" - _version = (1, 1, 0) + _version = (2, 0, 0) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) - @classmethod + class ModuleInfo(NamedTuple): + """ + Used to track the name and boundary of a kernel module + """ + + offset: int + name: str + start: int + end: int + + @staticmethod def module_lookup_by_address( - cls, context: interfaces.context.ContextInterface, - layer_name: str, - modules: Iterable[extensions.module], + kernel_module_name: str, + modules: Iterable[ModuleInfo], target_address: int, - ) -> Optional[extensions.module]: + run_hidden_modules: bool = True, + ) -> Optional[Tuple[ModuleInfo, Optional[str]]]: """ Determine if a target address lies in a module memory space. Returns the module where the provided address lies. + `modules` must contain masked addresses via `get_module_info_for_module` or + a ValueError will be thrown + Args: context: The context on which to operate layer_name: The name of the layer on which to operate @@ -34,44 +56,66 @@ class Modules(interfaces.configuration.VersionableInterface): target_address: The address to check for a match Returns: - The first memory module in which the address fits + The first memory module in which the address fits and the symbol name for `target_address` Kernel documentation: "within_module" and "within_module_mem_type" functions """ - matches = [] - seen_addresses = set() - for module in modules: - _, start, end = cls.mask_mods_list(context, layer_name, [module])[0] - if ( - start <= target_address < end - and module.vol.offset not in seen_addresses - ): - matches.append(module) - seen_addresses.add(module.vol.offset) + kernel = context.modules[kernel_module_name] - if len(matches) > 1: - warnings.warn( - f"Address {hex(target_address)} fits in modules at {[hex(module.vol.offset) for module in matches]}, indicating potential modules memory space overlap.", - UserWarning, + kernel_layer = context.layers[kernel.layer_name] + + if modules[0].start != modules[0].start & kernel_layer.address_mask: + raise ValueError( + "Modules list must be gathered from `run_modules_scanners` to be used in this function" ) - return matches[0] - elif len(matches) == 1: - return matches[0] - return None + matches = [] + for module in modules: + if module.start <= target_address < module.end: + matches.append(module) + + if len(matches) >= 1: + if len(matches) > 1: + warnings.warn( + f"Address {hex(target_address)} fits in modules at {[hex(module.start) for module in matches]}, indicating potential modules memory space overlap.", + UserWarning, + ) + + symbol_name = None + + match = matches[0] + + if match.name == constants.linux.KERNEL_NAME: + symbols = list(kernel.get_symbols_by_absolute_location(target_address)) + + if len(symbols): + symbol_name = symbols[0] + else: + module = kernel.object("module", offset=module.offset, absolute=True) + symbol_name = module.get_symbol_by_address(target_address) + + if symbol_name: + symbol_name = symbol_name.split(constants.BANG)[1] + + return match, symbol_name + + return None, None @classmethod + @Deprecation.method_being_removed( + "This method is not needed. The correct API for mapping kernel pointers to modules is `linux_utilities_modules.Modules.run_module_scanners`" + ) def mask_mods_list( cls, context: interfaces.context.ContextInterface, - layer_name: str, - mods: Iterator[interfaces.objects.ObjectInterface], - ) -> List[Tuple[str, int, int]]: + kernel_layer_name: str, + mods: Iterator[extensions.module], + ) -> List[extensions.module]: """ A helper function to mask the starting and end address of kernel modules """ - mask = context.layers[layer_name].address_mask + mask = context.layers[kernel_layer_name].address_mask return [ ( @@ -83,6 +127,9 @@ class Modules(interfaces.configuration.VersionableInterface): ] @classmethod + @Deprecation.method_being_removed( + "Use `module_lookup_by_address` to map address to their hosting kernel module and symbol." + ) def lookup_module_address( cls, context: interfaces.context.ContextInterface, @@ -116,3 +163,369 @@ class Modules(interfaces.configuration.VersionableInterface): break return mod_name, symbol_name + + @classmethod + def get_module_info_for_module( + cls, address_mask: int, module: extensions.module + ) -> Optional[ModuleInfo]: + """ + Returns a ModuleInfo instance for `module` + + This performs address masking to avoid endless calls to `mask_mods_list` + + Returns None if the name is smeared + """ + try: + mod_name = utility.array_to_string(module.name) + except exceptions.InvalidAddressException: + return None + + start = module.get_module_base() & address_mask + + end = start + module.get_core_size() + + return Modules.ModuleInfo(module.vol.offset, mod_name, start, end) + + @staticmethod + def get_kernel_module_info( + context: interfaces.context.ContextInterface, + kernel_module_name: str, + ) -> ModuleInfo: + """ + Returns a ModuleInfo instance that encodes the kernel + This is required to map function pointers to the kerenl executable + """ + kernel = context.modules[kernel_module_name] + + mask = context.layers[kernel.layer_name].address_mask + + start_addr = kernel.object_from_symbol("_text") + start_addr = start_addr.vol.offset & mask + + end_addr = kernel.object_from_symbol("_etext") + end_addr = end_addr.vol.offset & mask + + return Modules.ModuleInfo( + start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr + ) + + @classmethod + def run_modules_scanners( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + run_hidden_modules: bool = True, + flatten: bool = True, + ) -> Dict[str, List[ModuleInfo]]: + """Run module scanning plugins and aggregate the results. It is designed + to not operate any inter-plugin results triage. + + Args: + run_hidden_modules: specify if the hidden_modules plugin should be run + Returns: + Dictionary mapping each plugin to its corresponding result + """ + + kernel = context.modules[kernel_name] + + address_mask = context.layers[kernel.layer_name].address_mask + + run_results = {} + + # the kernel module boundaries + run_results["kernel"] = [cls.get_kernel_module_info(context, kernel_name)] + + # lsmod + run_results["lsmod"] = [] + + for module in cls.list_modules(context, kernel_name): + modinfo = cls.get_module_info_for_module(address_mask, module) + if modinfo: + run_results["lsmod"].append(modinfo) + + # check_modules + run_results["check_modules"] = [] + + sysfs_modules: dict = cls.get_kset_modules(context, kernel_name) + + for m_offset in sysfs_modules.values(): + module = kernel.object(object_type="module", offset=m_offset, absolute=True) + modinfo = cls.get_module_info_for_module(address_mask, module) + if modinfo: + run_results["check_modules"].append(modinfo) + + # hidden_modules + if run_hidden_modules: + known_modules_addresses = set( + context.layers[kernel.layer_name].canonicalize(modinfo.start) + for modinfo in run_results["kernel"] + + run_results["lsmod"] + + run_results["check_modules"] + ) + modules_memory_boundaries = cls.get_modules_memory_boundaries( + context, kernel_name + ) + run_results["hidden_modules"] = [] + + for module in cls.get_hidden_modules( + context, + kernel_name, + known_modules_addresses, + modules_memory_boundaries, + ): + modinfo = cls.get_module_info_for_module(address_mask, module) + if modinfo: + run_results["hidden_modules"].append(modinfo) + + if flatten: + return cls.flatten_run_modules_results(run_results) + + return run_results + + @staticmethod + def get_modules_memory_boundaries( + context: interfaces.context.ContextInterface, + vmlinux_module_name: str, + ) -> Tuple[int, int]: + """Determine the boundaries of the module allocation area + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + vmlinux_module_name: The name of the kernel module on which to operate + + Returns: + A tuple containing the minimum and maximum addresses for the module allocation area. + """ + vmlinux = context.modules[vmlinux_module_name] + if vmlinux.has_symbol("mod_tree"): + # Kernel >= 5.19 58d208de3e8d87dbe196caf0b57cc58c7a3836ca + mod_tree = vmlinux.object_from_symbol("mod_tree") + modules_addr_min = mod_tree.addr_min + modules_addr_max = mod_tree.addr_max + elif vmlinux.has_symbol("module_addr_min"): + # 2.6.27 <= kernel < 5.19 3a642e99babe0617febb6f402e1e063479f489db + modules_addr_min = vmlinux.object_from_symbol("module_addr_min") + modules_addr_max = vmlinux.object_from_symbol("module_addr_max") + + if isinstance(modules_addr_min, objects.Void): + raise exceptions.VolatilityException( + "Your ISF symbols lack type information. You may need to update the" + "ISF using the latest version of dwarf2json" + ) + else: + raise exceptions.VolatilityException( + "Cannot find the module memory allocation area. Unsupported kernel" + ) + + return modules_addr_min, modules_addr_max + + @classmethod + def flatten_run_modules_results( + cls, run_results: Dict[str, List[ModuleInfo]], deduplicate: bool = True + ) -> List[ModuleInfo]: + """Flatten a dictionary mapping plugin names and modules list, to a single merged list. + This is useful to get a generic lookup list of all the detected modules. + + Args: + run_results: dictionary of plugin names mapping a list of detected modules + deduplicate: remove duplicate modules, based on their offsets + + Returns: + List of ModuleInfo objects + """ + uniq_modules: List[Modules.ModuleInfo] = [] + + seen_addresses: int = set() + + for modules in run_results.values(): + for module in modules: + if deduplicate and (module.start in seen_addresses): + continue + seen_addresses.add(module.start) + uniq_modules.append(module) + + return uniq_modules + + @classmethod + def get_hidden_modules( + cls, + context: interfaces.context.ContextInterface, + vmlinux_module_name: str, + known_module_addresses: Set[int], + modules_memory_boundaries: Tuple, + ) -> Iterable[interfaces.objects.ObjectInterface]: + """Enumerate hidden modules by taking advantage of memory address alignment patterns + + This technique is much faster and uses less memory than the traditional scan method + in Volatility2, but it doesn't work with older kernels. + + From kernels 4.2 struct module allocation are aligned to the L1 cache line size. + In i386/amd64/arm64 this is typically 64 bytes. However, this can be changed in + the Linux kernel configuration via CONFIG_X86_L1_CACHE_SHIFT. The alignment can + also be obtained from the DWARF info i.e. DW_AT_alignment<64>, but dwarf2json + doesn't support this feature yet. + In kernels < 4.2, alignment attributes are absent in the struct module, meaning + alignment cannot be guaranteed. Therefore, for older kernels, it's better to use + the traditional scan technique. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + vmlinux_module_name: The name of the kernel module on which to operate + known_module_addresses: Set with known module addresses + modules_memory_boundaries: Minimum and maximum address boundaries for module allocation. + Yields: + module objects + """ + vmlinux = context.modules[vmlinux_module_name] + vmlinux_layer = context.layers[vmlinux.layer_name] + + module_addr_min, module_addr_max = modules_memory_boundaries + module_address_alignment = cls.get_module_address_alignment( + context, vmlinux_module_name + ) + if not cls.validate_alignment_patterns( + known_module_addresses, module_address_alignment + ): + vollog.warning( + f"Module addresses aren't aligned to {module_address_alignment} bytes. " + "Switching to 1 byte aligment scan method." + ) + module_address_alignment = 1 + + mkobj_offset = vmlinux.get_type("module").relative_child_offset("mkobj") + mod_offset = vmlinux.get_type("module_kobject").relative_child_offset("mod") + offset_to_mkobj_mod = mkobj_offset + mod_offset + mod_member_template = vmlinux.get_type("module_kobject").child_template("mod") + mod_size = mod_member_template.size + mod_member_data_format = mod_member_template.data_format + + for module_addr in range( + module_addr_min, module_addr_max, module_address_alignment + ): + if module_addr in known_module_addresses: + continue + + try: + # This is just a pre-filter. Module readability and consistency are verified in module.is_valid() + self_referential_bytes = vmlinux_layer.read( + module_addr + offset_to_mkobj_mod, mod_size + ) + self_referential = objects.convert_data_to_value( + self_referential_bytes, int, mod_member_data_format + ) + if self_referential != module_addr: + continue + except ( + exceptions.PagedInvalidAddressException, + exceptions.InvalidAddressException, + ): + continue + + module = vmlinux.object("module", offset=module_addr, absolute=True) + if module and module.is_valid(): + yield module + + @classmethod + def get_module_address_alignment( + cls, + context: interfaces.context.ContextInterface, + vmlinux_module_name: str, + ) -> int: + """Obtain the module memory address alignment. + + struct module is aligned to the L1 cache line, which is typically 64 bytes for most + common i386/AMD64/ARM64 configurations. In some cases, it can be 128 bytes, but this + will still work. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + vmlinux_module_name: The name of the kernel module on which to operate + + Returns: + The struct module alignment + """ + # FIXME: When dwarf2json/ISF supports type alignments. Read it directly from the type metadata + # Additionally, while 'context' and 'vmlinux_module_name' are currently unused, they will be + # essential for retrieving type metadata in the future. + return 64 + + @classmethod + def list_modules( + cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str + ) -> Iterable[interfaces.objects.ObjectInterface]: + """Lists all the modules in the primary layer. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + layer_name: The name of the layer on which to operate + vmlinux_symbols: The name of the table containing the kernel symbols + + Yields: + The modules present in the `layer_name` layer's modules list + + This function will throw a SymbolError exception if kernel module support is not enabled. + """ + vmlinux = context.modules[vmlinux_module_name] + + modules = vmlinux.object_from_symbol(symbol_name="modules").cast("list_head") + + table_name = modules.vol.type_name.split(constants.BANG)[0] + + yield from modules.to_list(table_name + constants.BANG + "module", "list") + + @classmethod + def get_kset_modules( + cls, context: interfaces.context.ContextInterface, vmlinux_name: str + ) -> Dict[str, extensions.module]: + vmlinux = context.modules[vmlinux_name] + + try: + module_kset = vmlinux.object_from_symbol("module_kset") + except exceptions.SymbolError: + module_kset = None + + if not module_kset: + raise TypeError( + "This plugin requires the module_kset structure. This structure is not present in the supplied symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." + ) + + ret = {} + + kobj_off = vmlinux.get_type("module_kobject").relative_child_offset("kobj") + + for kobj in module_kset.list.to_list( + vmlinux.symbol_table_name + constants.BANG + "kobject", "entry" + ): + mod_kobj = vmlinux.object( + object_type="module_kobject", + offset=kobj.vol.offset - kobj_off, + absolute=True, + ) + + mod = mod_kobj.mod + + try: + name = utility.pointer_to_string(kobj.name, 32) + except exceptions.InvalidAddressException: + continue + + if kobj.name and kobj.reference_count() > 2: + ret[name] = mod + + return ret + + @staticmethod + def validate_alignment_patterns( + addresses: Iterable[int], + address_alignment: int, + ) -> bool: + """Check if the memory addresses meet our alignments patterns + + Args: + addresses: Iterable with the address values + address_alignment: Number of bytes for alignment validation + + Returns: + True if all the addresses meet the alignment + """ + return all(addr % address_alignment == 0 for addr in addresses) From 2ead4d3dc6c9ff801eace48a84de275dec14eee4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 00:10:20 +0000 Subject: [PATCH 0744/1352] update for black --- volatility3/framework/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 333e7909f..20f30714d 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -75,7 +75,10 @@ class Deprecation: def decorator(deprecated_func): @functools.wraps(deprecated_func) def wrapper(*args, **kwargs): - warnings.warn(f"This API ({deprecated_func.__module__}.{deprecated_func.__qualname__}) will be removed in a release very soon. {message}", FutureWarning) + warnings.warn( + f"This API ({deprecated_func.__module__}.{deprecated_func.__qualname__}) will be removed in a release very soon. {message}", + FutureWarning, + ) return deprecated_func(*args, **kwargs) return wrapper From 636bb10f9f1290edb02b6ed7b506400cc4be0e7d Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 14:04:37 -0600 Subject: [PATCH 0745/1352] Update volatility3/framework/plugins/linux/hidden_modules.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/hidden_modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 0b93cfacc..7fa8e1d4f 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -3,7 +3,7 @@ # import logging from typing import List, Set, Tuple, Iterable -import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.framework.symbols.linux.utilities import modules as linux_utilities_modules from volatility3.framework import renderers, interfaces, exceptions, Deprecation from volatility3.framework.constants import architectures from volatility3.framework.renderers import format_hints From 00678fbf19cb3fe230d332ed5abd1e429faa6d8c Mon Sep 17 00:00:00 2001 From: ikelos Date: Sat, 8 Mar 2025 20:37:55 +0000 Subject: [PATCH 0746/1352] Update volatility3/framework/plugins/linux/hidden_modules.py Ensure black doesn't complain --- volatility3/framework/plugins/linux/hidden_modules.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 7fa8e1d4f..948a8cce6 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -3,7 +3,9 @@ # import logging from typing import List, Set, Tuple, Iterable -from volatility3.framework.symbols.linux.utilities import modules as linux_utilities_modules +from volatility3.framework.symbols.linux.utilities import ( + modules as linux_utilities_modules, +) from volatility3.framework import renderers, interfaces, exceptions, Deprecation from volatility3.framework.constants import architectures from volatility3.framework.renderers import format_hints From 6a32aa4b6a3313b8abba027e38a56f10d67c054f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 21:39:50 +0000 Subject: [PATCH 0747/1352] Deprecation API updates --- volatility3/framework/__init__.py | 78 +------------------ .../framework/plugins/linux/check_modules.py | 4 +- .../framework/plugins/linux/hidden_modules.py | 8 +- volatility3/framework/plugins/linux/lsmod.py | 4 +- .../framework/plugins/linux/modxview.py | 6 +- .../framework/symbols/linux/__init__.py | 12 +-- .../symbols/linux/utilities/modules.py | 10 +-- 7 files changed, 24 insertions(+), 98 deletions(-) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 20f30714d..0bbdefa43 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -11,12 +11,9 @@ import inspect import logging import os import traceback -import functools -import warnings -from typing import Any, Callable, Dict, Generator, List, Optional, Tuple, Type, TypeVar +from typing import Any, Dict, Generator, List, Optional, Tuple, Type, TypeVar -from volatility3.framework import constants, exceptions, interfaces -from volatility3.framework.configuration import requirements +from volatility3.framework import constants, interfaces if ( sys.version_info.major != constants.REQUIRED_PYTHON_VERSION[0] @@ -66,77 +63,6 @@ def require_interface_version(*args) -> None: ) -class Deprecation: - """Deprecation related methods.""" - - @staticmethod - def method_being_removed(message: str): - - def decorator(deprecated_func): - @functools.wraps(deprecated_func) - def wrapper(*args, **kwargs): - warnings.warn( - f"This API ({deprecated_func.__module__}.{deprecated_func.__qualname__}) will be removed in a release very soon. {message}", - FutureWarning, - ) - return deprecated_func(*args, **kwargs) - - return wrapper - - return decorator - - @staticmethod - def deprecated_method( - replacement: Callable, - replacement_version: Tuple[int, int, int] = None, - additional_information: str = "", - ): - """A decorator for marking functions as deprecated. - - Args: - replacement: The replacement function overriding the deprecated API, in the form of a Callable (typically a method) - replacement_version: The "replacement" base class version that the deprecated method expects before proxying to it. This implies that "replacement" is a method from a class that inherits from VersionableInterface. - additional_information: Information appended at the end of the deprecation message - """ - - def decorator(deprecated_func): - @functools.wraps(deprecated_func) - def wrapper(*args, **kwargs): - nonlocal replacement, replacement_version, additional_information - # Prevent version mismatches between deprecated (proxy) methods and the ones they proxy - if ( - replacement_version is not None - and callable(replacement) - and hasattr(replacement, "__self__") - ): - replacement_base_class = replacement.__self__ - - # Verify that the base class inherits from VersionableInterface - if inspect.isclass(replacement_base_class) and issubclass( - replacement_base_class, - interfaces.configuration.VersionableInterface, - ): - # SemVer check - if not requirements.VersionRequirement.matches_required( - replacement_version, replacement_base_class.version - ): - raise exceptions.VersionMismatchException( - deprecated_func, - replacement_base_class, - replacement_version, - "This is a bug, the deprecated call needs to be removed and the caller needs to update their code to use the new method.", - ) - - deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__qualname__}\" is deprecated, use \"{replacement.__module__ + '.' + replacement.__qualname__}\" instead. {additional_information}" - warnings.warn(deprecation_msg, FutureWarning) - # Return the wrapped function with its original arguments - return deprecated_func(*args, **kwargs) - - return wrapper - - return decorator - - class NonInheritable: def __init__(self, value: Any, cls: Type) -> None: self.default_value = value diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 8d2d0c746..c6cf4e22e 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -6,7 +6,7 @@ import logging from typing import List, Dict import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, renderers, Deprecation +from volatility3.framework import interfaces, renderers, deprecation from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -38,7 +38,7 @@ class Check_modules(plugins.PluginInterface): ] @classmethod - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_kset_modules, replacement_version=(2, 0, 0), ) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 948a8cce6..87cd5f6aa 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -40,7 +40,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): ] @staticmethod - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, replacement_version=(2, 0, 0), ) @@ -52,7 +52,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): context, vmlinux_module_name ) - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_module_address_alignment, replacement_version=(2, 0, 0), ) @@ -79,7 +79,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): context, vmlinux_module_name ) - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_hidden_modules, replacement_version=(2, 0, 0), ) @@ -118,7 +118,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): ) @staticmethod - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.validate_alignment_patterns, replacement_version=(2, 0, 0), ) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index be3970a5b..728466afa 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -7,7 +7,7 @@ import logging from typing import List, Iterable import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import exceptions, renderers, interfaces, Deprecation +from volatility3.framework import exceptions, renderers, interfaces, deprecation from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -38,7 +38,7 @@ class Lsmod(plugins.PluginInterface): ] @classmethod - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.list_modules, replacement_version=(2, 0, 0), ) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index d05f16458..09e12fe87 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -6,7 +6,7 @@ from typing import List, Dict, Iterator import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, Deprecation +from volatility3.framework import interfaces, deprecation from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue from volatility3.framework.symbols.linux import extensions @@ -48,7 +48,7 @@ spot modules presence and taints.""" ] @classmethod - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.flatten_run_modules_results, replacement_version=(2, 0, 0), ) @@ -70,7 +70,7 @@ spot modules presence and taints.""" ) @classmethod - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.run_modules_scanners, replacement_version=(2, 0, 0), ) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 8d7cbcae1..49081cb08 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -15,9 +15,9 @@ from volatility3 import framework from volatility3.framework import ( constants, exceptions, + deprecation, interfaces, objects, - Deprecation, ) from volatility3.framework.objects import utility from volatility3.framework.symbols import intermed @@ -368,8 +368,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): yield fd_num, filp, full_path @classmethod - @Deprecation.method_being_removed( - "This method is not needed. The correct API for mapping kernel pointers to modules is `linux_utilities_modules.Modules.run_module_scanners`" + @deprecation.method_being_removed( + "Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`" ) def mask_mods_list( cls, @@ -385,8 +385,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return linux_utilities_modules.Modules.mask_mods_list(context, layer_name, mods) @classmethod - @Deprecation.method_being_removed( - "The correct API for mapping kernel pointers to modules is `linux_utilities_modules.Modules.run_module_scanners`" + @deprecation.method_being_removed( + "Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`" ) def generate_kernel_handler_info( cls, @@ -417,7 +417,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): ) @classmethod - @Deprecation.deprecated_method( + @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.lookup_module_address, replacement_version=(2, 0, 0), ) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 8f242a169..c1c6dbd86 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -6,7 +6,7 @@ from volatility3 import framework from volatility3.framework import ( constants, interfaces, - Deprecation, + deprecation, exceptions, objects, ) @@ -103,15 +103,15 @@ class Modules(interfaces.configuration.VersionableInterface): return None, None @classmethod - @Deprecation.method_being_removed( - "This method is not needed. The correct API for mapping kernel pointers to modules is `linux_utilities_modules.Modules.run_module_scanners`" + @deprecation.method_being_removed( + "Code using this function should adapt `linux_utilities_modules.Modules.run_module_scanners`" ) def mask_mods_list( cls, context: interfaces.context.ContextInterface, kernel_layer_name: str, mods: Iterator[extensions.module], - ) -> List[extensions.module]: + ) -> List[Tuple[str, int, int]]: """ A helper function to mask the starting and end address of kernel modules """ @@ -127,7 +127,7 @@ class Modules(interfaces.configuration.VersionableInterface): ] @classmethod - @Deprecation.method_being_removed( + @deprecation.method_being_removed( "Use `module_lookup_by_address` to map address to their hosting kernel module and symbol." ) def lookup_module_address( From b68b4f3e72943508b815b54047a3340cfd372318 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 21:42:23 +0000 Subject: [PATCH 0748/1352] Bring back change after merge conflict --- volatility3/framework/plugins/linux/hidden_modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 87cd5f6aa..260eb8d21 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -6,7 +6,7 @@ from typing import List, Set, Tuple, Iterable from volatility3.framework.symbols.linux.utilities import ( modules as linux_utilities_modules, ) -from volatility3.framework import renderers, interfaces, exceptions, Deprecation +from volatility3.framework import renderers, interfaces, exceptions, deprecation from volatility3.framework.constants import architectures from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements From 4a87bf506ac95c36e9e354fa2d6780a56d31bcb4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 21:46:21 +0000 Subject: [PATCH 0749/1352] Add new deprecation module --- volatility3/framework/deprecation.py | 81 ++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) create mode 100644 volatility3/framework/deprecation.py diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py new file mode 100644 index 000000000..fca7115c3 --- /dev/null +++ b/volatility3/framework/deprecation.py @@ -0,0 +1,81 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +# This file contains the Deprecation class used to deprecate methods in an orderly manner + +import warnings +import functools +import inspect + +from typing import Callable, Tuple + +from volatility3.framework import interfaces, exceptions +from volatility3.framework.configuration import requirements + + +def method_being_removed(message: str): + + def decorator(deprecated_func): + @functools.wraps(deprecated_func) + def wrapper(*args, **kwargs): + warnings.warn( + f"This API ({deprecated_func.__module__}.{deprecated_func.__qualname__}) will be removed in a release very soon. {message}", + FutureWarning, + ) + return deprecated_func(*args, **kwargs) + + return wrapper + + return decorator + + +def deprecated_method( + replacement: Callable, + replacement_version: Tuple[int, int, int] = None, + additional_information: str = "", +): + """A decorator for marking functions as deprecated. + + Args: + replacement: The replacement function overriding the deprecated API, in the form of a Callable (typically a method) + replacement_version: The "replacement" base class version that the deprecated method expects before proxying to it. This implies that "replacement" is a method from a class that inherits from VersionableInterface. + additional_information: Information appended at the end of the deprecation message + """ + + def decorator(deprecated_func): + @functools.wraps(deprecated_func) + def wrapper(*args, **kwargs): + nonlocal replacement, replacement_version, additional_information + # Prevent version mismatches between deprecated (proxy) methods and the ones they proxy + if ( + replacement_version is not None + and callable(replacement) + and hasattr(replacement, "__self__") + ): + replacement_base_class = replacement.__self__ + + # Verify that the base class inherits from VersionableInterface + if inspect.isclass(replacement_base_class) and issubclass( + replacement_base_class, + interfaces.configuration.VersionableInterface, + ): + # SemVer check + if not requirements.VersionRequirement.matches_required( + replacement_version, replacement_base_class.version + ): + raise exceptions.VersionMismatchException( + deprecated_func, + replacement_base_class, + replacement_version, + "This is a bug, the deprecated call needs to be removed and the caller needs to update their code to use the new method.", + ) + + deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__qualname__}\" is deprecated, use \"{replacement.__module__ + '.' + replacement.__qualname__}\" instead. {additional_information}" + warnings.warn(deprecation_msg, FutureWarning) + # Return the wrapped function with its original arguments + return deprecated_func(*args, **kwargs) + + return wrapper + + return decorator From 6cabb0586b3f836a2012b94b4e9cfa577b181b80 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 9 Mar 2025 03:48:48 +0000 Subject: [PATCH 0750/1352] Add removal_date to deprecation API --- volatility3/framework/deprecation.py | 10 +++++----- volatility3/framework/plugins/linux/check_modules.py | 1 + volatility3/framework/plugins/linux/hidden_modules.py | 4 ++++ volatility3/framework/plugins/linux/lsmod.py | 1 + volatility3/framework/plugins/linux/modxview.py | 2 ++ volatility3/framework/symbols/linux/__init__.py | 7 +++++-- .../framework/symbols/linux/utilities/modules.py | 6 ++++-- 7 files changed, 22 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index fca7115c3..728760671 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -14,13 +14,12 @@ from volatility3.framework import interfaces, exceptions from volatility3.framework.configuration import requirements -def method_being_removed(message: str): - +def method_being_removed(message: str, removal_date: str): def decorator(deprecated_func): @functools.wraps(deprecated_func) def wrapper(*args, **kwargs): warnings.warn( - f"This API ({deprecated_func.__module__}.{deprecated_func.__qualname__}) will be removed in a release very soon. {message}", + f"This API ({deprecated_func.__module__}.{deprecated_func.__qualname__}) will be removed in the first release after {removal_date}. {message}", FutureWarning, ) return deprecated_func(*args, **kwargs) @@ -32,8 +31,9 @@ def method_being_removed(message: str): def deprecated_method( replacement: Callable, + removal_date: str, replacement_version: Tuple[int, int, int] = None, - additional_information: str = "", + additional_information: str = "" ): """A decorator for marking functions as deprecated. @@ -71,7 +71,7 @@ def deprecated_method( "This is a bug, the deprecated call needs to be removed and the caller needs to update their code to use the new method.", ) - deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__qualname__}\" is deprecated, use \"{replacement.__module__ + '.' + replacement.__qualname__}\" instead. {additional_information}" + deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__qualname__}\" is deprecated and will be removed in the first release after {removal_date}, use \"{replacement.__module__ + '.' + replacement.__qualname__}\" instead. {additional_information}" warnings.warn(deprecation_msg, FutureWarning) # Return the wrapped function with its original arguments return deprecated_func(*args, **kwargs) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index c6cf4e22e..76f75ec50 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -40,6 +40,7 @@ class Check_modules(plugins.PluginInterface): @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_kset_modules, + removal_date="2025-09-25", replacement_version=(2, 0, 0), ) def get_kset_modules( diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 260eb8d21..9891bf138 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -42,6 +42,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, + removal_date="2025-09-25", replacement_version=(2, 0, 0), ) def get_modules_memory_boundaries( @@ -54,6 +55,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_module_address_alignment, + removal_date="2025-09-25", replacement_version=(2, 0, 0), ) @classmethod @@ -81,6 +83,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_hidden_modules, + removal_date="2025-09-25", replacement_version=(2, 0, 0), ) @classmethod @@ -120,6 +123,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.validate_alignment_patterns, + removal_date="2025-09-25", replacement_version=(2, 0, 0), ) def _validate_alignment_patterns( diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 728466afa..4f3275fa3 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -41,6 +41,7 @@ class Lsmod(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.list_modules, replacement_version=(2, 0, 0), + removal_date="2025-09-25" ) def list_modules( cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 09e12fe87..2928226b9 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -51,6 +51,7 @@ spot modules presence and taints.""" @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.flatten_run_modules_results, replacement_version=(2, 0, 0), + removal_date="2025-09-25" ) def flatten_run_modules_results( cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True @@ -73,6 +74,7 @@ spot modules presence and taints.""" @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.run_modules_scanners, replacement_version=(2, 0, 0), + removal_date="2025-09-25" ) def run_modules_scanners( cls, diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 49081cb08..0931dcabf 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -369,7 +369,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @deprecation.method_being_removed( - "Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`" + removal_date="2025-09-25", + message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`" ) def mask_mods_list( cls, @@ -386,7 +387,8 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @deprecation.method_being_removed( - "Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`" + removal_date="2025-09-25", + message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`" ) def generate_kernel_handler_info( cls, @@ -419,6 +421,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.lookup_module_address, + removal_date="2025-09-25", replacement_version=(2, 0, 0), ) def lookup_module_address( diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index c1c6dbd86..a4854e81b 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -104,7 +104,8 @@ class Modules(interfaces.configuration.VersionableInterface): @classmethod @deprecation.method_being_removed( - "Code using this function should adapt `linux_utilities_modules.Modules.run_module_scanners`" + removal_date="2025-09-25", + message="Code using this function should adapt `linux_utilities_modules.Modules.run_module_scanners`" ) def mask_mods_list( cls, @@ -128,7 +129,8 @@ class Modules(interfaces.configuration.VersionableInterface): @classmethod @deprecation.method_being_removed( - "Use `module_lookup_by_address` to map address to their hosting kernel module and symbol." + removal_date="2025-09-25", + message="Use `module_lookup_by_address` to map address to their hosting kernel module and symbol." ) def lookup_module_address( cls, From 3eae04c1e8bb8c4a551251b272fa5366ca097174 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 9 Mar 2025 03:49:35 +0000 Subject: [PATCH 0751/1352] Add removal_date to deprecation API --- volatility3/framework/deprecation.py | 2 +- volatility3/framework/plugins/linux/lsmod.py | 2 +- volatility3/framework/plugins/linux/modxview.py | 4 ++-- volatility3/framework/symbols/linux/__init__.py | 4 ++-- volatility3/framework/symbols/linux/utilities/modules.py | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index 728760671..e1a4d444e 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -33,7 +33,7 @@ def deprecated_method( replacement: Callable, removal_date: str, replacement_version: Tuple[int, int, int] = None, - additional_information: str = "" + additional_information: str = "", ): """A decorator for marking functions as deprecated. diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 4f3275fa3..b4f881801 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -41,7 +41,7 @@ class Lsmod(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.list_modules, replacement_version=(2, 0, 0), - removal_date="2025-09-25" + removal_date="2025-09-25", ) def list_modules( cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 2928226b9..f6a6f7727 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -51,7 +51,7 @@ spot modules presence and taints.""" @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.flatten_run_modules_results, replacement_version=(2, 0, 0), - removal_date="2025-09-25" + removal_date="2025-09-25", ) def flatten_run_modules_results( cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True @@ -74,7 +74,7 @@ spot modules presence and taints.""" @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.run_modules_scanners, replacement_version=(2, 0, 0), - removal_date="2025-09-25" + removal_date="2025-09-25", ) def run_modules_scanners( cls, diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 0931dcabf..758e142aa 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -370,7 +370,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @deprecation.method_being_removed( removal_date="2025-09-25", - message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`" + message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`", ) def mask_mods_list( cls, @@ -388,7 +388,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): @classmethod @deprecation.method_being_removed( removal_date="2025-09-25", - message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`" + message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`", ) def generate_kernel_handler_info( cls, diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index a4854e81b..560398f91 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -105,7 +105,7 @@ class Modules(interfaces.configuration.VersionableInterface): @classmethod @deprecation.method_being_removed( removal_date="2025-09-25", - message="Code using this function should adapt `linux_utilities_modules.Modules.run_module_scanners`" + message="Code using this function should adapt `linux_utilities_modules.Modules.run_module_scanners`", ) def mask_mods_list( cls, @@ -130,7 +130,7 @@ class Modules(interfaces.configuration.VersionableInterface): @classmethod @deprecation.method_being_removed( removal_date="2025-09-25", - message="Use `module_lookup_by_address` to map address to their hosting kernel module and symbol." + message="Use `module_lookup_by_address` to map address to their hosting kernel module and symbol.", ) def lookup_module_address( cls, From 7289f7dc70b77004bbf0c48d14ead436cfa925ff Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 03:27:56 +0000 Subject: [PATCH 0752/1352] Ensure that new symbol tables are only created when needed. Avoid name collisions leading to inconsistent behaviour. Make API for symbol table acquisition sane. --- .../framework/plugins/windows/modscan.py | 2 +- .../framework/plugins/windows/netscan.py | 2 +- .../framework/plugins/windows/poolscanner.py | 76 ++++++++++--------- .../framework/plugins/windows/psscan.py | 2 +- .../framework/plugins/windows/symlinkscan.py | 2 +- .../plugins/windows/windowstations.py | 2 +- 6 files changed, 45 insertions(+), 41 deletions(-) diff --git a/volatility3/framework/plugins/windows/modscan.py b/volatility3/framework/plugins/windows/modscan.py index 7330b2cb4..667fadd11 100644 --- a/volatility3/framework/plugins/windows/modscan.py +++ b/volatility3/framework/plugins/windows/modscan.py @@ -32,7 +32,7 @@ class ModScan(modules.Modules): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), requirements.VersionRequirement( name="modules", component=modules.Modules, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index 0c8523cce..1ab748864 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -34,7 +34,7 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), requirements.VersionRequirement( name="info", component=info.Info, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 5e75d9bbb..7dd6821b8 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -129,7 +129,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (3, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -423,6 +423,7 @@ class PoolScanner(plugins.PluginInterface): # scan in the main kernel layer for the object(s) for constraint, header in cls.pool_scan( context, + kernel_module_name, scan_layer, object_symbol_table_name, constraints, @@ -501,6 +502,7 @@ class PoolScanner(plugins.PluginInterface): def pool_scan( cls, context: interfaces.context.ContextInterface, + kernel_module_name: str, layer_name: str, symbol_table: str, pool_constraints: List[PoolConstraint], @@ -534,8 +536,16 @@ class PoolScanner(plugins.PluginInterface): ) constraint_lookup[constraint.tag] = constraint - pool_header_table_name = cls.get_pool_header_table(context, symbol_table) - module = context.module(pool_header_table_name, layer_name, offset=0) + kernel = context.modules[kernel_module_name] + + if kernel.has_type("_POOL_HEADER"): + pool_header_table_name = kernel.symbol_table_name + else: + pool_header_table_name = cls.get_pool_header_table(context, symbol_table) + + module = context.module( + pool_header_table_name, layer_name, offset=kernel.offset + ) # Run the scan locating the offsets of a particular tag layer = context.layers[layer_name] @@ -553,43 +563,37 @@ class PoolScanner(plugins.PluginInterface): context: The context that the symbol tables does (or will) reside in symbol_table: The expected symbol_table to contain the _POOL_HEADER type """ - # Setup the pool header and offset differential - try: - context.symbol_space.get_type( - symbol_table + constants.BANG + "_POOL_HEADER" - ) - table_name = symbol_table - except exceptions.SymbolError: - # We have to manually load a symbol table + # We have to manually load a symbol table - if symbols.symbol_table_is_64bit( - context=context, symbol_table_name=symbol_table - ): - is_win_7 = versions.is_windows_7(context, symbol_table) - if is_win_7: - pool_header_json_filename = "poolheader-x64-win7" - else: - pool_header_json_filename = "poolheader-x64" + if symbols.symbol_table_is_64bit( + context=context, symbol_table_name=symbol_table + ): + is_win_7 = versions.is_windows_7(context, symbol_table) + if is_win_7: + pool_header_json_filename = "poolheader-x64-win7" else: - pool_header_json_filename = "poolheader-x86" + pool_header_json_filename = "poolheader-x64" + else: + pool_header_json_filename = "poolheader-x86" - # set the class_type to match the normal WindowsKernelIntermedSymbols - is_vista_or_later = versions.is_vista_or_later(context, symbol_table) - if is_vista_or_later: - class_type = extensions.pool.POOL_HEADER_VISTA - else: - class_type = extensions.pool.POOL_HEADER + # set the class_type to match the normal WindowsKernelIntermedSymbols + is_vista_or_later = versions.is_vista_or_later(context, symbol_table) + if is_vista_or_later: + class_type = extensions.pool.POOL_HEADER_VISTA + else: + class_type = extensions.pool.POOL_HEADER + + table_name = intermed.IntermediateSymbolTable.create( + context=context, + config_path=configuration.path_join( + context.symbol_space[symbol_table].config_path, "poolheader" + ), + sub_path="windows", + filename=pool_header_json_filename, + table_mapping={"nt_symbols": symbol_table}, + class_types={"_POOL_HEADER": class_type}, + ) - table_name = intermed.IntermediateSymbolTable.create( - context=context, - config_path=configuration.path_join( - context.symbol_space[symbol_table].config_path, "poolheader" - ), - sub_path="windows", - filename=pool_header_json_filename, - table_mapping={"nt_symbols": symbol_table}, - class_types={"_POOL_HEADER": class_type}, - ) return table_name def run(self) -> renderers.TreeGrid: diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 45f935ceb..99fa9640b 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -40,7 +40,7 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): name="info", component=info.Info, version=(2, 0, 0) ), requirements.VersionRequirement( - name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py index 459129843..358ea130e 100644 --- a/volatility3/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -28,7 +28,7 @@ class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfa architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index 9d666e3dd..0ca92eb97 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -47,7 +47,7 @@ class WindowStations(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="poolscanner", component=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), requirements.VersionRequirement( name="modules", component=modules.Modules, version=(3, 0, 0) From b8c0b1eaa87d08b35aa42c1daa106668aa973a3c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 03:39:57 +0000 Subject: [PATCH 0753/1352] Add missing files --- volatility3/framework/plugins/windows/callbacks.py | 2 +- volatility3/framework/plugins/windows/driverscan.py | 2 +- volatility3/framework/plugins/windows/filescan.py | 2 +- volatility3/framework/plugins/windows/mutantscan.py | 2 +- volatility3/framework/plugins/windows/registry/hivescan.py | 2 +- volatility3/framework/plugins/windows/thrdscan.py | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index 24f25c38d..bb326fd41 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -42,7 +42,7 @@ class Callbacks(interfaces.plugins.PluginInterface): name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) ), requirements.PluginRequirement( name="driverirp", plugin=driverirp.DriverIrp, version=(1, 0, 0) diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index 86db8d72b..57edfe0b6 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -25,7 +25,7 @@ class DriverScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py index abec2a92e..e0c823756 100644 --- a/volatility3/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -25,7 +25,7 @@ class FileScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py index ca6e26157..38685677a 100644 --- a/volatility3/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -25,7 +25,7 @@ class MutantScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index a28ab19de..10843f8ab 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -26,7 +26,7 @@ class HiveScan(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) ), requirements.PluginRequirement( name="bigpools", plugin=bigpools.BigPools, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index b43593401..369db1fd8 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -34,7 +34,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(2, 0, 0) + name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) ), ] From 66df9f206661fdcbffdc9cbb401b1772c14a9d7f Mon Sep 17 00:00:00 2001 From: D Date: Mon, 10 Mar 2025 15:57:29 +0900 Subject: [PATCH 0754/1352] Modern shell / Python3 Fix --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b74bdab0b..4f5a0a37e 100644 --- a/README.md +++ b/README.md @@ -35,7 +35,7 @@ The latest stable version of Volatility will always be the `stable` branch of th git clone https://github.com/volatilityfoundation/volatility3.git cd volatility3/ python3 -m venv venv && . venv/bin/activate -pip install -e .[dev] +pip install -e ".[dev]" ``` ## Quick Start From 9e4fdbf8efad109e0993a019952617ad9cb366c4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 16:21:56 +0000 Subject: [PATCH 0755/1352] Address feedback --- volatility3/framework/deprecation.py | 9 ++++++++ .../symbols/linux/utilities/modules.py | 23 +++++++++++-------- 2 files changed, 22 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index e1a4d444e..e2e91a0eb 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -15,6 +15,14 @@ from volatility3.framework.configuration import requirements def method_being_removed(message: str, removal_date: str): + """A decorator for marking functions as being removed in the future and without a replacement. + Callers to this function should explicitly list the API paths that should be used instead. + + Args: + message: A message added to the standard deprecation warning. Should include the replacement API paths + removal_date: A YYYY-MM-DD formatted date of when the function will be removed from the framework + """ + def decorator(deprecated_func): @functools.wraps(deprecated_func) def wrapper(*args, **kwargs): @@ -39,6 +47,7 @@ def deprecated_method( Args: replacement: The replacement function overriding the deprecated API, in the form of a Callable (typically a method) + removal_date: A YYYY-MM-DD formatted date of when the function will be removed from the framework replacement_version: The "replacement" base class version that the deprecated method expects before proxying to it. This implies that "replacement" is a method from a class that inherits from VersionableInterface. additional_information: Information appended at the end of the deprecation message """ diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 560398f91..0eeb2b33c 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -46,7 +46,7 @@ class Modules(interfaces.configuration.VersionableInterface): Determine if a target address lies in a module memory space. Returns the module where the provided address lies. - `modules` must contain masked addresses via `get_module_info_for_module` or + `modules` must be non-empty and contain masked addresses via `get_module_info_for_module` or a ValueError will be thrown Args: @@ -65,20 +65,23 @@ class Modules(interfaces.configuration.VersionableInterface): kernel_layer = context.layers[kernel.layer_name] - if modules[0].start != modules[0].start & kernel_layer.address_mask: - raise ValueError( - "Modules list must be gathered from `run_modules_scanners` to be used in this function" - ) + if not modules: + raise ValueError("Empty list sent to `module_lookup_by_address`") matches = [] for module in modules: + if module.start != module.start & kernel_layer.address_mask: + raise ValueError( + "Modules list must be gathered from `run_modules_scanners` to be used in this function" + ) + if module.start <= target_address < module.end: matches.append(module) if len(matches) >= 1: if len(matches) > 1: warnings.warn( - f"Address {hex(target_address)} fits in modules at {[hex(module.start) for module in matches]}, indicating potential modules memory space overlap.", + f"Address {hex(target_address)} fits in modules at {[hex(module.start) for module in matches]}, indicating potential modules memory space overlap. The first matching entry {matches[0].name} will be used", UserWarning, ) @@ -199,13 +202,13 @@ class Modules(interfaces.configuration.VersionableInterface): """ kernel = context.modules[kernel_module_name] - mask = context.layers[kernel.layer_name].address_mask + address_mask = context.layers[kernel.layer_name].address_mask start_addr = kernel.object_from_symbol("_text") - start_addr = start_addr.vol.offset & mask + start_addr = start_addr.vol.offset & address_mask end_addr = kernel.object_from_symbol("_etext") - end_addr = end_addr.vol.offset & mask + end_addr = end_addr.vol.offset & address_mask return Modules.ModuleInfo( start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr @@ -471,7 +474,7 @@ class Modules(interfaces.configuration.VersionableInterface): modules = vmlinux.object_from_symbol(symbol_name="modules").cast("list_head") - table_name = modules.vol.type_name.split(constants.BANG)[0] + table_name = vmlinux.symbol_table_name yield from modules.to_list(table_name + constants.BANG + "module", "list") From a4bbdfddedd95136f836d49256fc7a81cb7d194c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 9 Mar 2025 22:11:32 +0000 Subject: [PATCH 0756/1352] Make exception throwing consistent in the PDB gathering API. Avoid returning an empty symbol_table name when the PDB cannot be downloaded. --- volatility3/framework/plugins/windows/netstat.py | 4 ---- volatility3/framework/symbols/windows/pdbutil.py | 4 ++++ 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index aaab4494c..655ef710a 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -649,10 +649,6 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): vollog.error("Unable to locate symbols for the memory image's tcpip module") return - if not tcpip_symbol_table: - vollog.error("Unable to reconstruct symbol table for tcpip.sys") - return - for netw_obj in self.list_sockets( self.context, kernel.layer_name, diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index b5e8ca70a..c2084ea25 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -409,6 +409,10 @@ class PDBUtility(interfaces.configuration.VersionableInterface): _, symbol_table_name = cls._modtable_from_pdb( context, config_path, layer_name, pdb_name, module_offset, module_size ) + + if symbol_table_name is None: + raise exceptions.VolatilityException(f"Symbol table could not be reconstructed for module {pdb_name}") + return symbol_table_name @classmethod From 2a99a5378405992d1683841015d34eeff122b899 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 9 Mar 2025 22:17:39 +0000 Subject: [PATCH 0757/1352] Make exception throwing consistent in the PDB gathering API. Avoid returning an empty symbol_table name when the PDB cannot be downloaded. --- volatility3/framework/symbols/windows/pdbutil.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index c2084ea25..ea96b0bf8 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -411,7 +411,9 @@ class PDBUtility(interfaces.configuration.VersionableInterface): ) if symbol_table_name is None: - raise exceptions.VolatilityException(f"Symbol table could not be reconstructed for module {pdb_name}") + raise exceptions.VolatilityException( + f"Symbol table could not be reconstructed for module {pdb_name}" + ) return symbol_table_name From 897069c6d05cae414c3d42c72a4deeff3c77563f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 16:27:49 +0000 Subject: [PATCH 0758/1352] Throw more specific exception --- volatility3/framework/symbols/windows/pdbutil.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index ea96b0bf8..3c23eddb8 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -411,7 +411,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): ) if symbol_table_name is None: - raise exceptions.VolatilityException( + raise exceptions.SymbolSpaceError( f"Symbol table could not be reconstructed for module {pdb_name}" ) @@ -445,7 +445,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): ) if not guids: - raise exceptions.VolatilityException( + raise exceptions.SymbolSpaceError( f"Did not find GUID of {pdb_name} in module @ 0x{module_offset:x}!" ) From dad88965e9ac2c5e1b9d42f330dbe2b492ed6221 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 1 Mar 2025 14:22:15 -0600 Subject: [PATCH 0759/1352] Fix broken code and APIs in Linux networking paths --- volatility3/framework/plugins/linux/ip.py | 8 ++-- .../symbols/linux/extensions/network.py | 47 ++++++++++++++++--- 2 files changed, 45 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 8b42ccdbf..76f7253fe 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -15,7 +15,7 @@ class Addr(plugins.PluginInterface): _required_framework_version = (2, 22, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -47,7 +47,7 @@ class Addr(plugins.PluginInterface): prefix_len = in_ifaddr.get_prefix_len() scope_type = in_ifaddr.get_scope_type() ip_addr = in_ifaddr.get_address() - yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type, operational_state + yield net_ns_id or renderers.NotAvailableValue(), iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type, operational_state # Interface IPv6 Addresses inet6_dev = net_dev.ip6_ptr.dereference().cast("inet6_dev") @@ -55,7 +55,7 @@ class Addr(plugins.PluginInterface): prefix_len = inet6_ifaddr.get_prefix_len() scope_type = inet6_ifaddr.get_scope_type() ip6_addr = inet6_ifaddr.get_address() - yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type, operational_state + yield net_ns_id or renderers.NotAvailableValue(), iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type, operational_state def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] @@ -127,7 +127,7 @@ class Link(plugins.PluginInterface): ] flags_str = ",".join(flags_list) - yield net_ns_id, iface_name, mac_addr, operational_state, mtu, qdisc_name, qlen, flags_str + yield net_ns_id or renderers.NotAvailableValue(), iface_name, mac_addr, operational_state, mtu, qdisc_name or renderers.NotAvailableValue(), qlen, flags_str def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] diff --git a/volatility3/framework/symbols/linux/extensions/network.py b/volatility3/framework/symbols/linux/extensions/network.py index ed739894d..30094d1b1 100644 --- a/volatility3/framework/symbols/linux/extensions/network.py +++ b/volatility3/framework/symbols/linux/extensions/network.py @@ -199,7 +199,7 @@ class net_device(objects.StructType): """ return self.flags & self._get_net_device_flag_value("IFF_PROMISC") != 0 - def get_net_namespace_id(self) -> int: + def _do_get_net_namespace_id(self) -> int: """Return the network namespace id for this network interface. Returns: @@ -216,6 +216,20 @@ class net_device(objects.StructType): return net_ns_id + def get_net_namespace_id(self) -> Optional[int]: + """Return the network namespace id for this network interface. + + Returns: + int: the network namespace id for this network interface + """ + try: + return self._do_get_net_namespace_id() + except exceptions.InvalidAddressException: + vollog.debug( + f"Encountered an invalid address exception when getting the namespace for {self.vol.offset:#x}" + ) + return None + def get_operational_state(self) -> Union[str, interfaces.renderers.BaseAbsentValue]: """Return the netwok device oprational state (RFC 2863) string @@ -228,13 +242,17 @@ class net_device(objects.StructType): vollog.warning(f"Invalid net_device operational state '{self.operstate}'") return renderers.UnparsableValue() - def get_qdisc_name(self) -> str: + def get_qdisc_name(self) -> Optional[str]: """Return the network device queuing discipline (qdisc) name Returns: str: A string with the queuing discipline (qdisc) name """ - return utility.array_to_string(self.qdisc.ops.id) + try: + return utility.array_to_string(self.qdisc.ops.id) + except exceptions.InvalidAddressException: + vollog.debug(f"Unable to get qdisc name for {self.vol.offset:#x}") + return None def get_queue_length(self) -> int: """Return the netwrok device transmision qeueue length (qlen) @@ -247,17 +265,34 @@ class net_device(objects.StructType): class in_device(objects.StructType): def get_addresses( - self, + self, max_devices=128 ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Yield the IPv4 ifaddr addresses Yields: in_ifaddr: An IPv4 ifaddr address """ - cur = self.ifa_list + seen = set() + + try: + cur = self.ifa_list + except exceptions.InvalidAddressException: + return + while cur and cur.vol.offset: + if len(seen) > max_devices: + break + + if cur.vol.offset in seen: + break + seen.add(cur.vol.offset) + yield cur - cur = cur.ifa_next + + try: + cur = cur.ifa_next + except exceptions.InvalidAddressException: + break class inet6_dev(objects.StructType): From f7f8cf24cd21d9376e60ac9f27830a6d7b972442 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 16:36:53 +0000 Subject: [PATCH 0760/1352] Address feedback --- volatility3/framework/plugins/linux/ip.py | 37 ++++++++++++++++++----- 1 file changed, 30 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 76f7253fe..348f3c13f 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -39,7 +39,7 @@ class Addr(plugins.PluginInterface): try: net_ns_id = net_dev.get_net_namespace_id() except AttributeError: - net_ns_id = renderers.NotAvailableValue() + net_ns_id = None # Interface IPv4 Addresses in_device = net_dev.ip_ptr.dereference().cast("in_device") @@ -47,7 +47,7 @@ class Addr(plugins.PluginInterface): prefix_len = in_ifaddr.get_prefix_len() scope_type = in_ifaddr.get_scope_type() ip_addr = in_ifaddr.get_address() - yield net_ns_id or renderers.NotAvailableValue(), iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type, operational_state + yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type, operational_state # Interface IPv6 Addresses inet6_dev = net_dev.ip6_ptr.dereference().cast("inet6_dev") @@ -55,9 +55,9 @@ class Addr(plugins.PluginInterface): prefix_len = inet6_ifaddr.get_prefix_len() scope_type = inet6_ifaddr.get_scope_type() ip6_addr = inet6_ifaddr.get_address() - yield net_ns_id or renderers.NotAvailableValue(), iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type, operational_state + yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type, operational_state - def _generator(self): + def _enumerate_net_namespace_list(self): vmlinux = self.context.modules[self.config["kernel"]] net_type_symname = vmlinux.symbol_table_name + constants.BANG + "net" @@ -67,9 +67,32 @@ class Addr(plugins.PluginInterface): # 'net_namespace_list' exists from kernels >= 2.6.24 net_namespace_list = vmlinux.object_from_symbol("net_namespace_list") for net_ns in net_namespace_list.to_list(net_type_symname, "list"): - for net_dev in net_ns.dev_base_head.to_list(net_device_symname, "dev_list"): - for fields in self._gather_net_dev_info(net_dev): - yield 0, fields + yield from net_ns.dev_base_head.to_list(net_device_symname, "dev_list") + + def _generator(self): + for net_dev in self._enumerate_net_namespace_list(): + for ( + net_ns_id, + iface_ifindex, + iface_name, + mac_addr, + promisc, + ip6_addr, + prefix_len, + scope_type, + operational_state, + ) in self._gather_net_dev_info(net_dev): + yield 0, ( + net_ns_id or renderers.NotAvailableValue(), + iface_ifindex, + iface_name, + mac_addr, + promisc, + ip6_addr, + prefix_len, + scope_type, + operational_state, + ) def run(self): headers = [ From 2d4e0f66d87cdce6a3d75db6df8b566c83409669 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 01:09:52 +0000 Subject: [PATCH 0761/1352] Update fbdev plugin to gracefully handle old/broken symbol tables --- .../framework/plugins/linux/graphics/fbdev.py | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 7b644eccf..d436bbcb9 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -255,22 +255,28 @@ You can try using ffmpeg to decode the raw buffer. Example usage: vollog.error( "PIL (pillow) module is required to use this plugin. Please install it manually or through pyproject.toml." ) - return None + return kernel_name = self.config["kernel"] kernel = self.context.modules[kernel_name] if not kernel.has_symbol("num_registered_fb"): - raise exceptions.SymbolError( - "num_registered_fb", - kernel.symbol_table_name, - "The provided symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt.", + vollog.error( + '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module..' ) + return + + try: + num_registered_fb = kernel.object_from_symbol("num_registered_fb") + except exceptions.SymbolError: + vollog.error( + 'Creating an object from "num_registered_fb" caused a symbol error. This is a sign that the symbol table is outdated. Please re-generate your symbol table using the latest dwarf2json' + ) + return - num_registered_fb = kernel.object_from_symbol("num_registered_fb") if num_registered_fb < 1: vollog.info("No registered framebuffer in the fbdev API.") - return None + return registered_fb = kernel.object_from_symbol("registered_fb") fb_info_list = utility.array_of_pointers( From 6c96ffacddc0bc3ad461b1fd1042e572ec5d344a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 8 Mar 2025 01:13:03 +0000 Subject: [PATCH 0762/1352] Update fbdev plugin to gracefully handle old/broken symbol tables --- volatility3/framework/plugins/linux/graphics/fbdev.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index d436bbcb9..f7cde1bf0 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -262,7 +262,7 @@ You can try using ffmpeg to decode the raw buffer. Example usage: if not kernel.has_symbol("num_registered_fb"): vollog.error( - '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module..' + '"num_registered_fb" symbol does not exist in the symbol table. This means you are either analyzing an unsupported kernel version, your symbol table is corrupt, or the fbdev driver is compiled as a kernel module.' ) return From 8b302ff7fc568177d97e865a2031ac35ad10dab6 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Mon, 10 Mar 2025 13:39:00 -0500 Subject: [PATCH 0763/1352] #1476 - additional exception handling for registry plugins --- .../framework/plugins/windows/envars.py | 15 +- .../plugins/windows/getservicesids.py | 17 +- .../framework/plugins/windows/getsids.py | 11 +- .../framework/plugins/windows/hashdump.py | 30 +- .../framework/plugins/windows/lsadump.py | 23 +- .../framework/plugins/windows/prefetch.py | 478 ++++++++++++++++++ .../plugins/windows/registry/printkey.py | 16 +- .../plugins/windows/registry/userassist.py | 14 +- .../plugins/windows/scheduled_tasks.py | 30 +- .../symbols/windows/extensions/registry.py | 16 +- 10 files changed, 604 insertions(+), 46 deletions(-) create mode 100644 volatility3/framework/plugins/windows/prefetch.py diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 61414778d..f1cca9b94 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -73,13 +73,13 @@ class Envars(interfaces.plugins.PluginInterface): sys = hive.get_key( "CurrentControlSet\\Control\\Session Manager\\Environment" ) - except (KeyError, registry.RegistryFormatException): - with contextlib.suppress(KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): + with contextlib.suppress(KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): sys = hive.get_key( "ControlSet001\\Control\\Session Manager\\Environment" ) if sys: - with contextlib.suppress(KeyError, registry.RegistryFormatException): + with contextlib.suppress(KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): for node in sys.get_values(): try: value_node_name = node.get_name() @@ -88,6 +88,7 @@ class Envars(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, registry.RegistryFormatException, + registry.RegistryInvalidIndex ): vollog.log( constants.LOGLEVEL_VVV, @@ -97,10 +98,10 @@ class Envars(interfaces.plugins.PluginInterface): ntuser = None ## The user-specific variables - with contextlib.suppress(KeyError, registry.RegistryFormatException): + with contextlib.suppress(KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): ntuser = hive.get_key("Environment") if ntuser: - with contextlib.suppress(KeyError, registry.RegistryFormatException): + with contextlib.suppress(KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): for node in ntuser.get_values(): try: value_node_name = node.get_name() @@ -109,6 +110,7 @@ class Envars(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, registry.RegistryFormatException, + registry.RegistryInvalidIndex, ): vollog.log( constants.LOGLEVEL_VVV, @@ -119,7 +121,7 @@ class Envars(interfaces.plugins.PluginInterface): ## The volatile user variables try: key = hive.get_key("Volatile Environment") - except (KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): continue try: for node in key.get_values(): @@ -130,6 +132,7 @@ class Envars(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, registry.RegistryFormatException, + registry.RegistryInvalidIndex, ): vollog.log( constants.LOGLEVEL_VVV, diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 207d0e2ad..4dbdf5106 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -91,6 +91,7 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException, + registry.RegistryInvalidIndex, ): try: services = hive.get_key(r"ControlSet001\Services") @@ -98,14 +99,24 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): KeyError, exceptions.InvalidAddressException, registry.RegistryFormatException, + registry.RegistryInvalidIndex, ): continue if services: for s in services.get_subkeys(): - if s.get_name() not in self.servicesids.values(): - sid = createservicesid(s.get_name()) - yield (0, (sid, s.get_name())) + try: + sid_name = s.get_name() + except ( + exceptions.InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): + continue + + if sid_name not in self.servicesids.values(): + sid = createservicesid(sid_name) + yield (0, (sid, sid_name)) def run(self): return renderers.TreeGrid([("SID", str), ("Service", str)], self._generator()) diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index a75bbe7ea..0c8374455 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -114,7 +114,15 @@ class GetSIDs(interfaces.plugins.PluginInterface): ): try: for subkey in hive.get_key(key).get_subkeys(): - sid = str(subkey.get_name()) + try: + sid = str(subkey.get_name()) + except ( + exceptions.InvalidAddressException, + layers.registry.RegistryFormatException, + layers.registry.RegistryInvalidIndex, + ): + continue + path = "" for node in subkey.get_values(): try: @@ -122,6 +130,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, layers.registry.RegistryFormatException, + layers.registry.RegistryInvalidIndex, ): continue try: diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 1fea3d49d..9f481781d 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -9,8 +9,9 @@ from typing import List, Optional, Tuple from Crypto.Cipher import AES, ARC4, DES -from volatility3.framework import interfaces, renderers +from volatility3.framework import interfaces, renderers, constants from volatility3.framework.configuration import requirements +from volatility3.framework.exceptions import InvalidAddressException from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist @@ -356,21 +357,27 @@ class Hashdump(interfaces.plugins.PluginInterface): lsa_keys = ["JD", "Skew1", "GBG", "Data"] lsa = cls.get_hive_key(syshive, lsa_base) - if not lsa: return None bootkey = "" for lk in lsa_keys: - key = cls.get_hive_key(syshive, lsa_base + "\\" + lk) - class_data = None - if key: - class_data = syshive.read(key.Class + 4, key.ClassLength) + try: + key = cls.get_hive_key(syshive, lsa_base + "\\" + lk) + class_data = None + if key: + class_data = syshive.read(key.Class + 4, key.ClassLength) - if class_data is None: + if class_data is None: + return None + bootkey += class_data.decode("utf-16-le") + except (InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex) as excp: + vollog.log( + constants.LOGLEVEL_VVV, + f"Unable to read Lsa key {lk}: {excp}" + ) return None - bootkey += class_data.decode("utf-16-le") bootkey_str = binascii.unhexlify(bootkey) bootkey_scrambled = bytes( @@ -443,8 +450,11 @@ class Hashdump(interfaces.plugins.PluginInterface): return None sam_data = None for v in user.get_values(): - if v.get_name() == "V": - sam_data = samhive.read(v.Data + 4, v.DataLength) + try: + if v.get_name() == "V": + sam_data = samhive.read(v.Data + 4, v.DataLength) + except (InvalidAddressException, registry.RegistryInvalidIndex): + continue if not sam_data: return None diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 50f4da30d..511ec0126 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -10,6 +10,8 @@ from Crypto.Cipher import ARC4, DES, AES from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements +from volatility3.framework.exceptions import InvalidAddressException +from volatility3.framework.interfaces.layers import IteratorValue from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows import hashdump @@ -119,7 +121,11 @@ class Lsadump(interfaces.plugins.PluginInterface): secret = None if enc_secret_key: - enc_secret_value = next(enc_secret_key.get_values()) + try: + enc_secret_value = next(enc_secret_key.get_values()) + except (InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + enc_secret_value = None + if enc_secret_value: enc_secret = sechive.read( enc_secret_value.Data + 4, enc_secret_value.DataLength @@ -168,11 +174,11 @@ class Lsadump(interfaces.plugins.PluginInterface): ) bootkey = hashdump.Hashdump.get_bootkey(syshive) - lsakey = self.get_lsa_key(sechive, bootkey, vista_or_later) if not bootkey: vollog.warning("Unable to find bootkey") return None + lsakey = self.get_lsa_key(sechive, bootkey, vista_or_later) if not lsakey: vollog.warning("Unable to find lsa key") return None @@ -190,7 +196,11 @@ class Lsadump(interfaces.plugins.PluginInterface): if not sec_val_key: continue - enc_secret_value = next(sec_val_key.get_values()) + try: + enc_secret_value = next(sec_val_key.get_values()) + except (StopIteration, InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + enc_secret_value = None + if not enc_secret_value: continue @@ -204,7 +214,12 @@ class Lsadump(interfaces.plugins.PluginInterface): else: secret = self.decrypt_aes(enc_secret, lsakey) - yield (0, (key.get_name(), secret.decode("latin1"), secret)) + try: + key_name = key.get_name() + except (InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + key_name = renderers.UnreadableValue() + + yield (0, (key_name, secret.decode("latin1"), secret)) def run(self): offset = self.config.get("offset", None) diff --git a/volatility3/framework/plugins/windows/prefetch.py b/volatility3/framework/plugins/windows/prefetch.py new file mode 100644 index 000000000..3997bc012 --- /dev/null +++ b/volatility3/framework/plugins/windows/prefetch.py @@ -0,0 +1,478 @@ +# References : +# https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-XCA/%5bMS-XCA%5d.pdf +# https://github.com/libyal/libscca/blob/main/documentation/Windows%20Prefetch%20File%20(PF)%20format.asciidoc +# https://github.com/volatilityfoundation/volatility3/ +# https://github.com/EricZimmerman/Prefetch/tree/master/Prefetch +import logging, pathlib, datetime, io, struct +from volatility3.framework import renderers, interfaces, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import filescan +from volatility3.framework.renderers import format_hints, conversion + +vollog = logging.getLogger(__name__) +from typing import Tuple, List, Union + + +class BitStream: + def __init__(self, source: bytes, in_pos: int): + self.source = source + self.index = in_pos + 4 + # read UInt16 little endian + mask = struct.unpack_from(' int: + if n == 0: + return 0 + return self.mask >> (32 - n) + + def skip(self, n: int) -> Union[None, Exception]: + self.mask = ((self.mask << n) & 0xFFFFFFFF) + self.bits -= n + if self.bits < 16: + if self.index + 2 > len(self.source): + return Exception("EOF Error") + # read UInt16 little endian + self.mask += ((struct.unpack_from(' int: + node = treeNodes[0] + i = leafIndex + 1 + childIndex = None + + while bits > 1: + bits -= 1 + childIndex = (mask >> bits) & 1 + if node.child[childIndex] == None: + node.child[childIndex] = treeNodes[i] + treeNodes[i].leaf = False + i += 1 + node = node.child[childIndex] + + node.child[mask & 1] = treeNodes[leafIndex] + + return i + + +def prefix_code_tree_rebuild(input: bytes) -> PREFIX_CODE_NODE: + treeNodes = [PREFIX_CODE_NODE() for _ in range(1024)] + symbolInfo = [PREFIX_CODE_SYMBOL() for _ in range(512)] + + for i in range(256): + value = input[i] + + symbolInfo[2 * i].id = 2 * i + symbolInfo[2 * i].symbol = 2 * i + symbolInfo[2 * i].length = value & 0xf + + value >>= 4 + + symbolInfo[2 * i + 1].id = 2 * i + 1 + symbolInfo[2 * i + 1].symbol = 2 * i + 1 + symbolInfo[2 * i + 1].length = value & 0xf + + symbolInfo = sorted(symbolInfo, key=lambda x: (x.length, x.symbol)) + + i = 0 + while i < 512 and symbolInfo[i].length == 0: + i += 1 + + mask = 0 + bits = 1 + + root = treeNodes[0] + root.leaf = False + + j = 1 + while i < 512: + treeNodes[j].id = j + treeNodes[j].symbol = symbolInfo[i].symbol + treeNodes[j].leaf = True + mask = mask << (symbolInfo[i].length - bits) + bits = symbolInfo[i].length + j = prefix_code_tree_add_leaf(treeNodes, j, mask, bits) + mask += 1 + i += 1 + + return root + + +def prefix_code_tree_decode_symbol(bstr: BitStream, root: PREFIX_CODE_NODE) -> Tuple[int, Union[None, Exception]]: + node = root + i = 0 + while True: + bit = bstr.lookup(1) + err = bstr.skip(1) + if err is not None: + return 0, err + + node = node.child[bit] + if node == None: + return 0, Exception("Corruption detected") + + if node.leaf: + break + return node.symbol, None + + +def lz77_huffman_decompress_chunck(in_idx: int, + input: bytes, + out_idx: int, + output: bytearray, + chunk_size: int) -> Tuple[int, int, Union[None, Exception]]: + # Ensure there are at least 256 bytes available to read + if in_idx + 256 > len(input): + return 0, 0, Exception("EOF Error") + + root = prefix_code_tree_rebuild(input[in_idx:]) + # print_tree(root) + bstr = BitStream(input, in_idx + 256) + + i = out_idx + + while i < out_idx + chunk_size: + symbol, err = prefix_code_tree_decode_symbol(bstr, root) + + if err is not None: + return int(bstr.index), i, err + + if symbol < 256: + output[i] = symbol + i += 1 + else: + symbol -= 256 + length = symbol & 15 + symbol >>= 4 + + offset = 0 + if symbol != 0: + offset = int(bstr.lookup(symbol)) + + offset |= 1 << symbol + offset = -offset + + if length == 15: + length = bstr.source[bstr.index] + 15 + bstr.index += 1 + + if length == 270: + length = struct.unpack_from(' 0: + if i + offset < 0: + print(i + offset) + return int(bstr.index), i, Exception("Decompression Error") + + output[i] = output[i + offset] + i += 1 + length -= 1 + if length == 0: + break + return int(bstr.index), i, None + + +def lz77_huffman_decompress(input: bytes, output_size: int) -> Tuple[bytes, Union[None, Exception]]: + output = bytearray(output_size) + err = None + + # Index into the input buffer. + in_idx = 0 + + # Index into the output buffer. + out_idx = 0 + + while True: + # How much data belongs in the current chunk. Chunks + # are split into maximum 65536 bytes. + chunk_size = output_size - out_idx + if chunk_size > 65536: + chunk_size = 65536 + + in_idx, out_idx, err = lz77_huffman_decompress_chunck( + in_idx, input, out_idx, output, chunk_size) + if err is not None: + return output, err + if out_idx >= len(output) or in_idx >= len(input): + break + return output, None + + +class Prefetch(interfaces.plugins.PluginInterface): + """Get and parse the prefetch files""" + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls): + return [requirements.ModuleRequirement(name='kernel', description='Windows kernel', + architectures=["Intel32", "Intel64"]), + requirements.PluginRequirement(name='filescan', plugin=filescan.FileScan, version=(0, 0, 0)), ] + + @classmethod + def version_17(cls, prefetch_file): + """Extract pf information for Version 17""" + stream = io.BytesIO(prefetch_file) + + stream.seek(0x000C) + file_size = int.from_bytes(stream.read(4), "little") + + stream.seek(0x0010) + executable_raw = stream.read(60).decode('utf-16') + executable_name = executable_raw.split('\u0000')[0] + + stream.seek(0x004C) + prefetch_hash = int.from_bytes(stream.read(4), "little") + + stream.seek(0x0078) + last_execution_filetime = int.from_bytes(stream.read(8), "little") + last_execution_filetime_human = conversion.wintime_to_datetime(last_execution_filetime) + + stream.seek(0x0090) + execution_counter = int.from_bytes(stream.read(4), "little") + + yield ( + executable_name, + file_size, + format_hints.Hex(prefetch_hash), + last_execution_filetime_human, + execution_counter + ) + + @classmethod + def version_23(cls, prefetch_file): + """Extract pf information for Version 23""" + stream = io.BytesIO(prefetch_file) + + stream.seek(0x000C) + file_size = int.from_bytes(stream.read(4), "little") + + stream.seek(0x0010) + executable_raw = stream.read(60).decode('utf-16') + executable_name = executable_raw.split('\u0000')[0] + + stream.seek(0x004C) + prefetch_hash = int.from_bytes(stream.read(4), "little") + + stream.seek(0x0080) + last_execution_filetime = int.from_bytes(stream.read(8), "little") + last_execution_filetime_human = conversion.wintime_to_datetime(last_execution_filetime) + + stream.seek(0x0098) + execution_counter = int.from_bytes(stream.read(4), "little") + + yield ( + executable_name, + file_size, + format_hints.Hex(prefetch_hash), + last_execution_filetime_human, + execution_counter + ) + + @classmethod + def version_26(cls, prefetch_file): + """Extract pf information for Version 26""" + stream = io.BytesIO(prefetch_file) + + stream.seek(0x000C) + file_size = int.from_bytes(stream.read(4), "little") + + stream.seek(0x0010) + executable_raw = stream.read(60).decode('utf-16') + executable_name = executable_raw.split('\u0000')[0] + + stream.seek(0x004C) + prefetch_hash = int.from_bytes(stream.read(4), "little") + + stream.seek(0x0080) + last_execution_filetime = int.from_bytes(stream.read(8), "little") + last_execution_filetime_human = conversion.wintime_to_datetime(last_execution_filetime) + + stream.seek(0x00D0) + execution_counter = int.from_bytes(stream.read(4), "little") + + yield ( + executable_name, + file_size, + format_hints.Hex(prefetch_hash), + last_execution_filetime_human, + execution_counter + ) + + @classmethod + def version_30(cls, prefetch_file): + """Extract pf information for Version 30""" + stream = io.BytesIO(prefetch_file) + + stream.seek(0x000C) + file_size = int.from_bytes(stream.read(4), "little") + + stream.seek(0x0010) + executable_raw = stream.read(60).decode('utf-16') + executable_name = executable_raw.split('\u0000')[0] + + stream.seek(0x004C) + prefetch_hash = int.from_bytes(stream.read(4), "little") + + stream.seek(0x0080) + # The first FILETIME is the most recent run time + last_execution_filetime = int.from_bytes(stream.read(8), "little") + last_execution_filetime_human = conversion.wintime_to_datetime(last_execution_filetime) + + stream.seek(0x00C8) # Variant 1 + execution_counter = int.from_bytes(stream.read(4), "little") + if execution_counter == 0: + stream.seek(0x00D0) # Variant 2 + execution_counter = int.from_bytes(stream.read(4), "little") + + yield ( + executable_name, + file_size, + format_hints.Hex(prefetch_hash), + last_execution_filetime_human, + execution_counter + ) + + @classmethod + def parse_prefetch(cls, prefetch_file): + WinXpOrWin2K3 = 17 + VistaOrWin7 = 23 + Win8xOrWin2012x = 26 + Win10OrWin11 = 30 + stream = io.BytesIO(prefetch_file) + # First, we need to know if the prefetch is compressed (Win10/11) + signature = prefetch_file[:3].decode() + if signature == "MAM": + vollog.info("Windows 1X prefetch file detected.") + # The size of decompressed data is at offset 4 + stream.seek(0x0004) + decompressed_size = int.from_bytes(stream.read(4), "little") + vollog.info(f"decompressed size : {decompressed_size}") + stream.seek(0x0008) + compressed_bytes = stream.read() + prefetch_file = lz77_huffman_decompress(bytearray(compressed_bytes), decompressed_size)[0] + try: + file_version = int.from_bytes(prefetch_file[:4], "little") + signature = prefetch_file[4:8].decode() + vollog.info(f'File version : {file_version}') + vollog.info(f"Signature : {signature}") + except: + # We can not even read the header + pass + + if signature != "SCCA": + vollog.info("Wrong signature, should be SCCA") + return + if file_version == WinXpOrWin2K3: + for result in cls.version_17(prefetch_file): + yield result + elif file_version == VistaOrWin7: + for result in cls.version_23(prefetch_file): + yield result + elif file_version == Win8xOrWin2012x: + for result in cls.version_26(prefetch_file): + yield result + elif file_version == Win10OrWin11: + for result in cls.version_30(prefetch_file): + yield result + + def _generator(self, files): + kernel = self.context.modules[self.config['kernel']] + offsets = [] + for file_obj in files: + """Get the prefetch recovered files from the “filescan” plugin; """ + try: + file_name = file_obj.FileName.String + file_extension = pathlib.Path(file_name).suffix + if file_extension == ".pf": + """If found, try to dump the prefetch file (inspired from the "DumpFiles" plugin)""" + memory_objects = [] + memory_layer_name = self.context.layers[kernel.layer_name].config['memory_layer'] + memory_layer = self.context.layers[memory_layer_name] + primary_layer = self.context.layers[kernel.layer_name] + for member_name in ["DataSectionObject", "ImageSectionObject"]: + try: + section_obj = getattr(file_obj.SectionObjectPointer, member_name) + control_area = section_obj.dereference().cast("_CONTROL_AREA") + if control_area.is_valid(): + vollog.info(f"Found : {file_obj.FileName.String}") + memory_objects.append((control_area, memory_layer)) + except exceptions.InvalidAddressException: + vollog.log(constants.LOGLEVEL_VVV, + f"{member_name} is unavailable for file {file_obj.vol.offset:#x}") + try: + scm_pointer = file_obj.SectionObjectPointer.SharedCacheMap + shared_cache_map = scm_pointer.dereference().cast("_SHARED_CACHE_MAP") + if shared_cache_map.is_valid(): + memory_objects.append((shared_cache_map, primary_layer)) + except exceptions.InvalidAddressException: + vollog.log(constants.LOGLEVEL_VVV, + f"SharedCacheMap is unavailable for file {file_obj.vol.offset:#x}") + vollog.info(f"memory_objects : {memory_objects}") + + """Now, read and parse our PF to retrieve our artifacts""" + for memory_object, layer in memory_objects: + bytes_read = 0 + prefetch_raw = b'' + try: + for mem_offset, _, datasize in memory_object.get_available_pages(): + prefetch_raw += layer.read(mem_offset, datasize, pad=True) + bytes_read += len(prefetch_raw) + vollog.info(f"Read {bytes_read}") + if not bytes_read: + vollog.info(f"Prefetch is empty") + else: + """Prefetch parsing""" + for result in self.parse_prefetch(prefetch_raw): + yield 0, result + + except exceptions.InvalidAddressException: + vollog.debug(f"Unable to dump file at {file_obj.vol.offset:#x}") + pass + except exceptions.InvalidAddressException: + continue + + def run(self): + kernel = self.context.modules[self.config['kernel']] + return renderers.TreeGrid([ + ("ExecutableName", str), + ("FileSize", int), + ("PrefetchHash", format_hints.Hex), + ("LastExecution", datetime.datetime), ("ExecutionCounter", int)], + self._generator(filescan.FileScan.scan_files(self.context, kernel.layer_name, kernel.symbol_table_name))) \ No newline at end of file diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index ed926805b..10079e41b 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -8,7 +8,8 @@ from typing import List, Optional, Sequence, Iterable, Tuple, Union from volatility3.framework import objects, renderers, exceptions, interfaces, constants from volatility3.framework.configuration import requirements -from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException +from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException, InvalidAddressException, \ + RegistryInvalidIndex from volatility3.framework.renderers import TreeGrid, conversion, format_hints from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist @@ -77,7 +78,14 @@ class PrintKey(interfaces.plugins.PluginInterface): return None node = node_path[-1] key_path_items = [hive] + node_path[1:] - key_path = "\\".join([k.get_name() for k in key_path_items]) + key_path_names = [] + for k in key_path_items: + try: + key_path_names.append(k.get_name()) + except (InvalidAddressException, RegistryFormatException, RegistryInvalidIndex): + key_path_names.append('-') + key_path = "\\".join([k for k in key_path_names]) + if node.vol.type_name.endswith(constants.BANG + "_CELL_DATA"): raise RegistryFormatException( hive.name, "Encountered _CELL_DATA instead of _CM_KEY_NODE" @@ -99,7 +107,7 @@ class PrintKey(interfaces.plugins.PluginInterface): if key_node.vol.offset not in [x.vol.offset for x in node_path]: try: key_node.get_name() - except exceptions.InvalidAddressException as excp: + except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex) as excp: vollog.debug(excp) continue @@ -149,6 +157,7 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, RegistryFormatException, + RegistryInvalidIndex ) as excp: vollog.debug(excp) key_node_name = renderers.UnreadableValue() @@ -176,6 +185,7 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, RegistryFormatException, + RegistryInvalidIndex ) as excp: vollog.debug(excp) value_node_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 87016553a..3bc4e48d8 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -13,7 +13,7 @@ from typing import Any, Generator, List, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.layers.physical import BufferDataLayer -from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException +from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException, RegistryInvalidIndex from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed from volatility3.plugins.windows.registry import hivelist @@ -238,7 +238,11 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac # output any subkeys under Count for subkey in countkey.get_subkeys(): - subkey_name = subkey.get_name() + try: + subkey_name = subkey.get_name() + except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex): + subkey_name = renderers.UnreadableValue() + result = ( 1, ( @@ -260,7 +264,11 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac # output any values under Count for value in countkey.get_values(): - value_name = value.get_name() + try: + value_name = value.get_name() + except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex): + value_name = renderers.UnreadableValue() + with contextlib.suppress(UnicodeDecodeError): value_name = codecs.encode(value_name, "rot_13") diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 31aaec4f0..2f2f7c254 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -311,7 +311,7 @@ def _build_guid_name_map(key: reg_extensions.CM_KEY_NODE) -> Dict[str, str]: if value.get_name() == "Id": task_id_value = value break - except exceptions.InvalidAddressException: + except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): continue if ( @@ -323,10 +323,13 @@ def _build_guid_name_map(key: reg_extensions.CM_KEY_NODE) -> Dict[str, str]: except exceptions.InvalidAddressException: id_str = None - if isinstance(id_str, bytes): - mapping[id_str.decode("utf-16le", errors="replace").rstrip(NULL)] = str( - key.get_name() - ) + try: + if isinstance(id_str, bytes): + mapping[id_str.decode("utf-16le", errors="replace").rstrip(NULL)] = str( + key.get_name() + ) + except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + pass for subkey in key.get_subkeys(): mapping.update(_build_guid_name_map(subkey)) @@ -1231,13 +1234,22 @@ information about triggers, actions, run times, and creation times.""" for value in key.get_values(): try: name = str(value.get_name()) - except exceptions.InvalidAddressException: + except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryFormatException): continue if name in ["Actions", "Triggers", "DynamicInfo"]: values[name] = value - task_name = guid_mapping.get(str(key.get_name()), renderers.NotAvailableValue()) + + try: + key_name = str(key.get_name()) + except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryFormatException): + key_name = None + + try: + task_name = guid_mapping.get(key_name, renderers.NotAvailableValue()) + except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryFormatException): + task_name = renderers.NotAvailableValue() try: action_set = cls.parse_actions_value(values["Actions"]) @@ -1348,11 +1360,11 @@ information about triggers, actions, run times, and creation times.""" args, ( action_set.context - if action_set is not None + if action_set is not None and action_set.context is not None else renderers.NotAvailableValue() ), working_directory, - str(key.get_name()), + key_name or renderers.NotAvailableValue(), ) def _generator(self) -> Iterator[Tuple[int, _ScheduledTaskEntry]]: diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index c807c2cd6..7f284a36f 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -103,7 +103,7 @@ class CMHIVE(objects.StructType): for attr in ["FileFullPath", "FileUserName", "HiveRootPath"]: with contextlib.suppress( - AttributeError, exceptions.InvalidAddressException + AttributeError, exceptions.InvalidAddressException, RegistryInvalidIndex ): name = getattr(self, attr) if name.Length > 0: @@ -228,6 +228,7 @@ class CM_KEY_NODE(objects.StructType): except ( exceptions.InvalidAddressException, RegistryFormatException, + RegistryInvalidIndex, ): vollog.log( constants.LOGLEVEL_VVV, @@ -244,21 +245,22 @@ class CM_KEY_NODE(objects.StructType): hive = self._context.layers[self.vol.layer_name] if not isinstance(hive, RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") - child_list = hive.get_cell(self.ValueList.List).u.KeyList - child_list.count = self.ValueList.Count try: + child_list = hive.get_cell(self.ValueList.List).u.KeyList + child_list.count = self.ValueList.Count + for v in child_list: if v != 0: try: node = hive.get_node(v) - except (RegistryInvalidIndex, RegistryFormatException) as excp: + except (RegistryInvalidIndex, RegistryFormatException, RegistryInvalidIndex) as excp: vollog.debug(f"Invalid address {excp}") continue if isinstance(node, CM_KEY_VALUE): yield node - except (exceptions.InvalidAddressException, RegistryFormatException) as excp: + except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex) as excp: vollog.debug(f"Invalid address in get_values iteration: {excp}") return None @@ -347,7 +349,7 @@ class CM_KEY_VALUE(objects.StructType): offset=layer.get_cell(block_offset).vol.offset, length=amount, ) - except exceptions.InvalidAddressException: + except (exceptions.InvalidAddressException, RegistryInvalidIndex): vollog.debug( f"Failed to read {amount:x} bytes of data, padding with {amount:x}" ) @@ -357,7 +359,7 @@ class CM_KEY_VALUE(objects.StructType): # but the length at the start could be negative so just adding 4 to jump past it try: data = layer.read(self.Data + 4, datalen) - except exceptions.InvalidAddressException: + except (exceptions.InvalidAddressException, RegistryInvalidIndex): vollog.debug( f"Failed to read {datalen:x} bytes of data, returning {datalen:x} null bytes" ) From e1c88f065b547bada3622632a381322a94c4c5c3 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Mon, 10 Mar 2025 13:57:14 -0500 Subject: [PATCH 0764/1352] #1476 - black fixes --- .../framework/plugins/windows/envars.py | 38 +++++++++++++++---- .../plugins/windows/getservicesids.py | 6 +-- .../framework/plugins/windows/getsids.py | 6 +-- .../framework/plugins/windows/hashdump.py | 9 +++-- .../framework/plugins/windows/lsadump.py | 20 ++++++++-- .../plugins/windows/registry/printkey.py | 26 +++++++++---- .../plugins/windows/registry/userassist.py | 18 +++++++-- .../plugins/windows/scheduled_tasks.py | 31 ++++++++++++--- .../symbols/windows/extensions/registry.py | 18 +++++++-- 9 files changed, 133 insertions(+), 39 deletions(-) diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 98d9e2553..d197fbc98 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -71,13 +71,25 @@ class Envars(interfaces.plugins.PluginInterface): sys = hive.get_key( "CurrentControlSet\\Control\\Session Manager\\Environment" ) - except (KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): - with contextlib.suppress(KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): + except ( + KeyError, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): + with contextlib.suppress( + KeyError, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): sys = hive.get_key( "ControlSet001\\Control\\Session Manager\\Environment" ) if sys: - with contextlib.suppress(KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): + with contextlib.suppress( + KeyError, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): for node in sys.get_values(): try: value_node_name = node.get_name() @@ -86,7 +98,7 @@ class Envars(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, registry.RegistryFormatException, - registry.RegistryInvalidIndex + registry.RegistryInvalidIndex, ): vollog.log( constants.LOGLEVEL_VVV, @@ -96,10 +108,18 @@ class Envars(interfaces.plugins.PluginInterface): ntuser = None ## The user-specific variables - with contextlib.suppress(KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): + with contextlib.suppress( + KeyError, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): ntuser = hive.get_key("Environment") if ntuser: - with contextlib.suppress(KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): + with contextlib.suppress( + KeyError, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): for node in ntuser.get_values(): try: value_node_name = node.get_name() @@ -119,7 +139,11 @@ class Envars(interfaces.plugins.PluginInterface): ## The volatile user variables try: key = hive.get_key("Volatile Environment") - except (KeyError, registry.RegistryFormatException, registry.RegistryInvalidIndex): + except ( + KeyError, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): continue try: for node in key.get_values(): diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 9e9c5fa4d..c334fe722 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -106,9 +106,9 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): try: sid_name = s.get_name() except ( - exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + exceptions.InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, ): continue diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 6cbba059b..0d54ea12c 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -115,9 +115,9 @@ class GetSIDs(interfaces.plugins.PluginInterface): try: sid = str(subkey.get_name()) except ( - exceptions.InvalidAddressException, - layers.registry.RegistryFormatException, - layers.registry.RegistryInvalidIndex, + exceptions.InvalidAddressException, + layers.registry.RegistryFormatException, + layers.registry.RegistryInvalidIndex, ): continue diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 6529cba19..d90e23802 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -380,10 +380,13 @@ class Hashdump(interfaces.plugins.PluginInterface): if class_data is None: return None bootkey += class_data.decode("utf-16-le") - except (InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex) as excp: + except ( + InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ) as excp: vollog.log( - constants.LOGLEVEL_VVV, - f"Unable to read Lsa key {lk}: {excp}" + constants.LOGLEVEL_VVV, f"Unable to read Lsa key {lk}: {excp}" ) return None diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index c4e8ef48a..aeea239c7 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -123,7 +123,11 @@ class Lsadump(interfaces.plugins.PluginInterface): if enc_secret_key: try: enc_secret_value = next(enc_secret_key.get_values(), None) - except (InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + except ( + InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): enc_secret_value = None if enc_secret_value: @@ -202,7 +206,12 @@ class Lsadump(interfaces.plugins.PluginInterface): try: enc_secret_value = next(sec_val_key.get_values(), None) - except (StopIteration, InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + except ( + StopIteration, + InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): enc_secret_value = None if not enc_secret_value: @@ -222,12 +231,15 @@ class Lsadump(interfaces.plugins.PluginInterface): try: key_name = key.get_name() - except (InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + except ( + InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): key_name = renderers.UnreadableValue() yield (0, (key_name, format_hints.HexBytes(secret), secret)) - def run(self): offset = self.config.get("offset", None) syshive = sechive = None diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 585ec6b5e..c6d216760 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -8,8 +8,12 @@ from typing import List, Optional, Sequence, Iterable, Tuple, Union from volatility3.framework import objects, renderers, exceptions, interfaces, constants from volatility3.framework.configuration import requirements -from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException, InvalidAddressException, \ - RegistryInvalidIndex +from volatility3.framework.layers.registry import ( + RegistryHive, + RegistryFormatException, + InvalidAddressException, + RegistryInvalidIndex, +) from volatility3.framework.renderers import TreeGrid, conversion, format_hints from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes from volatility3.plugins.windows.registry import hivelist @@ -82,8 +86,12 @@ class PrintKey(interfaces.plugins.PluginInterface): for k in key_path_items: try: key_path_names.append(k.get_name()) - except (InvalidAddressException, RegistryFormatException, RegistryInvalidIndex): - key_path_names.append('-') + except ( + InvalidAddressException, + RegistryFormatException, + RegistryInvalidIndex, + ): + key_path_names.append("-") key_path = "\\".join([k for k in key_path_names]) if node.vol.type_name.endswith(constants.BANG + "_CELL_DATA"): @@ -107,7 +115,11 @@ class PrintKey(interfaces.plugins.PluginInterface): if key_node.vol.offset not in [x.vol.offset for x in node_path]: try: key_node.get_name() - except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex) as excp: + except ( + exceptions.InvalidAddressException, + RegistryFormatException, + RegistryInvalidIndex, + ) as excp: vollog.debug(excp) continue @@ -157,7 +169,7 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, RegistryFormatException, - RegistryInvalidIndex + RegistryInvalidIndex, ) as excp: vollog.debug(excp) key_node_name = renderers.UnreadableValue() @@ -185,7 +197,7 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, RegistryFormatException, - RegistryInvalidIndex + RegistryInvalidIndex, ) as excp: vollog.debug(excp) value_node_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 82139fdf2..738f230b7 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -13,7 +13,11 @@ from typing import Any, Generator, List, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.layers.physical import BufferDataLayer -from volatility3.framework.layers.registry import RegistryHive, RegistryFormatException, RegistryInvalidIndex +from volatility3.framework.layers.registry import ( + RegistryHive, + RegistryFormatException, + RegistryInvalidIndex, +) from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed from volatility3.plugins.windows.registry import hivelist @@ -240,7 +244,11 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac for subkey in countkey.get_subkeys(): try: subkey_name = subkey.get_name() - except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex): + except ( + exceptions.InvalidAddressException, + RegistryFormatException, + RegistryInvalidIndex, + ): subkey_name = renderers.UnreadableValue() result = ( @@ -266,7 +274,11 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac for value in countkey.get_values(): try: value_name = value.get_name() - except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex): + except ( + exceptions.InvalidAddressException, + RegistryFormatException, + RegistryInvalidIndex, + ): value_name = renderers.UnreadableValue() with contextlib.suppress(UnicodeDecodeError): diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index b901139c3..fc4d46338 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -311,7 +311,11 @@ def _build_guid_name_map(key: reg_extensions.CM_KEY_NODE) -> Dict[str, str]: if value.get_name() == "Id": task_id_value = value break - except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + except ( + exceptions.InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): continue if ( @@ -328,7 +332,11 @@ def _build_guid_name_map(key: reg_extensions.CM_KEY_NODE) -> Dict[str, str]: mapping[id_str.decode("utf-16le", errors="replace").rstrip(NULL)] = str( key.get_name() ) - except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex): + except ( + exceptions.InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryInvalidIndex, + ): pass for subkey in key.get_subkeys(): @@ -1233,21 +1241,32 @@ information about triggers, actions, run times, and creation times.""" for value in key.get_values(): try: name = str(value.get_name()) - except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryFormatException): + except ( + exceptions.InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryFormatException, + ): continue if name in ["Actions", "Triggers", "DynamicInfo"]: values[name] = value - try: key_name = str(key.get_name()) - except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryFormatException): + except ( + exceptions.InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryFormatException, + ): key_name = None try: task_name = guid_mapping.get(key_name, renderers.NotAvailableValue()) - except (exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryFormatException): + except ( + exceptions.InvalidAddressException, + registry.RegistryFormatException, + registry.RegistryFormatException, + ): task_name = renderers.NotAvailableValue() try: diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index 7f284a36f..c6c2ee358 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -199,7 +199,11 @@ class CM_KEY_NODE(objects.StructType): # We could change the array type to a struct with both parts try: signature = node.cast("string", max_length=2, encoding="latin-1") - except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex): + except ( + exceptions.InvalidAddressException, + RegistryFormatException, + RegistryInvalidIndex, + ): return None listjump = None @@ -254,13 +258,21 @@ class CM_KEY_NODE(objects.StructType): if v != 0: try: node = hive.get_node(v) - except (RegistryInvalidIndex, RegistryFormatException, RegistryInvalidIndex) as excp: + except ( + RegistryInvalidIndex, + RegistryFormatException, + RegistryInvalidIndex, + ) as excp: vollog.debug(f"Invalid address {excp}") continue if isinstance(node, CM_KEY_VALUE): yield node - except (exceptions.InvalidAddressException, RegistryFormatException, RegistryInvalidIndex) as excp: + except ( + exceptions.InvalidAddressException, + RegistryFormatException, + RegistryInvalidIndex, + ) as excp: vollog.debug(f"Invalid address in get_values iteration: {excp}") return None From 6061270816c75f019e4ce185becfee5901aa7730 Mon Sep 17 00:00:00 2001 From: superponible Date: Mon, 10 Mar 2025 14:03:34 -0500 Subject: [PATCH 0765/1352] Potential fix for code scanning alert no. 381: Unused import Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- volatility3/framework/plugins/windows/lsadump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index aeea239c7..989d4d473 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -11,7 +11,7 @@ from Crypto.Cipher import ARC4, DES, AES from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.exceptions import InvalidAddressException -from volatility3.framework.interfaces.layers import IteratorValue + from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows import hashdump From e0168c7becf017f2cfbee326b5b3a847c7f69e4c Mon Sep 17 00:00:00 2001 From: superponible Date: Mon, 10 Mar 2025 14:03:45 -0500 Subject: [PATCH 0766/1352] Potential fix for code scanning alert no. 374: Testing equality to None Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- volatility3/framework/plugins/windows/prefetch.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/prefetch.py b/volatility3/framework/plugins/windows/prefetch.py index 3997bc012..30642b269 100644 --- a/volatility3/framework/plugins/windows/prefetch.py +++ b/volatility3/framework/plugins/windows/prefetch.py @@ -74,7 +74,7 @@ def prefix_code_tree_add_leaf(treeNodes: List[PREFIX_CODE_NODE], leafIndex: int, while bits > 1: bits -= 1 childIndex = (mask >> bits) & 1 - if node.child[childIndex] == None: + if node.child[childIndex] is None: node.child[childIndex] = treeNodes[i] treeNodes[i].leaf = False i += 1 From f52a857aa06986d6d7f4c12241ff1bf5d8625963 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Mon, 10 Mar 2025 14:10:59 -0500 Subject: [PATCH 0767/1352] #1476 - code cleanup --- .../framework/plugins/windows/prefetch.py | 178 +++++++++++------- .../plugins/windows/scheduled_tasks.py | 4 +- 2 files changed, 117 insertions(+), 65 deletions(-) diff --git a/volatility3/framework/plugins/windows/prefetch.py b/volatility3/framework/plugins/windows/prefetch.py index 30642b269..6e74f466f 100644 --- a/volatility3/framework/plugins/windows/prefetch.py +++ b/volatility3/framework/plugins/windows/prefetch.py @@ -18,8 +18,8 @@ class BitStream: self.source = source self.index = in_pos + 4 # read UInt16 little endian - mask = struct.unpack_from('> (32 - n) def skip(self, n: int) -> Union[None, Exception]: - self.mask = ((self.mask << n) & 0xFFFFFFFF) + self.mask = (self.mask << n) & 0xFFFFFFFF self.bits -= n if self.bits < 16: if self.index + 2 > len(self.source): return Exception("EOF Error") # read UInt16 little endian - self.mask += ((struct.unpack_from(' int: +def prefix_code_tree_add_leaf( + treeNodes: List[PREFIX_CODE_NODE], leafIndex: int, mask: int, bits: int +) -> int: node = treeNodes[0] i = leafIndex + 1 childIndex = None @@ -94,13 +99,13 @@ def prefix_code_tree_rebuild(input: bytes) -> PREFIX_CODE_NODE: symbolInfo[2 * i].id = 2 * i symbolInfo[2 * i].symbol = 2 * i - symbolInfo[2 * i].length = value & 0xf + symbolInfo[2 * i].length = value & 0xF value >>= 4 symbolInfo[2 * i + 1].id = 2 * i + 1 symbolInfo[2 * i + 1].symbol = 2 * i + 1 - symbolInfo[2 * i + 1].length = value & 0xf + symbolInfo[2 * i + 1].length = value & 0xF symbolInfo = sorted(symbolInfo, key=lambda x: (x.length, x.symbol)) @@ -128,9 +133,10 @@ def prefix_code_tree_rebuild(input: bytes) -> PREFIX_CODE_NODE: return root -def prefix_code_tree_decode_symbol(bstr: BitStream, root: PREFIX_CODE_NODE) -> Tuple[int, Union[None, Exception]]: +def prefix_code_tree_decode_symbol( + bstr: BitStream, root: PREFIX_CODE_NODE +) -> Tuple[int, Union[None, Exception]]: node = root - i = 0 while True: bit = bstr.lookup(1) err = bstr.skip(1) @@ -138,7 +144,7 @@ def prefix_code_tree_decode_symbol(bstr: BitStream, root: PREFIX_CODE_NODE) -> T return 0, err node = node.child[bit] - if node == None: + if node is None: return 0, Exception("Corruption detected") if node.leaf: @@ -146,11 +152,9 @@ def prefix_code_tree_decode_symbol(bstr: BitStream, root: PREFIX_CODE_NODE) -> T return node.symbol, None -def lz77_huffman_decompress_chunck(in_idx: int, - input: bytes, - out_idx: int, - output: bytearray, - chunk_size: int) -> Tuple[int, int, Union[None, Exception]]: +def lz77_huffman_decompress_chunck( + in_idx: int, input: bytes, out_idx: int, output: bytearray, chunk_size: int +) -> Tuple[int, int, Union[None, Exception]]: # Ensure there are at least 256 bytes available to read if in_idx + 256 > len(input): return 0, 0, Exception("EOF Error") @@ -187,7 +191,7 @@ def lz77_huffman_decompress_chunck(in_idx: int, bstr.index += 1 if length == 270: - length = struct.unpack_from(' Tuple[bytes, Union[None, Exception]]: +def lz77_huffman_decompress( + input: bytes, output_size: int +) -> Tuple[bytes, Union[None, Exception]]: output = bytearray(output_size) err = None @@ -226,7 +232,8 @@ def lz77_huffman_decompress(input: bytes, output_size: int) -> Tuple[bytes, Unio chunk_size = 65536 in_idx, out_idx, err = lz77_huffman_decompress_chunck( - in_idx, input, out_idx, output, chunk_size) + in_idx, input, out_idx, output, chunk_size + ) if err is not None: return output, err if out_idx >= len(output) or in_idx >= len(input): @@ -236,14 +243,22 @@ def lz77_huffman_decompress(input: bytes, output_size: int) -> Tuple[bytes, Unio class Prefetch(interfaces.plugins.PluginInterface): """Get and parse the prefetch files""" + _required_framework_version = (2, 0, 0) _version = (1, 0, 0) @classmethod def get_requirements(cls): - return [requirements.ModuleRequirement(name='kernel', description='Windows kernel', - architectures=["Intel32", "Intel64"]), - requirements.PluginRequirement(name='filescan', plugin=filescan.FileScan, version=(0, 0, 0)), ] + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.PluginRequirement( + name="filescan", plugin=filescan.FileScan, version=(0, 0, 0) + ), + ] @classmethod def version_17(cls, prefetch_file): @@ -254,15 +269,17 @@ class Prefetch(interfaces.plugins.PluginInterface): file_size = int.from_bytes(stream.read(4), "little") stream.seek(0x0010) - executable_raw = stream.read(60).decode('utf-16') - executable_name = executable_raw.split('\u0000')[0] + executable_raw = stream.read(60).decode("utf-16") + executable_name = executable_raw.split("\u0000")[0] stream.seek(0x004C) prefetch_hash = int.from_bytes(stream.read(4), "little") stream.seek(0x0078) last_execution_filetime = int.from_bytes(stream.read(8), "little") - last_execution_filetime_human = conversion.wintime_to_datetime(last_execution_filetime) + last_execution_filetime_human = conversion.wintime_to_datetime( + last_execution_filetime + ) stream.seek(0x0090) execution_counter = int.from_bytes(stream.read(4), "little") @@ -272,7 +289,7 @@ class Prefetch(interfaces.plugins.PluginInterface): file_size, format_hints.Hex(prefetch_hash), last_execution_filetime_human, - execution_counter + execution_counter, ) @classmethod @@ -284,15 +301,17 @@ class Prefetch(interfaces.plugins.PluginInterface): file_size = int.from_bytes(stream.read(4), "little") stream.seek(0x0010) - executable_raw = stream.read(60).decode('utf-16') - executable_name = executable_raw.split('\u0000')[0] + executable_raw = stream.read(60).decode("utf-16") + executable_name = executable_raw.split("\u0000")[0] stream.seek(0x004C) prefetch_hash = int.from_bytes(stream.read(4), "little") stream.seek(0x0080) last_execution_filetime = int.from_bytes(stream.read(8), "little") - last_execution_filetime_human = conversion.wintime_to_datetime(last_execution_filetime) + last_execution_filetime_human = conversion.wintime_to_datetime( + last_execution_filetime + ) stream.seek(0x0098) execution_counter = int.from_bytes(stream.read(4), "little") @@ -302,7 +321,7 @@ class Prefetch(interfaces.plugins.PluginInterface): file_size, format_hints.Hex(prefetch_hash), last_execution_filetime_human, - execution_counter + execution_counter, ) @classmethod @@ -314,15 +333,17 @@ class Prefetch(interfaces.plugins.PluginInterface): file_size = int.from_bytes(stream.read(4), "little") stream.seek(0x0010) - executable_raw = stream.read(60).decode('utf-16') - executable_name = executable_raw.split('\u0000')[0] + executable_raw = stream.read(60).decode("utf-16") + executable_name = executable_raw.split("\u0000")[0] stream.seek(0x004C) prefetch_hash = int.from_bytes(stream.read(4), "little") stream.seek(0x0080) last_execution_filetime = int.from_bytes(stream.read(8), "little") - last_execution_filetime_human = conversion.wintime_to_datetime(last_execution_filetime) + last_execution_filetime_human = conversion.wintime_to_datetime( + last_execution_filetime + ) stream.seek(0x00D0) execution_counter = int.from_bytes(stream.read(4), "little") @@ -332,7 +353,7 @@ class Prefetch(interfaces.plugins.PluginInterface): file_size, format_hints.Hex(prefetch_hash), last_execution_filetime_human, - execution_counter + execution_counter, ) @classmethod @@ -344,8 +365,8 @@ class Prefetch(interfaces.plugins.PluginInterface): file_size = int.from_bytes(stream.read(4), "little") stream.seek(0x0010) - executable_raw = stream.read(60).decode('utf-16') - executable_name = executable_raw.split('\u0000')[0] + executable_raw = stream.read(60).decode("utf-16") + executable_name = executable_raw.split("\u0000")[0] stream.seek(0x004C) prefetch_hash = int.from_bytes(stream.read(4), "little") @@ -353,7 +374,9 @@ class Prefetch(interfaces.plugins.PluginInterface): stream.seek(0x0080) # The first FILETIME is the most recent run time last_execution_filetime = int.from_bytes(stream.read(8), "little") - last_execution_filetime_human = conversion.wintime_to_datetime(last_execution_filetime) + last_execution_filetime_human = conversion.wintime_to_datetime( + last_execution_filetime + ) stream.seek(0x00C8) # Variant 1 execution_counter = int.from_bytes(stream.read(4), "little") @@ -366,7 +389,7 @@ class Prefetch(interfaces.plugins.PluginInterface): file_size, format_hints.Hex(prefetch_hash), last_execution_filetime_human, - execution_counter + execution_counter, ) @classmethod @@ -386,13 +409,15 @@ class Prefetch(interfaces.plugins.PluginInterface): vollog.info(f"decompressed size : {decompressed_size}") stream.seek(0x0008) compressed_bytes = stream.read() - prefetch_file = lz77_huffman_decompress(bytearray(compressed_bytes), decompressed_size)[0] + prefetch_file = lz77_huffman_decompress( + bytearray(compressed_bytes), decompressed_size + )[0] try: file_version = int.from_bytes(prefetch_file[:4], "little") signature = prefetch_file[4:8].decode() - vollog.info(f'File version : {file_version}') + vollog.info(f"File version : {file_version}") vollog.info(f"Signature : {signature}") - except: + except Exception: # We can not even read the header pass @@ -413,46 +438,63 @@ class Prefetch(interfaces.plugins.PluginInterface): yield result def _generator(self, files): - kernel = self.context.modules[self.config['kernel']] - offsets = [] + kernel = self.context.modules[self.config["kernel"]] for file_obj in files: - """Get the prefetch recovered files from the “filescan” plugin; """ + """Get the prefetch recovered files from the “filescan” plugin;""" try: file_name = file_obj.FileName.String file_extension = pathlib.Path(file_name).suffix if file_extension == ".pf": """If found, try to dump the prefetch file (inspired from the "DumpFiles" plugin)""" memory_objects = [] - memory_layer_name = self.context.layers[kernel.layer_name].config['memory_layer'] + memory_layer_name = self.context.layers[kernel.layer_name].config[ + "memory_layer" + ] memory_layer = self.context.layers[memory_layer_name] primary_layer = self.context.layers[kernel.layer_name] for member_name in ["DataSectionObject", "ImageSectionObject"]: try: - section_obj = getattr(file_obj.SectionObjectPointer, member_name) - control_area = section_obj.dereference().cast("_CONTROL_AREA") + section_obj = getattr( + file_obj.SectionObjectPointer, member_name + ) + control_area = section_obj.dereference().cast( + "_CONTROL_AREA" + ) if control_area.is_valid(): vollog.info(f"Found : {file_obj.FileName.String}") memory_objects.append((control_area, memory_layer)) except exceptions.InvalidAddressException: - vollog.log(constants.LOGLEVEL_VVV, - f"{member_name} is unavailable for file {file_obj.vol.offset:#x}") + vollog.log( + constants.LOGLEVEL_VVV, + f"{member_name} is unavailable for file {file_obj.vol.offset:#x}", + ) try: scm_pointer = file_obj.SectionObjectPointer.SharedCacheMap - shared_cache_map = scm_pointer.dereference().cast("_SHARED_CACHE_MAP") + shared_cache_map = scm_pointer.dereference().cast( + "_SHARED_CACHE_MAP" + ) if shared_cache_map.is_valid(): memory_objects.append((shared_cache_map, primary_layer)) except exceptions.InvalidAddressException: - vollog.log(constants.LOGLEVEL_VVV, - f"SharedCacheMap is unavailable for file {file_obj.vol.offset:#x}") + vollog.log( + constants.LOGLEVEL_VVV, + f"SharedCacheMap is unavailable for file {file_obj.vol.offset:#x}", + ) vollog.info(f"memory_objects : {memory_objects}") """Now, read and parse our PF to retrieve our artifacts""" for memory_object, layer in memory_objects: bytes_read = 0 - prefetch_raw = b'' + prefetch_raw = b"" try: - for mem_offset, _, datasize in memory_object.get_available_pages(): - prefetch_raw += layer.read(mem_offset, datasize, pad=True) + for ( + mem_offset, + _, + datasize, + ) in memory_object.get_available_pages(): + prefetch_raw += layer.read( + mem_offset, datasize, pad=True + ) bytes_read += len(prefetch_raw) vollog.info(f"Read {bytes_read}") if not bytes_read: @@ -463,16 +505,26 @@ class Prefetch(interfaces.plugins.PluginInterface): yield 0, result except exceptions.InvalidAddressException: - vollog.debug(f"Unable to dump file at {file_obj.vol.offset:#x}") - pass + vollog.debug( + f"Unable to dump file at {file_obj.vol.offset:#x}" + ) + except exceptions.InvalidAddressException: continue def run(self): - kernel = self.context.modules[self.config['kernel']] - return renderers.TreeGrid([ - ("ExecutableName", str), - ("FileSize", int), - ("PrefetchHash", format_hints.Hex), - ("LastExecution", datetime.datetime), ("ExecutionCounter", int)], - self._generator(filescan.FileScan.scan_files(self.context, kernel.layer_name, kernel.symbol_table_name))) \ No newline at end of file + kernel = self.context.modules[self.config["kernel"]] + return renderers.TreeGrid( + [ + ("ExecutableName", str), + ("FileSize", int), + ("PrefetchHash", format_hints.Hex), + ("LastExecution", datetime.datetime), + ("ExecutionCounter", int), + ], + self._generator( + filescan.FileScan.scan_files( + self.context, kernel.layer_name, kernel.symbol_table_name + ) + ), + ) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index fc4d46338..dd821bb35 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -336,8 +336,8 @@ def _build_guid_name_map(key: reg_extensions.CM_KEY_NODE) -> Dict[str, str]: exceptions.InvalidAddressException, registry.RegistryFormatException, registry.RegistryInvalidIndex, - ): - pass + ) as excp: + vollog.debug(f"Exception occurred while decoding id_str: {excp}") for subkey in key.get_subkeys(): mapping.update(_build_guid_name_map(subkey)) From 9b23feef2be35e079f7dba02e2a1e31343d8315e Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Mon, 10 Mar 2025 14:17:24 -0500 Subject: [PATCH 0768/1352] #1476 - ruff fixes --- volatility3/framework/plugins/windows/prefetch.py | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/prefetch.py b/volatility3/framework/plugins/windows/prefetch.py index 6e74f466f..a5f054f15 100644 --- a/volatility3/framework/plugins/windows/prefetch.py +++ b/volatility3/framework/plugins/windows/prefetch.py @@ -3,14 +3,19 @@ # https://github.com/libyal/libscca/blob/main/documentation/Windows%20Prefetch%20File%20(PF)%20format.asciidoc # https://github.com/volatilityfoundation/volatility3/ # https://github.com/EricZimmerman/Prefetch/tree/master/Prefetch -import logging, pathlib, datetime, io, struct +import logging +import pathlib +import datetime +import io +import struct + from volatility3.framework import renderers, interfaces, exceptions, constants from volatility3.framework.configuration import requirements from volatility3.plugins.windows import filescan from volatility3.framework.renderers import format_hints, conversion +from typing import Tuple, List, Union vollog = logging.getLogger(__name__) -from typing import Tuple, List, Union class BitStream: @@ -498,7 +503,7 @@ class Prefetch(interfaces.plugins.PluginInterface): bytes_read += len(prefetch_raw) vollog.info(f"Read {bytes_read}") if not bytes_read: - vollog.info(f"Prefetch is empty") + vollog.info("Prefetch is empty") else: """Prefetch parsing""" for result in self.parse_prefetch(prefetch_raw): From 4b74de4104bca92a9ceb92a1784c62aa11935fbd Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Mon, 10 Mar 2025 15:32:13 -0500 Subject: [PATCH 0769/1352] #1645 - duplicate list_processes code --- volatility3/framework/layers/registry.py | 54 +++++++++++++++++++----- 1 file changed, 44 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 48dd2b624..19e02ac33 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -14,7 +14,7 @@ from volatility3.framework.configuration.requirements import ( from volatility3.framework.exceptions import InvalidAddressException from volatility3.framework.layers import linear from volatility3.framework.symbols import intermed -from volatility3.plugins.windows import pslist +from volatility3.framework.symbols.windows import extensions vollog = logging.getLogger(__name__) @@ -65,16 +65,15 @@ class RegistryHive(linear.LinearlyMappedLayer): # Win10 17063 introduced the Registry process to map most hives. Check # if it exists and update RegistryHive._base_layer - for proc in pslist.PsList.list_processes( - context=self.context, kernel_module_name=self.config["kernel_module_name"] - ): - proc_name = proc.ImageFileName.cast( - "string", max_length=proc.ImageFileName.vol.count, errors="replace" + try: + registry_proc = self._find_registry_process() + if registry_proc: + self._base_layer = registry_proc.add_process_layer() + except ValueError: + vollog.log( + constants.LOGLEVEL_VVVV, + "Error walking process list, results may not be valid.", ) - if proc_name == "Registry" and proc.InheritedFromUniqueProcessId == 4: - proc_layer_name = proc.add_process_layer() - self._base_layer = proc_layer_name - break self._base_block = self.hive.BaseBlock.dereference() @@ -96,6 +95,41 @@ class RegistryHive(linear.LinearlyMappedLayer): f"Exception when setting hive {self.name} max address, using {hex(self._maxaddr)}", ) + def _find_registry_process(self) -> Optional["extensions.EPROCESS"]: + """Walk the active process list and return the Registry process if it exists. Duplicates + PsList.list_processes() since pulling in the plugin causes problems. + + Returns: + The Registry EPROCESS object if it exists, or None + """ + + kernel = self.context.modules.get("kernel") + + if not kernel or not kernel.offset: + raise ValueError( + "Intel layer does not have an associated kernel virtual offset, failing" + ) + + ps_aph_offset = kernel.get_symbol("PsActiveProcessHead").address + list_entry = kernel.object(object_type="_LIST_ENTRY", offset=ps_aph_offset) + reloff = kernel.get_type("_EPROCESS").relative_child_offset( + "ActiveProcessLinks" + ) + eproc = kernel.object( + object_type="_EPROCESS", + offset=list_entry.vol.offset - reloff, + absolute=True, + ) + + for proc in eproc.ActiveProcessLinks: + proc_name = proc.ImageFileName.cast( + "string", max_length=proc.ImageFileName.vol.count, errors="replace" + ) + if proc_name == "Registry" and proc.InheritedFromUniqueProcessId == 4: + return proc + + return None + def _get_hive_maxaddr(self, volatile): return ( self._hive_maxaddr_volatile if volatile else self._hive_maxaddr_non_volatile From 7d5d379144ce1a34a4346b6068e0008987b66407 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 21:24:55 +0000 Subject: [PATCH 0770/1352] Allow desktops and window stations to come from the paged or non-paged pool --- volatility3/framework/plugins/windows/poolscanner.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 7dd6821b8..1f29a3aed 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -194,14 +194,14 @@ class PoolScanner(plugins.PluginInterface): b"Wind", type_name=gui_table + constants.BANG + "tagWINDOWSTATION", size=(0x90, None), - page_type=PoolType.PAGED, + page_type=PoolType.PAGED | PoolType.NONPAGED, object_type="WindowStation", skip_type_test=True, ), PoolConstraint( b"Desk", type_name=gui_table + constants.BANG + "tagDESKTOP", - page_type=PoolType.PAGED, + page_type=PoolType.PAGED | PoolType.NONPAGED, object_type="Desktop", skip_type_test=True, ), From f17907200ddde0a4b9cf64581a841fadb034d39e Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 10 Mar 2025 21:26:58 +0000 Subject: [PATCH 0771/1352] No longer allocate session modules in support of the GUI objects at offset 0. Instantiate objects at the absolute address explicility. --- volatility3/framework/plugins/windows/windowstations.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index 0ca92eb97..cd02938cd 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -115,7 +115,9 @@ class WindowStations(interfaces.plugins.PluginInterface): for session_id, session_layer in session_map.items(): session_module = context.module( - gui_table_name, layer_name=session_layer, offset=0 + gui_table_name, + layer_name=session_layer, + offset=context.modules[module_name].offset, ) session_map[session_id] = session_module @@ -177,7 +179,9 @@ class WindowStations(interfaces.plugins.PluginInterface): if session_module: # create the object its own address space (per-session) yield session_module.object( - object_type=object_type, offset=mem_object.vol.offset + object_type=object_type, + offset=mem_object.vol.offset, + absolute=True, ) @classmethod From cbab1d1f49a6bdeaa2acda52290ccb925c24f9a3 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Tue, 11 Mar 2025 09:30:38 -0500 Subject: [PATCH 0774/1352] #1446 - pid is objects.Pointer, not int --- volatility3/framework/plugins/windows/pstree.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 24f7e2356..39db56243 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -20,10 +20,10 @@ class PsTree(interfaces.plugins.PluginInterface): def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) - self._processes: Dict[int, Tuple[interfaces.objects.ObjectInterface, int]] = {} - self._levels: Dict[int, int] = {} - self._children: Dict[int, Set[int]] = {} - self._ancestors: Set[int] = set([]) + self._processes: Dict[objects.Pointer, Tuple[interfaces.objects.ObjectInterface, int]] = {} + self._levels: Dict[objects.Pointer, int] = {} + self._children: Dict[objects.Pointer, Set[int]] = {} + self._ancestors: Set[objects.Pointer] = set([]) @classmethod def get_requirements(cls): From d148d8f9d8fb28f0027b6f276f6e26fdfd229068 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Tue, 11 Mar 2025 09:31:54 -0500 Subject: [PATCH 0775/1352] #1446 - black fixes --- volatility3/framework/plugins/windows/pstree.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 39db56243..3a5e1c878 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -20,7 +20,9 @@ class PsTree(interfaces.plugins.PluginInterface): def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) - self._processes: Dict[objects.Pointer, Tuple[interfaces.objects.ObjectInterface, int]] = {} + self._processes: Dict[ + objects.Pointer, Tuple[interfaces.objects.ObjectInterface, int] + ] = {} self._levels: Dict[objects.Pointer, int] = {} self._children: Dict[objects.Pointer, Set[int]] = {} self._ancestors: Set[objects.Pointer] = set([]) From ac74de694a82bd4aea169f3c209521fd3702d1fb Mon Sep 17 00:00:00 2001 From: superponible Date: Tue, 11 Mar 2025 09:46:10 -0500 Subject: [PATCH 0776/1352] Update volatility3/framework/layers/registry.py Co-authored-by: ikelos --- volatility3/framework/layers/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 19e02ac33..57747c14a 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -103,7 +103,7 @@ class RegistryHive(linear.LinearlyMappedLayer): The Registry EPROCESS object if it exists, or None """ - kernel = self.context.modules.get("kernel") + kernel = self.context.modules.get(self.config["kernel_module_name"]) if not kernel or not kernel.offset: raise ValueError( From d32f3e76d4746ca235c1d5ae1a3668167ece1297 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Tue, 11 Mar 2025 09:47:47 -0500 Subject: [PATCH 0777/1352] #1645 - remove quoutes around type --- volatility3/framework/layers/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 57747c14a..9444df675 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -95,7 +95,7 @@ class RegistryHive(linear.LinearlyMappedLayer): f"Exception when setting hive {self.name} max address, using {hex(self._maxaddr)}", ) - def _find_registry_process(self) -> Optional["extensions.EPROCESS"]: + def _find_registry_process(self) -> Optional[extensions.EPROCESS]: """Walk the active process list and return the Registry process if it exists. Duplicates PsList.list_processes() since pulling in the plugin causes problems. From 7f7295cdb7718da9719617297722de0bcd0b17f3 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Tue, 11 Mar 2025 09:52:24 -0500 Subject: [PATCH 0778/1352] #1476 - remove unfinished prefetch plugin --- .../framework/plugins/windows/prefetch.py | 535 ------------------ 1 file changed, 535 deletions(-) delete mode 100644 volatility3/framework/plugins/windows/prefetch.py diff --git a/volatility3/framework/plugins/windows/prefetch.py b/volatility3/framework/plugins/windows/prefetch.py deleted file mode 100644 index a5f054f15..000000000 --- a/volatility3/framework/plugins/windows/prefetch.py +++ /dev/null @@ -1,535 +0,0 @@ -# References : -# https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-XCA/%5bMS-XCA%5d.pdf -# https://github.com/libyal/libscca/blob/main/documentation/Windows%20Prefetch%20File%20(PF)%20format.asciidoc -# https://github.com/volatilityfoundation/volatility3/ -# https://github.com/EricZimmerman/Prefetch/tree/master/Prefetch -import logging -import pathlib -import datetime -import io -import struct - -from volatility3.framework import renderers, interfaces, exceptions, constants -from volatility3.framework.configuration import requirements -from volatility3.plugins.windows import filescan -from volatility3.framework.renderers import format_hints, conversion -from typing import Tuple, List, Union - -vollog = logging.getLogger(__name__) - - -class BitStream: - def __init__(self, source: bytes, in_pos: int): - self.source = source - self.index = in_pos + 4 - # read UInt16 little endian - mask = struct.unpack_from(" int: - if n == 0: - return 0 - return self.mask >> (32 - n) - - def skip(self, n: int) -> Union[None, Exception]: - self.mask = (self.mask << n) & 0xFFFFFFFF - self.bits -= n - if self.bits < 16: - if self.index + 2 > len(self.source): - return Exception("EOF Error") - # read UInt16 little endian - self.mask += ( - (struct.unpack_from(" int: - node = treeNodes[0] - i = leafIndex + 1 - childIndex = None - - while bits > 1: - bits -= 1 - childIndex = (mask >> bits) & 1 - if node.child[childIndex] is None: - node.child[childIndex] = treeNodes[i] - treeNodes[i].leaf = False - i += 1 - node = node.child[childIndex] - - node.child[mask & 1] = treeNodes[leafIndex] - - return i - - -def prefix_code_tree_rebuild(input: bytes) -> PREFIX_CODE_NODE: - treeNodes = [PREFIX_CODE_NODE() for _ in range(1024)] - symbolInfo = [PREFIX_CODE_SYMBOL() for _ in range(512)] - - for i in range(256): - value = input[i] - - symbolInfo[2 * i].id = 2 * i - symbolInfo[2 * i].symbol = 2 * i - symbolInfo[2 * i].length = value & 0xF - - value >>= 4 - - symbolInfo[2 * i + 1].id = 2 * i + 1 - symbolInfo[2 * i + 1].symbol = 2 * i + 1 - symbolInfo[2 * i + 1].length = value & 0xF - - symbolInfo = sorted(symbolInfo, key=lambda x: (x.length, x.symbol)) - - i = 0 - while i < 512 and symbolInfo[i].length == 0: - i += 1 - - mask = 0 - bits = 1 - - root = treeNodes[0] - root.leaf = False - - j = 1 - while i < 512: - treeNodes[j].id = j - treeNodes[j].symbol = symbolInfo[i].symbol - treeNodes[j].leaf = True - mask = mask << (symbolInfo[i].length - bits) - bits = symbolInfo[i].length - j = prefix_code_tree_add_leaf(treeNodes, j, mask, bits) - mask += 1 - i += 1 - - return root - - -def prefix_code_tree_decode_symbol( - bstr: BitStream, root: PREFIX_CODE_NODE -) -> Tuple[int, Union[None, Exception]]: - node = root - while True: - bit = bstr.lookup(1) - err = bstr.skip(1) - if err is not None: - return 0, err - - node = node.child[bit] - if node is None: - return 0, Exception("Corruption detected") - - if node.leaf: - break - return node.symbol, None - - -def lz77_huffman_decompress_chunck( - in_idx: int, input: bytes, out_idx: int, output: bytearray, chunk_size: int -) -> Tuple[int, int, Union[None, Exception]]: - # Ensure there are at least 256 bytes available to read - if in_idx + 256 > len(input): - return 0, 0, Exception("EOF Error") - - root = prefix_code_tree_rebuild(input[in_idx:]) - # print_tree(root) - bstr = BitStream(input, in_idx + 256) - - i = out_idx - - while i < out_idx + chunk_size: - symbol, err = prefix_code_tree_decode_symbol(bstr, root) - - if err is not None: - return int(bstr.index), i, err - - if symbol < 256: - output[i] = symbol - i += 1 - else: - symbol -= 256 - length = symbol & 15 - symbol >>= 4 - - offset = 0 - if symbol != 0: - offset = int(bstr.lookup(symbol)) - - offset |= 1 << symbol - offset = -offset - - if length == 15: - length = bstr.source[bstr.index] + 15 - bstr.index += 1 - - if length == 270: - length = struct.unpack_from(" 0: - if i + offset < 0: - print(i + offset) - return int(bstr.index), i, Exception("Decompression Error") - - output[i] = output[i + offset] - i += 1 - length -= 1 - if length == 0: - break - return int(bstr.index), i, None - - -def lz77_huffman_decompress( - input: bytes, output_size: int -) -> Tuple[bytes, Union[None, Exception]]: - output = bytearray(output_size) - err = None - - # Index into the input buffer. - in_idx = 0 - - # Index into the output buffer. - out_idx = 0 - - while True: - # How much data belongs in the current chunk. Chunks - # are split into maximum 65536 bytes. - chunk_size = output_size - out_idx - if chunk_size > 65536: - chunk_size = 65536 - - in_idx, out_idx, err = lz77_huffman_decompress_chunck( - in_idx, input, out_idx, output, chunk_size - ) - if err is not None: - return output, err - if out_idx >= len(output) or in_idx >= len(input): - break - return output, None - - -class Prefetch(interfaces.plugins.PluginInterface): - """Get and parse the prefetch files""" - - _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) - - @classmethod - def get_requirements(cls): - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.PluginRequirement( - name="filescan", plugin=filescan.FileScan, version=(0, 0, 0) - ), - ] - - @classmethod - def version_17(cls, prefetch_file): - """Extract pf information for Version 17""" - stream = io.BytesIO(prefetch_file) - - stream.seek(0x000C) - file_size = int.from_bytes(stream.read(4), "little") - - stream.seek(0x0010) - executable_raw = stream.read(60).decode("utf-16") - executable_name = executable_raw.split("\u0000")[0] - - stream.seek(0x004C) - prefetch_hash = int.from_bytes(stream.read(4), "little") - - stream.seek(0x0078) - last_execution_filetime = int.from_bytes(stream.read(8), "little") - last_execution_filetime_human = conversion.wintime_to_datetime( - last_execution_filetime - ) - - stream.seek(0x0090) - execution_counter = int.from_bytes(stream.read(4), "little") - - yield ( - executable_name, - file_size, - format_hints.Hex(prefetch_hash), - last_execution_filetime_human, - execution_counter, - ) - - @classmethod - def version_23(cls, prefetch_file): - """Extract pf information for Version 23""" - stream = io.BytesIO(prefetch_file) - - stream.seek(0x000C) - file_size = int.from_bytes(stream.read(4), "little") - - stream.seek(0x0010) - executable_raw = stream.read(60).decode("utf-16") - executable_name = executable_raw.split("\u0000")[0] - - stream.seek(0x004C) - prefetch_hash = int.from_bytes(stream.read(4), "little") - - stream.seek(0x0080) - last_execution_filetime = int.from_bytes(stream.read(8), "little") - last_execution_filetime_human = conversion.wintime_to_datetime( - last_execution_filetime - ) - - stream.seek(0x0098) - execution_counter = int.from_bytes(stream.read(4), "little") - - yield ( - executable_name, - file_size, - format_hints.Hex(prefetch_hash), - last_execution_filetime_human, - execution_counter, - ) - - @classmethod - def version_26(cls, prefetch_file): - """Extract pf information for Version 26""" - stream = io.BytesIO(prefetch_file) - - stream.seek(0x000C) - file_size = int.from_bytes(stream.read(4), "little") - - stream.seek(0x0010) - executable_raw = stream.read(60).decode("utf-16") - executable_name = executable_raw.split("\u0000")[0] - - stream.seek(0x004C) - prefetch_hash = int.from_bytes(stream.read(4), "little") - - stream.seek(0x0080) - last_execution_filetime = int.from_bytes(stream.read(8), "little") - last_execution_filetime_human = conversion.wintime_to_datetime( - last_execution_filetime - ) - - stream.seek(0x00D0) - execution_counter = int.from_bytes(stream.read(4), "little") - - yield ( - executable_name, - file_size, - format_hints.Hex(prefetch_hash), - last_execution_filetime_human, - execution_counter, - ) - - @classmethod - def version_30(cls, prefetch_file): - """Extract pf information for Version 30""" - stream = io.BytesIO(prefetch_file) - - stream.seek(0x000C) - file_size = int.from_bytes(stream.read(4), "little") - - stream.seek(0x0010) - executable_raw = stream.read(60).decode("utf-16") - executable_name = executable_raw.split("\u0000")[0] - - stream.seek(0x004C) - prefetch_hash = int.from_bytes(stream.read(4), "little") - - stream.seek(0x0080) - # The first FILETIME is the most recent run time - last_execution_filetime = int.from_bytes(stream.read(8), "little") - last_execution_filetime_human = conversion.wintime_to_datetime( - last_execution_filetime - ) - - stream.seek(0x00C8) # Variant 1 - execution_counter = int.from_bytes(stream.read(4), "little") - if execution_counter == 0: - stream.seek(0x00D0) # Variant 2 - execution_counter = int.from_bytes(stream.read(4), "little") - - yield ( - executable_name, - file_size, - format_hints.Hex(prefetch_hash), - last_execution_filetime_human, - execution_counter, - ) - - @classmethod - def parse_prefetch(cls, prefetch_file): - WinXpOrWin2K3 = 17 - VistaOrWin7 = 23 - Win8xOrWin2012x = 26 - Win10OrWin11 = 30 - stream = io.BytesIO(prefetch_file) - # First, we need to know if the prefetch is compressed (Win10/11) - signature = prefetch_file[:3].decode() - if signature == "MAM": - vollog.info("Windows 1X prefetch file detected.") - # The size of decompressed data is at offset 4 - stream.seek(0x0004) - decompressed_size = int.from_bytes(stream.read(4), "little") - vollog.info(f"decompressed size : {decompressed_size}") - stream.seek(0x0008) - compressed_bytes = stream.read() - prefetch_file = lz77_huffman_decompress( - bytearray(compressed_bytes), decompressed_size - )[0] - try: - file_version = int.from_bytes(prefetch_file[:4], "little") - signature = prefetch_file[4:8].decode() - vollog.info(f"File version : {file_version}") - vollog.info(f"Signature : {signature}") - except Exception: - # We can not even read the header - pass - - if signature != "SCCA": - vollog.info("Wrong signature, should be SCCA") - return - if file_version == WinXpOrWin2K3: - for result in cls.version_17(prefetch_file): - yield result - elif file_version == VistaOrWin7: - for result in cls.version_23(prefetch_file): - yield result - elif file_version == Win8xOrWin2012x: - for result in cls.version_26(prefetch_file): - yield result - elif file_version == Win10OrWin11: - for result in cls.version_30(prefetch_file): - yield result - - def _generator(self, files): - kernel = self.context.modules[self.config["kernel"]] - for file_obj in files: - """Get the prefetch recovered files from the “filescan” plugin;""" - try: - file_name = file_obj.FileName.String - file_extension = pathlib.Path(file_name).suffix - if file_extension == ".pf": - """If found, try to dump the prefetch file (inspired from the "DumpFiles" plugin)""" - memory_objects = [] - memory_layer_name = self.context.layers[kernel.layer_name].config[ - "memory_layer" - ] - memory_layer = self.context.layers[memory_layer_name] - primary_layer = self.context.layers[kernel.layer_name] - for member_name in ["DataSectionObject", "ImageSectionObject"]: - try: - section_obj = getattr( - file_obj.SectionObjectPointer, member_name - ) - control_area = section_obj.dereference().cast( - "_CONTROL_AREA" - ) - if control_area.is_valid(): - vollog.info(f"Found : {file_obj.FileName.String}") - memory_objects.append((control_area, memory_layer)) - except exceptions.InvalidAddressException: - vollog.log( - constants.LOGLEVEL_VVV, - f"{member_name} is unavailable for file {file_obj.vol.offset:#x}", - ) - try: - scm_pointer = file_obj.SectionObjectPointer.SharedCacheMap - shared_cache_map = scm_pointer.dereference().cast( - "_SHARED_CACHE_MAP" - ) - if shared_cache_map.is_valid(): - memory_objects.append((shared_cache_map, primary_layer)) - except exceptions.InvalidAddressException: - vollog.log( - constants.LOGLEVEL_VVV, - f"SharedCacheMap is unavailable for file {file_obj.vol.offset:#x}", - ) - vollog.info(f"memory_objects : {memory_objects}") - - """Now, read and parse our PF to retrieve our artifacts""" - for memory_object, layer in memory_objects: - bytes_read = 0 - prefetch_raw = b"" - try: - for ( - mem_offset, - _, - datasize, - ) in memory_object.get_available_pages(): - prefetch_raw += layer.read( - mem_offset, datasize, pad=True - ) - bytes_read += len(prefetch_raw) - vollog.info(f"Read {bytes_read}") - if not bytes_read: - vollog.info("Prefetch is empty") - else: - """Prefetch parsing""" - for result in self.parse_prefetch(prefetch_raw): - yield 0, result - - except exceptions.InvalidAddressException: - vollog.debug( - f"Unable to dump file at {file_obj.vol.offset:#x}" - ) - - except exceptions.InvalidAddressException: - continue - - def run(self): - kernel = self.context.modules[self.config["kernel"]] - return renderers.TreeGrid( - [ - ("ExecutableName", str), - ("FileSize", int), - ("PrefetchHash", format_hints.Hex), - ("LastExecution", datetime.datetime), - ("ExecutionCounter", int), - ], - self._generator( - filescan.FileScan.scan_files( - self.context, kernel.layer_name, kernel.symbol_table_name - ) - ), - ) From d9c9e11127963f8059a5ed5ee05def65fbfdbd45 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Tue, 11 Mar 2025 13:41:01 -0500 Subject: [PATCH 0779/1352] #1446 - uses ints instead of objects.Pointer --- volatility3/framework/plugins/windows/pstree.py | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/pstree.py b/volatility3/framework/plugins/windows/pstree.py index 3a5e1c878..373c555f6 100644 --- a/volatility3/framework/plugins/windows/pstree.py +++ b/volatility3/framework/plugins/windows/pstree.py @@ -5,7 +5,7 @@ import datetime import logging from typing import Callable, Dict, Set, Tuple -from volatility3.framework import objects, interfaces, renderers, exceptions +from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import pslist @@ -20,12 +20,10 @@ class PsTree(interfaces.plugins.PluginInterface): def __init__(self, *args, **kwargs) -> None: super().__init__(*args, **kwargs) - self._processes: Dict[ - objects.Pointer, Tuple[interfaces.objects.ObjectInterface, int] - ] = {} - self._levels: Dict[objects.Pointer, int] = {} - self._children: Dict[objects.Pointer, Set[int]] = {} - self._ancestors: Set[objects.Pointer] = set([]) + self._processes: Dict[int, Tuple[interfaces.objects.ObjectInterface, int]] = {} + self._levels: Dict[int, int] = {} + self._children: Dict[int, Set[int]] = {} + self._ancestors: Set[int] = set([]) @classmethod def get_requirements(cls): @@ -54,7 +52,7 @@ class PsTree(interfaces.plugins.PluginInterface): def find_level( self, - pid: objects.Pointer, + pid: int, filter_func: Callable[ [interfaces.objects.ObjectInterface], bool ] = lambda _: False, @@ -106,7 +104,7 @@ class PsTree(interfaces.plugins.PluginInterface): process_pids = set([]) - def yield_processes(pid, descendant: bool = False): + def yield_processes(pid: int, descendant: bool = False): if pid in process_pids: vollog.debug(f"Pid cycle: already processed pid {pid}") return None From 95aee9a66402480c24f042dde1085bdbfc92d4ea Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Tue, 11 Mar 2025 16:04:06 -0500 Subject: [PATCH 0780/1352] #1476 - introduce RegistryException for simpler exception handling --- volatility3/framework/layers/registry.py | 10 ++++--- .../framework/plugins/windows/amcache.py | 10 +++---- .../framework/plugins/windows/envars.py | 27 +++++++------------ .../plugins/windows/getservicesids.py | 9 +++---- .../framework/plugins/windows/getsids.py | 10 +++---- .../framework/plugins/windows/hashdump.py | 11 +++++--- .../framework/plugins/windows/lsadump.py | 9 +++---- .../plugins/windows/registry/printkey.py | 22 +++++++-------- .../plugins/windows/registry/userassist.py | 11 +++----- .../plugins/windows/scheduled_tasks.py | 19 +++++-------- .../framework/plugins/windows/svcscan.py | 4 +-- .../symbols/windows/extensions/registry.py | 24 ++++++----------- .../plugins/windows/registry/certificates.py | 2 +- 13 files changed, 69 insertions(+), 99 deletions(-) diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index 9ca32ed31..1c16cedcf 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -19,11 +19,15 @@ from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) -class RegistryFormatException(exceptions.LayerException): +class RegistryException(exceptions.LayerException): + """Base Registry Exception class for catching Registry layer errors.""" + + +class RegistryFormatException(RegistryException): """Thrown when an error occurs with the underlying Registry file format.""" -class RegistryInvalidIndex(exceptions.LayerException): +class RegistryInvalidIndex(RegistryException): """Thrown when an index that doesn't exist or can't be found occurs.""" @@ -142,7 +146,7 @@ class RegistryHive(linear.LinearlyMappedLayer): cell = self.get_cell(cell_offset) try: signature = cell.cast("string", max_length=2, encoding="latin-1") - except (RegistryInvalidIndex, exceptions.InvalidAddressException): + except (RegistryException, exceptions.InvalidAddressException): vollog.debug( f"Failed to get cell signature for cell (0x{cell.vol.offset:x})" ) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 133297de3..5920cd266 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -544,7 +544,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): amcache.get_key("Root\\InventoryDriverBinary") # type: ignore ) ) - except (KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryException): # Registry key not found pass @@ -555,7 +555,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): amcache.get_key("Root\\Programs") ) # type: ignore } - except (KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryException): programs = {} try: @@ -565,7 +565,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ), key=_entry_sort_key, ) - except (KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryException): files = [] for program_id, file_entries in itertools.groupby( @@ -594,7 +594,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): amcache.get_key("Root\\InventoryApplication") # type: ignore ) ) - except (KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryException): programs = {} try: @@ -604,7 +604,7 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ), key=_entry_sort_key, ) - except (KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryException): files = [] for program_id, file_entries in itertools.groupby( diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index d197fbc98..6360ca10b 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -73,13 +73,11 @@ class Envars(interfaces.plugins.PluginInterface): ) except ( KeyError, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): with contextlib.suppress( KeyError, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): sys = hive.get_key( "ControlSet001\\Control\\Session Manager\\Environment" @@ -87,8 +85,7 @@ class Envars(interfaces.plugins.PluginInterface): if sys: with contextlib.suppress( KeyError, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): for node in sys.get_values(): try: @@ -97,8 +94,7 @@ class Envars(interfaces.plugins.PluginInterface): values.append(value_node_name) except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): vollog.log( constants.LOGLEVEL_VVV, @@ -110,15 +106,13 @@ class Envars(interfaces.plugins.PluginInterface): ## The user-specific variables with contextlib.suppress( KeyError, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): ntuser = hive.get_key("Environment") if ntuser: with contextlib.suppress( KeyError, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): for node in ntuser.get_values(): try: @@ -127,8 +121,7 @@ class Envars(interfaces.plugins.PluginInterface): values.append(value_node_name) except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): vollog.log( constants.LOGLEVEL_VVV, @@ -141,8 +134,7 @@ class Envars(interfaces.plugins.PluginInterface): key = hive.get_key("Volatile Environment") except ( KeyError, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): continue try: @@ -153,8 +145,7 @@ class Envars(interfaces.plugins.PluginInterface): values.append(value_node_name) except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): vollog.log( constants.LOGLEVEL_VVV, diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index c334fe722..19a73fba8 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -88,16 +88,14 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): except ( KeyError, exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): try: services = hive.get_key(r"ControlSet001\Services") except ( KeyError, exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): continue @@ -107,8 +105,7 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): sid_name = s.get_name() except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): continue diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 0d54ea12c..786dc3394 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -116,8 +116,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): sid = str(subkey.get_name()) except ( exceptions.InvalidAddressException, - layers.registry.RegistryFormatException, - layers.registry.RegistryInvalidIndex, + layers.registry.RegistryException, ): continue @@ -127,8 +126,7 @@ class GetSIDs(interfaces.plugins.PluginInterface): value_node_name = node.get_name() or "(Default)" except ( exceptions.InvalidAddressException, - layers.registry.RegistryFormatException, - layers.registry.RegistryInvalidIndex, + layers.registry.RegistryException, ): continue try: @@ -162,13 +160,13 @@ class GetSIDs(interfaces.plugins.PluginInterface): except ( ValueError, exceptions.InvalidAddressException, - layers.registry.RegistryFormatException, + layers.registry.RegistryException, ): continue except ( KeyError, exceptions.InvalidAddressException, - layers.registry.RegistryFormatException, + layers.registry.RegistryException, ): continue diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index d90e23802..68d5f834a 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -12,6 +12,7 @@ from Crypto.Cipher import AES, ARC4, DES from volatility3.framework import interfaces, renderers, exceptions, constants from volatility3.framework.configuration import requirements from volatility3.framework.exceptions import InvalidAddressException +from volatility3.framework.layers import registry as registrylayer from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist @@ -334,7 +335,7 @@ class Hashdump(interfaces.plugins.PluginInterface): try: if hive: result = hive.get_key(key) - except (KeyError, registry.RegistryFormatException): + except (KeyError, registrylayer.RegistryException): vollog.info( f"Unable to load the required registry key {hive.get_name()}\\{key} from this memory image" ) @@ -382,8 +383,7 @@ class Hashdump(interfaces.plugins.PluginInterface): bootkey += class_data.decode("utf-16-le") except ( InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registrylayer.RegistryException, ) as excp: vollog.log( constants.LOGLEVEL_VVV, f"Unable to read Lsa key {lk}: {excp}" @@ -468,7 +468,10 @@ class Hashdump(interfaces.plugins.PluginInterface): if v.get_name() == "V": try: sam_data = samhive.read(v.Data + 4, v.DataLength) - except (exceptions.InvalidAddressException, registry.RegistryHive): + except ( + exceptions.InvalidAddressException, + registrylayer.RegistryException, + ): return None if not sam_data: diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 989d4d473..72f2fa146 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -125,8 +125,7 @@ class Lsadump(interfaces.plugins.PluginInterface): enc_secret_value = next(enc_secret_key.get_values(), None) except ( InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): enc_secret_value = None @@ -209,8 +208,7 @@ class Lsadump(interfaces.plugins.PluginInterface): except ( StopIteration, InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): enc_secret_value = None @@ -233,8 +231,7 @@ class Lsadump(interfaces.plugins.PluginInterface): key_name = key.get_name() except ( InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): key_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index c6d216760..c8b8f9cfb 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -12,7 +12,7 @@ from volatility3.framework.layers.registry import ( RegistryHive, RegistryFormatException, InvalidAddressException, - RegistryInvalidIndex, + RegistryException, ) from volatility3.framework.renderers import TreeGrid, conversion, format_hints from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes @@ -88,8 +88,7 @@ class PrintKey(interfaces.plugins.PluginInterface): key_path_names.append(k.get_name()) except ( InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ): key_path_names.append("-") key_path = "\\".join([k for k in key_path_names]) @@ -117,8 +116,7 @@ class PrintKey(interfaces.plugins.PluginInterface): key_node.get_name() except ( exceptions.InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ) as excp: vollog.debug(excp) continue @@ -168,8 +166,7 @@ class PrintKey(interfaces.plugins.PluginInterface): key_node_name = node.get_name() except ( exceptions.InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ) as excp: vollog.debug(excp) key_node_name = renderers.UnreadableValue() @@ -196,8 +193,7 @@ class PrintKey(interfaces.plugins.PluginInterface): value_node_name = node.get_name() or "(Default)" except ( exceptions.InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ) as excp: vollog.debug(excp) value_node_name = renderers.UnreadableValue() @@ -206,7 +202,7 @@ class PrintKey(interfaces.plugins.PluginInterface): value_type = RegValueTypes(node.Type).name except ( exceptions.InvalidAddressException, - RegistryFormatException, + RegistryException, ) as excp: vollog.debug(excp) value_type = renderers.UnreadableValue() @@ -241,7 +237,7 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( ValueError, exceptions.InvalidAddressException, - RegistryFormatException, + RegistryException, ) as excp: vollog.debug(excp) value_data = renderers.UnreadableValue() @@ -283,13 +279,13 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, KeyError, - RegistryFormatException, + RegistryException, ) as excp: if isinstance(excp, KeyError): vollog.debug( f"Key '{key}' not found in Hive at offset {hex(hive.hive_offset)}." ) - elif isinstance(excp, RegistryFormatException): + elif isinstance(excp, RegistryException): vollog.debug(excp) elif isinstance(excp, exceptions.InvalidAddressException): vollog.debug( diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 738f230b7..ef51b91bf 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -15,8 +15,7 @@ from volatility3.framework.configuration import requirements from volatility3.framework.layers.physical import BufferDataLayer from volatility3.framework.layers.registry import ( RegistryHive, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ) from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed @@ -176,7 +175,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac "software\\microsoft\\windows\\currentversion\\explorer\\userassist", return_list=True, ) - except RegistryFormatException as e: + except RegistryException as e: vollog.warning( f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}: {e}" ) @@ -246,8 +245,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac subkey_name = subkey.get_name() except ( exceptions.InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ): subkey_name = renderers.UnreadableValue() @@ -276,8 +274,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac value_name = value.get_name() except ( exceptions.InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ): value_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index dd821bb35..ba54e19ec 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -313,8 +313,7 @@ def _build_guid_name_map(key: reg_extensions.CM_KEY_NODE) -> Dict[str, str]: break except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ): continue @@ -334,8 +333,7 @@ def _build_guid_name_map(key: reg_extensions.CM_KEY_NODE) -> Dict[str, str]: ) except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryInvalidIndex, + registry.RegistryException, ) as excp: vollog.debug(f"Exception occurred while decoding id_str: {excp}") @@ -1221,14 +1219,14 @@ information about triggers, actions, run times, and creation times.""" task_key = software_hive.get_key( "Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks" ) - except (KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryException): task_key = None try: task_tree = software_hive.get_key( "Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree" ) - except (KeyError, registry.RegistryFormatException): + except (KeyError, registry.RegistryException): task_tree = None return (task_key, task_tree) # type: ignore @@ -1243,8 +1241,7 @@ information about triggers, actions, run times, and creation times.""" name = str(value.get_name()) except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryFormatException, + registry.RegistryException, ): continue @@ -1255,8 +1252,7 @@ information about triggers, actions, run times, and creation times.""" key_name = str(key.get_name()) except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryFormatException, + registry.RegistryException, ): key_name = None @@ -1264,8 +1260,7 @@ information about triggers, actions, run times, and creation times.""" task_name = guid_mapping.get(key_name, renderers.NotAvailableValue()) except ( exceptions.InvalidAddressException, - registry.RegistryFormatException, - registry.RegistryFormatException, + registry.RegistryException, ): task_name = renderers.NotAvailableValue() diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 915850574..80400ec5a 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -162,7 +162,7 @@ class SvcScan(interfaces.plugins.PluginInterface): except ( KeyError, exceptions.InvalidAddressException, - registry.RegistryFormatException, + registry.RegistryException, ): try: return cast( @@ -171,7 +171,7 @@ class SvcScan(interfaces.plugins.PluginInterface): except ( KeyError, exceptions.InvalidAddressException, - registry.RegistryFormatException, + registry.RegistryException, ): vollog.log( constants.LOGLEVEL_VVVV, diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index c6c2ee358..987f01ac1 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -9,9 +9,8 @@ from typing import Iterator, Optional, Union, cast from volatility3.framework import constants, exceptions, interfaces, objects from volatility3.framework.layers.registry import ( - RegistryFormatException, + RegistryException, RegistryHive, - RegistryInvalidIndex, ) vollog = logging.getLogger(__name__) @@ -103,7 +102,7 @@ class CMHIVE(objects.StructType): for attr in ["FileFullPath", "FileUserName", "HiveRootPath"]: with contextlib.suppress( - AttributeError, exceptions.InvalidAddressException, RegistryInvalidIndex + AttributeError, exceptions.InvalidAddressException, RegistryException ): name = getattr(self, attr) if name.Length > 0: @@ -201,8 +200,7 @@ class CM_KEY_NODE(objects.StructType): signature = node.cast("string", max_length=2, encoding="latin-1") except ( exceptions.InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ): return None @@ -231,8 +229,7 @@ class CM_KEY_NODE(objects.StructType): subnode = hive.get_node(subnode_offset) except ( exceptions.InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ): vollog.log( constants.LOGLEVEL_VVV, @@ -258,11 +255,7 @@ class CM_KEY_NODE(objects.StructType): if v != 0: try: node = hive.get_node(v) - except ( - RegistryInvalidIndex, - RegistryFormatException, - RegistryInvalidIndex, - ) as excp: + except (RegistryException,) as excp: vollog.debug(f"Invalid address {excp}") continue if isinstance(node, CM_KEY_VALUE): @@ -270,8 +263,7 @@ class CM_KEY_NODE(objects.StructType): except ( exceptions.InvalidAddressException, - RegistryFormatException, - RegistryInvalidIndex, + RegistryException, ) as excp: vollog.debug(f"Invalid address in get_values iteration: {excp}") return None @@ -361,7 +353,7 @@ class CM_KEY_VALUE(objects.StructType): offset=layer.get_cell(block_offset).vol.offset, length=amount, ) - except (exceptions.InvalidAddressException, RegistryInvalidIndex): + except (exceptions.InvalidAddressException, RegistryException): vollog.debug( f"Failed to read {amount:x} bytes of data, padding with {amount:x}" ) @@ -371,7 +363,7 @@ class CM_KEY_VALUE(objects.StructType): # but the length at the start could be negative so just adding 4 to jump past it try: data = layer.read(self.Data + 4, datalen) - except (exceptions.InvalidAddressException, RegistryInvalidIndex): + except (exceptions.InvalidAddressException, RegistryException): vollog.debug( f"Failed to read {datalen:x} bytes of data, returning {datalen:x} null bytes" ) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index eea05548b..fd33d75a7 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -80,7 +80,7 @@ class Certificates(interfaces.plugins.PluginInterface): ]: with contextlib.suppress( KeyError, - registry.RegistryFormatException, + registry.RegistryException, exceptions.InvalidAddressException, ): # Walk it From 7b0628d9c1732fb964c31eeb349a93ddc524232c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 15:59:07 +0100 Subject: [PATCH 0781/1352] windows testing data --- .../windows.driverirp.DriverIrp.json | 32 + .../windows/test_data/windows.info.Info.json | 96 +++ .../test_data/windows.pstree.Pstree.json | 375 ++++++++++ .../windows.registry.hivescan.HiveScan.json | 100 +++ .../windows.registry.printkey.PrintKey.json | 61 ++ ...indows.registry.userassist.UserAssist.json | 123 ++++ .../test_data/windows.sessions.Sessions.json | 36 + .../windows.shimcachemem.ShimcacheMem.json | 41 ++ .../test_data/windows.timers.Timers.json | 684 ++++++++++++++++++ ...ndows.unloadedmodules.UnloadedModules.json | 67 ++ .../test_data/windows.vadinfo.VadInfo.json | 94 +++ .../test_data/windows.vadwalk.VadWalk.json | 76 ++ .../test_data/windows.virtmap.VirtMap.json | 82 +++ 13 files changed, 1867 insertions(+) create mode 100644 test/plugins/windows/test_data/windows.driverirp.DriverIrp.json create mode 100644 test/plugins/windows/test_data/windows.info.Info.json create mode 100644 test/plugins/windows/test_data/windows.pstree.Pstree.json create mode 100644 test/plugins/windows/test_data/windows.registry.hivescan.HiveScan.json create mode 100644 test/plugins/windows/test_data/windows.registry.printkey.PrintKey.json create mode 100644 test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json create mode 100644 test/plugins/windows/test_data/windows.sessions.Sessions.json create mode 100644 test/plugins/windows/test_data/windows.shimcachemem.ShimcacheMem.json create mode 100644 test/plugins/windows/test_data/windows.timers.Timers.json create mode 100644 test/plugins/windows/test_data/windows.unloadedmodules.UnloadedModules.json create mode 100644 test/plugins/windows/test_data/windows.vadinfo.VadInfo.json create mode 100644 test/plugins/windows/test_data/windows.vadwalk.VadWalk.json create mode 100644 test/plugins/windows/test_data/windows.virtmap.VirtMap.json diff --git a/test/plugins/windows/test_data/windows.driverirp.DriverIrp.json b/test/plugins/windows/test_data/windows.driverirp.DriverIrp.json new file mode 100644 index 000000000..f026e54a2 --- /dev/null +++ b/test/plugins/windows/test_data/windows.driverirp.DriverIrp.json @@ -0,0 +1,32 @@ +{ + "GENERIC": [ + "IRP_MJ_CREATE", + "IRP_MJ_CREATE_NAMED_PIPE", + "IRP_MJ_CLOSE", + "IRP_MJ_READ", + "IRP_MJ_WRITE", + "IRP_MJ_QUERY_INFORMATION", + "IRP_MJ_SET_INFORMATION", + "IRP_MJ_QUERY_EA", + "IRP_MJ_SET_EA", + "IRP_MJ_FLUSH_BUFFERS", + "IRP_MJ_QUERY_VOLUME_INFORMATION", + "IRP_MJ_SET_VOLUME_INFORMATION", + "IRP_MJ_DIRECTORY_CONTROL", + "IRP_MJ_FILE_SYSTEM_CONTROL", + "IRP_MJ_DEVICE_CONTROL", + "IRP_MJ_INTERNAL_DEVICE_CONTROL", + "IRP_MJ_SHUTDOWN", + "IRP_MJ_LOCK_CONTROL", + "IRP_MJ_CLEANUP", + "IRP_MJ_CREATE_MAILSLOT", + "IRP_MJ_QUERY_SECURITY", + "IRP_MJ_SET_SECURITY", + "IRP_MJ_POWER", + "IRP_MJ_SYSTEM_CONTROL", + "IRP_MJ_DEVICE_CHANGE", + "IRP_MJ_QUERY_QUOTA", + "IRP_MJ_SET_QUOTA", + "IRP_MJ_PNP" + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.info.Info.json b/test/plugins/windows/test_data/windows.info.Info.json new file mode 100644 index 000000000..ef350389f --- /dev/null +++ b/test/plugins/windows/test_data/windows.info.Info.json @@ -0,0 +1,96 @@ +{ + "WINDOWS10_GENERIC": [ + { + "Value": "0xf8043601f000", + "Variable": "Kernel Base" + }, + { + "Value": "0x6d4000", + "Variable": "DTB" + }, + { + "Value": "True", + "Variable": "Is64Bit" + }, + { + "Value": "False", + "Variable": "IsPAE" + }, + { + "Value": "0 WindowsIntel32e", + "Variable": "layer_name" + }, + { + "Value": "1 WindowsCrashDump64Layer", + "Variable": "memory_layer" + }, + { + "Value": "2 FileLayer", + "Variable": "base_layer" + }, + { + "Value": "0xf80436c1fb20", + "Variable": "KdDebuggerDataBlock" + }, + { + "Value": "19041.1.amd64fre.vb_release.1912", + "Variable": "NTBuildLab" + }, + { + "Value": "0", + "Variable": "CSDVersion" + }, + { + "Value": "0xf80436c2e420", + "Variable": "KdVersionBlock" + }, + { + "Value": "15.19041", + "Variable": "Major/Minor" + }, + { + "Value": "34404", + "Variable": "MachineType" + }, + { + "Value": "1", + "Variable": "KeNumberProcessors" + }, + { + "Value": "2025-03-06 17:59:20+00:00", + "Variable": "SystemTime" + }, + { + "Value": "C:\\Windows", + "Variable": "NtSystemRoot" + }, + { + "Value": "NtProductWinNt", + "Variable": "NtProductType" + }, + { + "Value": "10", + "Variable": "NtMajorVersion" + }, + { + "Value": "0", + "Variable": "NtMinorVersion" + }, + { + "Value": "10", + "Variable": "PE MajorOperatingSystemVersion" + }, + { + "Value": "0", + "Variable": "PE MinorOperatingSystemVersion" + }, + { + "Value": "34404", + "Variable": "PE Machine" + }, + { + "Value": "Tue Sep 26 06:53:33 2023", + "Variable": "PE TimeDateStamp" + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.pstree.Pstree.json b/test/plugins/windows/test_data/windows.pstree.Pstree.json new file mode 100644 index 000000000..76971ddd4 --- /dev/null +++ b/test/plugins/windows/test_data/windows.pstree.Pstree.json @@ -0,0 +1,375 @@ +{ + "WINDOWS10_GENERIC": { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe", + "Cmd": null, + "CreateTime": "2025-03-06T17:49:34+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "winlogon.exe", + "Offset(V)": 145201769754752, + "PID": 3616, + "PPID": 3568, + "Path": null, + "SessionId": 2, + "Threads": 3, + "Wow64": false, + "__children": [ + { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe", + "Cmd": null, + "CreateTime": "2025-03-06T17:50:15+00:00", + "ExitTime": "2025-03-06T17:50:32+00:00", + "Handles": null, + "ImageFileName": "userinit.exe", + "Offset(V)": 145201786712256, + "PID": 4832, + "PPID": 3616, + "Path": null, + "SessionId": 2, + "Threads": 0, + "Wow64": false, + "__children": [ + { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe", + "Cmd": "C:\\Windows\\Explorer.EXE", + "CreateTime": "2025-03-06T17:50:17+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "explorer.exe", + "Offset(V)": 145201787191488, + "PID": 4912, + "PPID": 4832, + "Path": "C:\\Windows\\Explorer.EXE", + "SessionId": 2, + "Threads": 57, + "Wow64": false, + "__children": [ + { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\SecurityHealthSystray.exe", + "Cmd": "\"C:\\Windows\\System32\\SecurityHealthSystray.exe\" ", + "CreateTime": "2025-03-06T17:51:05+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "SecurityHealth", + "Offset(V)": 145201826054336, + "PID": 1860, + "PPID": 4912, + "Path": "C:\\Windows\\System32\\SecurityHealthSystray.exe", + "SessionId": 2, + "Threads": 2, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start", + "CreateTime": "2025-03-06T17:51:05+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201826906304, + "PID": 3952, + "PPID": 4912, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 61, + "Wow64": false, + "__children": [ + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=556708795 --always-read-main-dll --field-trial-handle=3928,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1", + "CreateTime": "2025-03-06T17:57:14+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201787768960, + "PID": 5348, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 19, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=6740,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8", + "CreateTime": "2025-03-06T17:57:52+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201832050880, + "PID": 3876, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 8, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7016,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8", + "CreateTime": "2025-03-06T17:57:59+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201827619008, + "PID": 5604, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 14, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5520,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8", + "CreateTime": "2025-03-06T17:57:16+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201827774656, + "PID": 1000, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 9, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=596993509 --always-read-main-dll --field-trial-handle=6904,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1", + "CreateTime": "2025-03-06T17:57:54+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201839592000, + "PID": 7080, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 15, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625057436 --always-read-main-dll --field-trial-handle=5592,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1", + "CreateTime": "2025-03-06T17:58:23+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201828201216, + "PID": 5132, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 17, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625148972 --always-read-main-dll --field-trial-handle=7112,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1", + "CreateTime": "2025-03-06T17:58:23+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201839919232, + "PID": 5388, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 15, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2180,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3", + "CreateTime": "2025-03-06T17:51:14+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201835704512, + "PID": 6448, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 16, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": null, + "CreateTime": "2025-03-06T17:51:16+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201668321408, + "PID": 6672, + "PPID": 3952, + "Path": null, + "SessionId": 2, + "Threads": 9, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-US --service-sandbox-type=entity_extraction --string-annotations --always-read-main-dll --field-trial-handle=6188,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8", + "CreateTime": "2025-03-06T17:58:44+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201830273728, + "PID": 6064, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 9, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2472,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2", + "CreateTime": "2025-03-06T17:51:14+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201834049728, + "PID": 6456, + "PPID": 3952, + "Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "SessionId": 2, + "Threads": 15, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe", + "Cmd": null, + "CreateTime": "2025-03-06T17:51:11+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "msedge.exe", + "Offset(V)": 145201786340096, + "PID": 6204, + "PPID": 3952, + "Path": null, + "SessionId": 2, + "Threads": 8, + "Wow64": false, + "__children": [] + } + ] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", + "Cmd": "\"C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /background", + "CreateTime": "2025-03-06T17:51:11+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "OneDrive.exe", + "Offset(V)": 145201834340544, + "PID": 6160, + "PPID": 4912, + "Path": "C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", + "SessionId": 2, + "Threads": 22, + "Wow64": true, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe", + "Cmd": "\"C:\\Windows\\system32\\cmd.exe\" ", + "CreateTime": "2025-03-06T17:51:44+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "cmd.exe", + "Offset(V)": 145201834332288, + "PID": 784, + "PPID": 4912, + "Path": "C:\\Windows\\system32\\cmd.exe", + "SessionId": 2, + "Threads": 1, + "Wow64": false, + "__children": [ + { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\conhost.exe", + "Cmd": null, + "CreateTime": "2025-03-06T17:51:49+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "conhost.exe", + "Offset(V)": 145201834446976, + "PID": 3896, + "PPID": 784, + "Path": null, + "SessionId": 2, + "Threads": 3, + "Wow64": false, + "__children": [] + } + ] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\notepad.exe", + "Cmd": "\"C:\\Windows\\system32\\notepad.exe\" ", + "CreateTime": "2025-03-06T17:52:33+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "notepad.exe", + "Offset(V)": 145201839497344, + "PID": 2968, + "PPID": 4912, + "Path": "C:\\Windows\\system32\\notepad.exe", + "SessionId": 2, + "Threads": 4, + "Wow64": false, + "__children": [] + } + ] + } + ] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\fontdrvhost.exe", + "Cmd": null, + "CreateTime": "2025-03-06T17:49:42+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "fontdrvhost.ex", + "Offset(V)": 145201770697088, + "PID": 3812, + "PPID": 3616, + "Path": null, + "SessionId": 2, + "Threads": 5, + "Wow64": false, + "__children": [] + }, + { + "Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\dwm.exe", + "Cmd": "\"dwm.exe\"", + "CreateTime": "2025-03-06T17:49:42+00:00", + "ExitTime": null, + "Handles": null, + "ImageFileName": "dwm.exe", + "Offset(V)": 145201770352768, + "PID": 3860, + "PPID": 3616, + "Path": "C:\\Windows\\system32\\dwm.exe", + "SessionId": 2, + "Threads": 16, + "Wow64": false, + "__children": [] + } + ] + } +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.registry.hivescan.HiveScan.json b/test/plugins/windows/test_data/windows.registry.hivescan.HiveScan.json new file mode 100644 index 000000000..67d36af04 --- /dev/null +++ b/test/plugins/windows/test_data/windows.registry.hivescan.HiveScan.json @@ -0,0 +1,100 @@ +{ + "WINDOWS10_GENERIC": [ + { + "Offset": 213323072327680, + "__children": [] + }, + { + "Offset": 213323069669376, + "__children": [] + }, + { + "Offset": 213323011252224, + "__children": [] + }, + { + "Offset": 213322964488192, + "__children": [] + }, + { + "Offset": 213323011387392, + "__children": [] + }, + { + "Offset": 213322962362368, + "__children": [] + }, + { + "Offset": 213323041546240, + "__children": [] + }, + { + "Offset": 213323013046272, + "__children": [] + }, + { + "Offset": 213323061571584, + "__children": [] + }, + { + "Offset": 213323079548928, + "__children": [] + }, + { + "Offset": 213323067502592, + "__children": [] + }, + { + "Offset": 213323081900032, + "__children": [] + }, + { + "Offset": 213322954362880, + "__children": [] + }, + { + "Offset": 213322954346496, + "__children": [] + }, + { + "Offset": 213323014123520, + "__children": [] + }, + { + "Offset": 213323067707392, + "__children": [] + }, + { + "Offset": 213323070193664, + "__children": [] + }, + { + "Offset": 213323078791168, + "__children": [] + }, + { + "Offset": 213323069112320, + "__children": [] + }, + { + "Offset": 213323047776256, + "__children": [] + }, + { + "Offset": 213323013799936, + "__children": [] + }, + { + "Offset": 213322954985472, + "__children": [] + }, + { + "Offset": 213322954969088, + "__children": [] + }, + { + "Offset": 213323048636416, + "__children": [] + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.registry.printkey.PrintKey.json b/test/plugins/windows/test_data/windows.registry.printkey.PrintKey.json new file mode 100644 index 000000000..ee069ec30 --- /dev/null +++ b/test/plugins/windows/test_data/windows.registry.printkey.PrintKey.json @@ -0,0 +1,61 @@ +{ + "WINDOWS10_GENERIC": [ + { + "Data": "", + "Hive Offset": 213322954346496, + "Key": "[NONAME]", + "Last Write Time": "2025-03-06T17:59:19+00:00", + "Name": "A", + "Type": "Key", + "Volatile": false + }, + { + "Data": "", + "Hive Offset": 213322954362880, + "Key": "\\REGISTRY\\MACHINE\\SYSTEM", + "Last Write Time": "2019-12-07T09:15:07+00:00", + "Name": "ControlSet001", + "Type": "Key", + "Volatile": false + }, + { + "Data": "", + "Hive Offset": 213322964488192, + "Key": "\\SystemRoot\\System32\\Config\\SOFTWARE", + "Last Write Time": "2025-03-06T17:38:01+00:00", + "Name": "Classes", + "Type": "Key", + "Volatile": false + }, + { + "Data": "", + "Hive Offset": 213323011252224, + "Key": "\\SystemRoot\\System32\\Config\\SAM", + "Last Write Time": "2025-01-31T13:01:49+00:00", + "Name": "SAM", + "Type": "Key", + "Volatile": false, + "__children": [] + }, + { + "Data": "", + "Hive Offset": 213323048636416, + "Key": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Last Write Time": "2025-03-06T17:50:04+00:00", + "Name": "SOFTWARE", + "Type": "Key", + "Volatile": false, + "__children": [] + }, + { + "Data": "", + "Hive Offset": 213323047776256, + "Key": "\\??\\C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", + "Last Write Time": "2025-03-05T18:36:09+00:00", + "Name": ".eip", + "Type": "Key", + "Volatile": false, + "__children": [] + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json b/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json new file mode 100644 index 000000000..6ae740822 --- /dev/null +++ b/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json @@ -0,0 +1,123 @@ +{ + "WINDOWS10_GENERIC": { + "Count": null, + "Focus Count": null, + "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Hive Offset": 213323048636416, + "ID": null, + "Last Updated": null, + "Last Write Time": "2025-03-06T17:57:09+00:00", + "Name": null, + "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", + "Raw Data": "", + "Time Focused": null, + "Type": "Key", + "__children": [ + { + "Count": 7, + "Focus Count": 0, + "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Hive Offset": 213323048636416, + "ID": null, + "Last Updated": "2025-03-05T18:34:13+00:00", + "Last Write Time": "2025-03-06T17:57:09+00:00", + "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", + "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", + "Raw Data": "\"\n00 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 90 86 6b 31 ..............k1\nfd 8d db 01 00 00 00 00 ........ \"", + "Time Focused": "0:00:00.507000", + "Type": "Value", + "__children": [] + }, + { + "Count": 1, + "Focus Count": 0, + "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Hive Offset": 213323048636416, + "ID": null, + "Last Updated": "2025-03-06T12:46:34+00:00", + "Last Write Time": "2025-03-06T17:57:09+00:00", + "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Registry Editor.lnk", + "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", + "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff f0 82 cf ca ................\n95 8e db 01 00 00 00 00 ........ \"", + "Time Focused": "0:00:00.501000", + "Type": "Value", + "__children": [] + }, + { + "Count": 4, + "Focus Count": 0, + "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Hive Offset": 213323048636416, + "ID": null, + "Last Updated": "2025-03-06T17:36:33+00:00", + "Last Write Time": "2025-03-06T17:57:09+00:00", + "Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", + "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", + "Raw Data": "\"\n00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 10 67 cf 4d .............g.M\nbe 8e db 01 00 00 00 00 ........ \"", + "Time Focused": "0:00:00.504000", + "Type": "Value", + "__children": [] + }, + { + "Count": 1, + "Focus Count": 0, + "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Hive Offset": 213323048636416, + "ID": null, + "Last Updated": "2025-03-06T17:51:44+00:00", + "Last Write Time": "2025-03-06T17:57:09+00:00", + "Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", + "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", + "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff d0 99 66 6c ..............fl\nc0 8e db 01 00 00 00 00 ........ \"", + "Time Focused": "0:00:00.501000", + "Type": "Value", + "__children": [] + }, + { + "Count": 1, + "Focus Count": 0, + "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Hive Offset": 213323048636416, + "ID": null, + "Last Updated": "2025-03-06T17:52:33+00:00", + "Last Write Time": "2025-03-06T17:57:09+00:00", + "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", + "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", + "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 00 62 ba 89 .............b..\nc0 8e db 01 00 00 00 00 ........ \"", + "Time Focused": "0:00:00.501000", + "Type": "Value", + "__children": [] + }, + { + "Count": 2, + "Focus Count": 0, + "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Hive Offset": 213323048636416, + "ID": null, + "Last Updated": "2025-03-06T17:56:50+00:00", + "Last Write Time": "2025-03-06T17:57:09+00:00", + "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", + "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", + "Raw Data": "\"\n00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff b0 24 49 23 .............$I#\nc1 8e db 01 00 00 00 00 ........ \"", + "Time Focused": "0:00:00.502000", + "Type": "Value", + "__children": [] + }, + { + "Count": 1, + "Focus Count": 0, + "Hive Name": "\\??\\C:\\Users\\generic-user\\ntuser.dat", + "Hive Offset": 213323048636416, + "ID": null, + "Last Updated": "2025-03-06T17:57:09+00:00", + "Last Write Time": "2025-03-06T17:57:09+00:00", + "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk", + "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", + "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 60 3d 89 2e ............`=..\nc1 8e db 01 00 00 00 00 ........ \"", + "Time Focused": "0:00:00.501000", + "Type": "Value", + "__children": [] + } + ] + } +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.sessions.Sessions.json b/test/plugins/windows/test_data/windows.sessions.Sessions.json new file mode 100644 index 000000000..30b202adb --- /dev/null +++ b/test/plugins/windows/test_data/windows.sessions.Sessions.json @@ -0,0 +1,36 @@ +{ + "WINDOWS10_GENERIC": [ + { + "Create Time": "2025-03-06T17:48:02+00:00", + "Process": "System", + "Process ID": 4 + }, + { + "Create Time": "2025-03-06T17:48:37+00:00", + "Process": "lsass.exe", + "Process ID": 696, + "Session ID": 0, + "Session Type": null, + "User Name": "/SYSTEM", + "__children": [] + }, + { + "Create Time": "2025-03-06T17:49:03+00:00", + "Process": "MsMpEng.exe", + "Process ID": 1956, + "Session ID": 0, + "Session Type": null, + "User Name": "WORKGROUP/Windows-generic$", + "__children": [] + }, + { + "Create Time": "2025-03-06T17:50:08+00:00", + "Process": "rdpclip.exe", + "Process ID": 4180, + "Session ID": 2, + "Session Type": null, + "User Name": "Windows-generic/generic-user", + "__children": [] + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.shimcachemem.ShimcacheMem.json b/test/plugins/windows/test_data/windows.shimcachemem.ShimcacheMem.json new file mode 100644 index 000000000..b671f4c4b --- /dev/null +++ b/test/plugins/windows/test_data/windows.shimcachemem.ShimcacheMem.json @@ -0,0 +1,41 @@ +{ + "WINDOWS10_GENERIC": + [ + { + "Exec Flag": null, + "File Path": "C:\\Windows\\System32\\cmdl32.exe", + "File Size": null, + "Last Modified": "2019-12-07T09:09:07+00:00", + "Last Update": null, + "Order": 0, + "__children": [] + }, + { + "Exec Flag": null, + "File Path": "C:\\Windows\\System32\\cmdkey.exe", + "File Size": null, + "Last Modified": "2019-12-07T09:09:09+00:00", + "Last Update": null, + "Order": 1, + "__children": [] + }, + { + "Exec Flag": null, + "File Path": "C:\\Windows\\system32\\whoami.exe", + "File Size": null, + "Last Modified": "2019-12-07T09:09:51+00:00", + "Last Update": null, + "Order": 2, + "__children": [] + }, + { + "Exec Flag": null, + "File Path": null, + "File Size": null, + "Last Modified": "2023-12-13T16:43:28+00:00", + "Last Update": null, + "Order": 3, + "__children": [] + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.timers.Timers.json b/test/plugins/windows/test_data/windows.timers.Timers.json new file mode 100644 index 000000000..88e8f339a --- /dev/null +++ b/test/plugins/windows/test_data/windows.timers.Timers.json @@ -0,0 +1,684 @@ +{ + "WINDOWSXP_GENERIC": [ + { + "DueTime": "0x00000001:0xb6912640", + "Module": "ntoskrnl", + "Offset": 2180960760, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xe2e5d9fc", + "Module": "ks", + "Offset": 2181100944, + "Period(ms)": 0, + "Routine": 4162614588, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x80000001:0x838d66d0", + "Module": "ntoskrnl", + "Offset": 2180726816, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xbe54efd0", + "Module": "NDIS", + "Offset": 2182586488, + "Period(ms)": 60000, + "Routine": 4164630316, + "Signaled": "Yes", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x80000000:0x6d915dc0", + "Module": "ntoskrnl", + "Offset": 2182771520, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xd5616870", + "Module": "HTTP", + "Offset": 4122586976, + "Period(ms)": 0, + "Routine": 4122527634, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa92535f", + "Module": "USBPORT", + "Offset": 2179614512, + "Period(ms)": 0, + "Routine": 4163343596, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x80000000:0x28ec7d80", + "Module": "ntoskrnl", + "Offset": 2167895896, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xd5f1ddd0", + "Module": "afd", + "Offset": 4289149728, + "Period(ms)": 0, + "Routine": 4146614848, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xe64e9c50", + "Module": "ntoskrnl", + "Offset": 4289091536, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000002:0x10691f50", + "Module": "BATTC", + "Offset": 2182647568, + "Period(ms)": 0, + "Routine": 4170619626, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000002:0x10691f50", + "Module": "BATTC", + "Offset": 2184852912, + "Period(ms)": 0, + "Routine": 4170619626, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xe650bd40", + "Module": "ntoskrnl", + "Offset": 4289091352, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xaf39aa70", + "Module": "watchdog", + "Offset": 2182133296, + "Period(ms)": 10000, + "Routine": 4170290884, + "Signaled": "Yes", + "Symbol": "_imp__KdSave", + "__children": [] + }, + { + "DueTime": "0x00000001:0xaf39aa70", + "Module": "watchdog", + "Offset": 2181849992, + "Period(ms)": 10000, + "Routine": 4170290884, + "Signaled": "Yes", + "Symbol": "_imp__KdSave", + "__children": [] + }, + { + "DueTime": "0x00000008:0x61e17090", + "Module": "ntoskrnl", + "Offset": 2153125248, + "Period(ms)": 0, + "Routine": 2152824977, + "Signaled": "-", + "Symbol": "ExpTimeRefreshDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xa9537f40", + "Module": "ntoskrnl", + "Offset": 2153083360, + "Period(ms)": 0, + "Routine": 2152814203, + "Signaled": "-", + "Symbol": "CmpLazyFlushDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xc5addbe0", + "Module": "TDI", + "Offset": 4147138000, + "Period(ms)": 0, + "Routine": 4169831408, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaadb3be0", + "Module": "netbt", + "Offset": 2182155920, + "Period(ms)": 0, + "Routine": 4146697354, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaadb9040", + "Module": "TDI", + "Offset": 2182059040, + "Period(ms)": 0, + "Routine": 4169831408, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xa9537f40", + "Module": "ntoskrnl", + "Offset": 2153083360, + "Period(ms)": 0, + "Routine": 2152814203, + "Signaled": "-", + "Symbol": "CmpLazyFlushDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x80000000:0x19eae820", + "Module": "ntoskrnl", + "Offset": 2182169704, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa9b2a20", + "Module": "NDIS", + "Offset": 2179568032, + "Period(ms)": 0, + "Routine": 4164628447, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000002:0x1a97a160", + "Module": "Ntfs", + "Offset": 4164841808, + "Period(ms)": 0, + "Routine": 4164732734, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x80000000:0x2c5fb7e0", + "Module": "ntoskrnl", + "Offset": 2180369200, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000002:0x3dcf47a0", + "Module": "afd", + "Offset": 2183169664, + "Period(ms)": 0, + "Routine": 4146614848, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xc4906e60", + "Module": "rdbss", + "Offset": 4146422176, + "Period(ms)": 0, + "Routine": 4146381701, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa92535f", + "Module": "USBPORT", + "Offset": 2179614512, + "Period(ms)": 0, + "Routine": 4163343596, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa8619e0", + "Module": "TDI", + "Offset": 2182064136, + "Period(ms)": 0, + "Routine": 4169831408, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xc45ec240", + "Module": "tcpip", + "Offset": 4147157776, + "Period(ms)": 100, + "Routine": 4146861021, + "Signaled": "Yes", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x80000000:0x35b72850", + "Module": "ntoskrnl", + "Offset": 2180437784, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xaad6fab0", + "Module": "NDIS", + "Offset": 2181321392, + "Period(ms)": 1000, + "Routine": 4164630316, + "Signaled": "Yes", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaadb9040", + "Module": "TDI", + "Offset": 2182059040, + "Period(ms)": 0, + "Routine": 4169831408, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xa9537f40", + "Module": "ntoskrnl", + "Offset": 2153083360, + "Period(ms)": 0, + "Routine": 2152814203, + "Signaled": "-", + "Symbol": "CmpLazyFlushDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xe2e5ee70", + "Module": "ipsec", + "Offset": 4147285920, + "Period(ms)": 60000, + "Routine": 4147221715, + "Signaled": "Yes", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xe2e5ee70", + "Module": "ipsec", + "Offset": 4147284744, + "Period(ms)": 0, + "Routine": 4147221577, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xe2e5d9fc", + "Module": "ks", + "Offset": 2181100944, + "Period(ms)": 0, + "Routine": 4162614588, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000098:0xa67683e0", + "Module": "NDIS", + "Offset": 2183038120, + "Period(ms)": 0, + "Routine": 4164628447, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xa6beb810", + "Module": "ntoskrnl", + "Offset": 2153086208, + "Period(ms)": 1000, + "Routine": 2152611575, + "Signaled": "Yes", + "Symbol": "IopTimerDispatch", + "__children": [] + }, + { + "DueTime": "0x00000001:0xe2f53650", + "Module": "ipnat", + "Offset": 4146164320, + "Period(ms)": 60000, + "Routine": 4146134936, + "Signaled": "Yes", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x80000001:0x838d66d0", + "Module": "ntoskrnl", + "Offset": 2180726816, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xa6c34da0", + "Module": "ntoskrnl", + "Offset": 2153118912, + "Period(ms)": 1000, + "Routine": 2152615232, + "Signaled": "Yes", + "Symbol": "PopScanIdleList", + "__children": [] + }, + { + "DueTime": "0x00000098:0xa67683e0", + "Module": "NDIS", + "Offset": 2183038120, + "Period(ms)": 0, + "Routine": 4164628447, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xa6d41cb0", + "Module": "ntoskrnl", + "Offset": 2153080200, + "Period(ms)": 0, + "Routine": 2152616496, + "Signaled": "-", + "Symbol": "CcScanDpc", + "__children": [] + }, + { + "DueTime": "0x80000000:0x14500b10", + "Module": "ntoskrnl", + "Offset": 2182113448, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xaba81b20", + "Module": "NDIS", + "Offset": 2182656416, + "Period(ms)": 0, + "Routine": 4164628447, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xab110bd0", + "Module": "ntoskrnl", + "Offset": 2181090272, + "Period(ms)": 0, + "Routine": 2152754200, + "Signaled": "-", + "Symbol": "CcPfTraceTimerRoutine", + "__children": [] + }, + { + "DueTime": "0x00000098:0xa6ad86a0", + "Module": "NDIS", + "Offset": 2182615456, + "Period(ms)": 0, + "Routine": 4164628447, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xd56a01e0", + "Module": "HTTP", + "Offset": 4122576520, + "Period(ms)": 60000, + "Routine": 4122481076, + "Signaled": "Yes", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xd56a7ca0", + "Module": "HTTP", + "Offset": 4122577120, + "Period(ms)": 30000, + "Routine": 4122510208, + "Signaled": "Yes", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xd56a7ca0", + "Module": "HTTP", + "Offset": 4122586816, + "Period(ms)": 0, + "Routine": 4122536296, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x80000000:0x14500b10", + "Module": "ntoskrnl", + "Offset": 2182113448, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000002:0x10691f50", + "Module": "BATTC", + "Offset": 2184852912, + "Period(ms)": 0, + "Routine": 4170619626, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000002:0x10691f50", + "Module": "BATTC", + "Offset": 2182647568, + "Period(ms)": 0, + "Routine": 4170619626, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa90b010", + "Module": "sr", + "Offset": 2184659528, + "Period(ms)": 0, + "Routine": 4165384494, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000131:0x3cf80b10", + "Module": "NDIS", + "Offset": 2181526704, + "Period(ms)": 0, + "Routine": 4164628447, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa9b2a20", + "Module": "NDIS", + "Offset": 2179568032, + "Period(ms)": 0, + "Routine": 4164628447, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa9cb150", + "Module": "NDIS", + "Offset": 2179569720, + "Period(ms)": 0, + "Routine": 4164628447, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa9e70c0", + "Module": "ntoskrnl", + "Offset": 2182248232, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xd56bd340", + "Module": "srv", + "Offset": 4128143248, + "Period(ms)": 0, + "Routine": 4128080773, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xbae86a40", + "Module": "ntoskrnl", + "Offset": 2182222184, + "Period(ms)": 0, + "Routine": 2152618407, + "Signaled": "-", + "Symbol": "ExpTimerDpcRoutine", + "__children": [] + }, + { + "DueTime": "0x00000001:0xacafcdd0", + "Module": "Ntfs", + "Offset": 4164841712, + "Period(ms)": 0, + "Routine": 4164719155, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaa92535f", + "Module": "USBPORT", + "Offset": 2179614512, + "Period(ms)": 0, + "Routine": 4163343596, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xad54f9d0", + "Module": "ntoskrnl", + "Offset": 2153085904, + "Period(ms)": 60000, + "Routine": 2152638914, + "Signaled": "Yes", + "Symbol": "IopIrpStackProfilerTimer", + "__children": [] + }, + { + "DueTime": "0x00000008:0x73b44670", + "Module": "ipsec", + "Offset": 4147284848, + "Period(ms)": 0, + "Routine": 4147221577, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaad6c270", + "Module": "NDIS", + "Offset": 2179663392, + "Period(ms)": 0, + "Routine": 4164642677, + "Signaled": "-", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000001:0xaad6fab0", + "Module": "NDIS", + "Offset": 2181321392, + "Period(ms)": 1000, + "Routine": 4164630316, + "Signaled": "Yes", + "Symbol": null, + "__children": [] + }, + { + "DueTime": "0x00000008:0x73bef8c0", + "Module": "netbt", + "Offset": 2182155520, + "Period(ms)": 0, + "Routine": 4146697354, + "Signaled": "-", + "Symbol": null, + "__children": [] + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.unloadedmodules.UnloadedModules.json b/test/plugins/windows/test_data/windows.unloadedmodules.UnloadedModules.json new file mode 100644 index 000000000..e287d3c14 --- /dev/null +++ b/test/plugins/windows/test_data/windows.unloadedmodules.UnloadedModules.json @@ -0,0 +1,67 @@ +{ + "WINDOWS10_GENERIC": [ + { + "EndAddress": 18446735295750344704, + "Name": "hwpolicy.sys", + "StartAddress": 18446735295750275072, + "Time": "2025-03-06T17:47:55+00:00", + "__children": [] + }, + { + "EndAddress": 18446735295728652288, + "Name": "WdBoot.sys", + "StartAddress": 18446735295728582656, + "Time": "2025-03-06T17:47:56+00:00", + "__children": [] + }, + { + "EndAddress": 18446735295786053632, + "Name": "dam.sys", + "StartAddress": 18446735295785926656, + "Time": "2025-03-06T17:48:02+00:00", + "__children": [] + }, + { + "EndAddress": 18446735295788797952, + "Name": "serial.sys", + "StartAddress": 18446735295788679168, + "Time": "2025-03-06T17:48:21+00:00", + "__children": [] + }, + { + "EndAddress": 18446735295788875776, + "Name": "serenum.sys", + "StartAddress": 18446735295788810240, + "Time": "2025-03-06T17:48:21+00:00", + "__children": [] + }, + { + "EndAddress": 18446735295761932288, + "Name": "dump_dumpfve.sys", + "StartAddress": 18446735295761809408, + "Time": "2025-03-06T17:48:27+00:00", + "__children": [] + }, + { + "EndAddress": 18446735295761629184, + "Name": "dump_vmbkmcl.sys", + "StartAddress": 18446735295761481728, + "Time": "2025-03-06T17:48:27+00:00", + "__children": [] + }, + { + "EndAddress": 18446735295761481728, + "Name": "dump_storvsc.sys", + "StartAddress": 18446735295761416192, + "Time": "2025-03-06T17:48:27+00:00", + "__children": [] + }, + { + "EndAddress": 18446735295761350656, + "Name": "dump_storport.sys", + "StartAddress": 18446735295761285120, + "Time": "2025-03-06T17:48:27+00:00", + "__children": [] + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.vadinfo.VadInfo.json b/test/plugins/windows/test_data/windows.vadinfo.VadInfo.json new file mode 100644 index 000000000..d980b21a2 --- /dev/null +++ b/test/plugins/windows/test_data/windows.vadinfo.VadInfo.json @@ -0,0 +1,94 @@ +{ + "WINDOWS10_GENERIC": [ + { + "CommitCharge": 1, + "End VPN": 2147381247, + "File": null, + "File output": "Disabled", + "Offset": 18446607800399740208, + "PID": 4, + "Parent": 0, + "PrivateMemory": 1, + "Process": "System", + "Protection": "PAGE_READONLY", + "Start VPN": 2147377152, + "Tag": "VadS", + "__children": [] + }, + { + "CommitCharge": 1, + "End VPN": 2147356671, + "File": null, + "File output": "Disabled", + "Offset": 18446607800399739968, + "PID": 4, + "Parent": 18446607800399740208, + "PrivateMemory": 1, + "Process": "System", + "Protection": "PAGE_READONLY", + "Start VPN": 2147352576, + "Tag": "VadS", + "__children": [] + }, + { + "CommitCharge": 9, + "End VPN": 2004303871, + "File": "\\Windows\\SysWOW64\\ntdll.dll", + "File output": "Disabled", + "Offset": 18446607800410763840, + "PID": 4, + "Parent": 18446607800399739968, + "PrivateMemory": 0, + "Process": "System", + "Protection": "PAGE_EXECUTE_WRITECOPY", + "Start VPN": 2002583552, + "Tag": "Vad ", + "__children": [] + }, + { + "CommitCharge": 9, + "End VPN": 140703785033727, + "File": "\\Windows\\System32\\vertdll.dll", + "File output": "Disabled", + "Offset": 18446607800410768000, + "PID": 4, + "Parent": 18446607800399740208, + "PrivateMemory": 0, + "Process": "System", + "Protection": "PAGE_EXECUTE_WRITECOPY", + "Start VPN": 140703784828928, + "Tag": "Vad ", + "__children": [] + }, + { + "CommitCharge": 0, + "End VPN": 2873390796799, + "File": null, + "File output": "Disabled", + "Offset": 18446607800474375600, + "PID": 4, + "Parent": 18446607800410768000, + "PrivateMemory": 0, + "Process": "System", + "Protection": "PAGE_READWRITE", + "Start VPN": 2873390792704, + "Tag": "Vad ", + "__children": [] + }, + { + "CommitCharge": 16, + "End VPN": 140703787155455, + "File": "\\Windows\\System32\\ntdll.dll", + "File output": "Disabled", + "Offset": 18446607800410767520, + "PID": 4, + "Parent": 18446607800410768000, + "PrivateMemory": 0, + "Process": "System", + "Protection": "PAGE_EXECUTE_WRITECOPY", + "Start VPN": 140703785091072, + "Tag": "Vad ", + "__children": [] + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.vadwalk.VadWalk.json b/test/plugins/windows/test_data/windows.vadwalk.VadWalk.json new file mode 100644 index 000000000..d7c884fca --- /dev/null +++ b/test/plugins/windows/test_data/windows.vadwalk.VadWalk.json @@ -0,0 +1,76 @@ +{ + "WINDOWS10_GENERIC": [ + { + "End": 2147381247, + "Left": 145201666899008, + "Offset": 145201666899248, + "PID": 4, + "Parent": 0, + "Process": "System", + "Right": 145201677927040, + "Start": 2147377152, + "Tag": "VadS", + "__children": [] + }, + { + "End": 2147356671, + "Left": 145201677922880, + "Offset": 145201666899008, + "PID": 4, + "Parent": 145201666899248, + "Process": "System", + "Right": 0, + "Start": 2147352576, + "Tag": "VadS", + "__children": [] + }, + { + "End": 2004303871, + "Left": 0, + "Offset": 145201677922880, + "PID": 4, + "Parent": 145201666899008, + "Process": "System", + "Right": 0, + "Start": 2002583552, + "Tag": "Vad ", + "__children": [] + }, + { + "End": 140703785033727, + "Left": 145201741534640, + "Offset": 145201677927040, + "PID": 4, + "Parent": 145201666899248, + "Process": "System", + "Right": 145201677926560, + "Start": 140703784828928, + "Tag": "Vad ", + "__children": [] + }, + { + "End": 2873390796799, + "Left": 0, + "Offset": 145201741534640, + "PID": 4, + "Parent": 145201677927040, + "Process": "System", + "Right": 0, + "Start": 2873390792704, + "Tag": "Vad ", + "__children": [] + }, + { + "End": 140703787155455, + "Left": 0, + "Offset": 145201677926560, + "PID": 4, + "Parent": 145201677927040, + "Process": "System", + "Right": 0, + "Start": 140703785091072, + "Tag": "Vad ", + "__children": [] + } + ] +} \ No newline at end of file diff --git a/test/plugins/windows/test_data/windows.virtmap.VirtMap.json b/test/plugins/windows/test_data/windows.virtmap.VirtMap.json new file mode 100644 index 000000000..6b80068f2 --- /dev/null +++ b/test/plugins/windows/test_data/windows.virtmap.VirtMap.json @@ -0,0 +1,82 @@ +{ + "WINDOWS10_GENERIC": [ + { + "End offset": 17592186044416, + "Region": "MiVaBootLoaded", + "Start offset": 238594023227392, + "__children": [] + }, + { + "End offset": 549755813888, + "Region": "MiVaDriverImages", + "Start offset": 272678883688448, + "__children": [] + }, + { + "End offset": 549755813888, + "Region": "MiVaHal", + "Start offset": 258385232527360, + "__children": [] + }, + { + "End offset": 3848290697216, + "Region": "MiVaNonPagedPool", + "Start offset": 266081813921792, + "__children": [] + }, + { + "End offset": 2748779069440, + "Region": "MiVaPagedPool", + "Start offset": 278135644927560, + "__children": [] + }, + { + "End offset": 17592186044416, + "Region": "MiVaPfnDatabase", + "Start offset": 166026255794176, + "__children": [] + }, + { + "End offset": 17592186044416, + "Region": "MiVaProcessSpace", + "Start offset": 191315023233024, + "__children": [] + }, + { + "End offset": 549755813888, + "Region": "MiVaSessionGlobalSpace", + "Start offset": 186367220908032, + "__children": [] + }, + { + "End offset": 17592186044416, + "Region": "MiVaSessionSpace", + "Start offset": 213305255788544, + "__children": [] + }, + { + "End offset": 1099511627776, + "Region": "MiVaSpecialPoolPaged", + "Start offset": 261683767410688, + "__children": [] + }, + { + "End offset": 1099511627776, + "Region": "MiVaSystemCache", + "Start offset": 208907209277440, + "__children": [] + }, + { + "End offset": 549755813888, + "Region": "MiVaSystemPtes", + "Start offset": 274328151130112, + "__children": [] + }, + { + "End offset": 17592186044416, + "Region": "MiVaUnused", + "Start offset": 145135534866432, + "__children": [] + } + ] +} \ No newline at end of file From d6362e010f0a24c327a8eea3fa5a43fdb06990dc Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:08:52 +0100 Subject: [PATCH 0782/1352] add testing data constants --- test/__init__.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/test/__init__.py b/test/__init__.py index 2b59ef5ca..cad5ea76b 100644 --- a/test/__init__.py +++ b/test/__init__.py @@ -1,4 +1,8 @@ from enum import Enum +from pathlib import Path + +TESTS_ROOT_DIR = Path(__file__).parent +WINDOWS_TESTS_DATA_DIR = TESTS_ROOT_DIR / "plugins" / "windows" / "test_data" class Sample: From 2d5a6eeb8e1e3c300214448985519a5da98d7ded Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:09:13 +0100 Subject: [PATCH 0783/1352] add windows10 sample abstraction --- test/__init__.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/__init__.py b/test/__init__.py index cad5ea76b..b2cfa3139 100644 --- a/test/__init__.py +++ b/test/__init__.py @@ -13,6 +13,8 @@ class Sample: class WindowsSamples(Enum): WINDOWSXP_GENERIC = Sample("./test_images/win-xp-laptop-2005-06-25.img") """WindowsXP sample from early Volatility training.""" + WINDOWS10_GENERIC = Sample("./test_images/win-10_19041-2025_03.dmp") + """Windows10 CrashDump sample.""" class LinuxSamples(Enum): From ca20b6e979bdd61eb9af82de1b6f35f03e953535 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:10:12 +0100 Subject: [PATCH 0784/1352] enhance and extend testing helper functions --- test/test_volatility.py | 104 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 99 insertions(+), 5 deletions(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 632a6bcde..960ac00d1 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -11,8 +11,15 @@ import sys import tempfile import contextlib import functools +import json +import logging from typing import List, Tuple +from test import WINDOWS_TESTS_DATA_DIR + +test_logger = logging.getLogger(__name__) + + # # HELPER FUNCTIONS # @@ -71,25 +78,100 @@ def runvolshell(img, volshell, python, volshellargs=None, globalargs=None): return runvol(args, volshell, python) +def load_test_data(plugin: str, test_key: str): + if plugin.startswith("windows."): + data_path = WINDOWS_TESTS_DATA_DIR / f"{plugin}.json" + # TODO: add Linux and macOS when any of these requires this API + else: + raise Exception(f"Cannot determine OS of plugin: {plugin}") + + if not data_path.exists(): + raise FileNotFoundError( + f"Test data not found for plugin {plugin} at {data_path}" + ) + + with open(data_path) as f: + # This will raise an explicit exception by itself on failures + return json.load(f)[test_key] + + +def dict_lower_strvalues(dict_to_convert: dict): + """Lower each value of type string of a dictionary + + Args: + dict_to_convert: The dictionary in which to lower the string values + Returns: + A copy of the dictionary with lowered string values + """ + + converted = {} + for key, value in dict_to_convert.items(): + if isinstance(value, str): + converted[key] = value.lower() + else: + converted[key] = value + return converted + + def match_output_row( - expected_row: dict, plugin_json_out: List[dict], exact_match: bool = False + expected_row: dict, + plugin_json_out: List[dict], + exact_match: bool = False, + case_sensitive: bool = True, + children_recursive: bool = False, ): - """Search each row of a plugin's JSON output for an expected row. Each row is a dict. + """Search each row in a plugin's JSON output for a matching row. + This method supports recursive comparisons using the "__children" key, making it useful for testing hierarchical plugins like windows.pstree. + It also maintains case sensitivity and exact matching behavior when traversing nested structures. Args: expected_row: The expected row to be found in the output plugin_json_out: The plugin's output in JSON format (typically obtained through -r json and json.loads) - exact_match: Whether to require exactly the expected row, no more no less, or to anticipate columns' addition by checking only + exact_match: Require exactly the expected row, no more no less, or anticipate columns' addition by checking only the expected row keys and values + case_sensitive: Operate case sensitive match for str values of both dictionaries or not + children_recursive: Perform a recursive match by inspecting "__children" keys of each expected_row + + Returns: + A boolean indicating whether a match was found or not """ + # Lower each string value of both dicts + if not case_sensitive: + expected_row = dict_lower_strvalues(expected_row) + plugin_json_out_tmp = [] + for row in plugin_json_out: + plugin_json_out_tmp.append(dict_lower_strvalues(row)) + plugin_json_out = plugin_json_out_tmp + if not exact_match: for row in plugin_json_out: if all( - expected_item in row.items() for expected_item in expected_row.items() + expected_item in row.items() + for expected_item in expected_row.items() + if not expected_item[0] == "__children" ): - return True + if ( + children_recursive + and "__children" in expected_row + and "__children" in row + ): + for children_expected_row in expected_row["__children"]: + if not match_output_row( + children_expected_row, + row["__children"], + case_sensitive=case_sensitive, + children_recursive=True, + ): + break + else: + # We matched all the children keys + return True + else: + # No recursion required and we already matched the row + return True else: + # No "__children" recursion here as we want to match the whole tree at once for row in plugin_json_out: if expected_row == row: return True @@ -97,6 +179,18 @@ def match_output_row( return False +def count_entries_flat(plugin_json_out: List[dict]): + """Count the number of entries as if -r json wasn't specified. Allows to get a non-hierarchical count, without running a plugin twice + (once with "-r json" and once without) while still preserving JSON features. + + Args: + plugin_json_out: The plugin's output in JSON format (typically obtained through -r json and json.loads) + """ + # Remove whitespaces between entries + # If a value contains {", it will be represented by {\" so no confusion + return json.dumps(plugin_json_out, separators=(",", ":")).count('{"') + + # # TESTS # From a53904751658ee24d7431e2ca4ca98affc9b5853 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:19:08 +0100 Subject: [PATCH 0785/1352] correctly order volshell args --- test/plugins/linux/linux.py | 2 +- test/plugins/windows/windows.py | 2 +- test/test_volatility.py | 12 +++++++----- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index 8ec485735..e39c1d15d 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -8,7 +8,7 @@ from test import test_volatility, LinuxSamples class TestLinuxVolshell: def test_linux_volshell(self, image, volatility, python): out = test_volatility.basic_volshell_test( - image, volatility, python, globalargs=("-l",) + image, volatility, python, volshellargs=("-l",) ) assert out.count(b" 100 diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index ce05af0cd..d19478484 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -10,7 +10,7 @@ from test import test_volatility, WindowsSamples class TestWindowsVolshell: def test_windows_volshell(self, image, volatility, python): out = test_volatility.basic_volshell_test( - image, volatility, python, globalargs=("-w",) + image, volatility, python, volshellargs=("-w",) ) assert out.count(b" 40 diff --git a/test/test_volatility.py b/test/test_volatility.py index 960ac00d1..9b7aff4be 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -62,9 +62,9 @@ def runvol_plugin( return runvol(args, volatility, python) -def runvolshell(img, volshell, python, volshellargs=None, globalargs=None): - volshellargs = volshellargs or [] - globalargs = globalargs or [] +def runvolshell( + img, volshell, python, volshellargs: Tuple = (), globalargs: Tuple = () +): args = ( globalargs + ( @@ -196,7 +196,9 @@ def count_entries_flat(plugin_json_out: List[dict]): # -def basic_volshell_test(image, volatility, python, globalargs): +def basic_volshell_test( + image, volatility, python, volshellargs: Tuple = (), globalargs: Tuple = () +): # Basic VolShell test to verify requirements and ensure VolShell runs without crashing volshell_commands = [ @@ -216,7 +218,7 @@ def basic_volshell_test(image, volatility, python, globalargs): img=image, volshell=volatility, python=python, - volshellargs=("--script", filename), + volshellargs=("--script", filename) + volshellargs, globalargs=globalargs, ) finally: From d37f7b98f56ee5bd2c75ba0e6e5941cab9d61d5d Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:22:54 +0100 Subject: [PATCH 0786/1352] first windows testing enhancement iteration --- test/plugins/windows/windows.py | 1167 +++++++++++++++++++++++++++++-- 1 file changed, 1123 insertions(+), 44 deletions(-) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index d19478484..36596721d 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -75,40 +75,66 @@ class TestWindowsPsscan: class TestWindowsDlllist: def test_windows_generic_dlllist(self, volatility, python, image): rc, out, _err = test_volatility.runvol_plugin( - "windows.dlllist.DllList", image, volatility, python + "windows.dlllist.DllList", + image, + volatility, + python, + globalargs=("-r", "json"), ) assert rc == 0 - out = out.lower() - assert out.count(b"\n") > 10 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 2000 + expected_rows = [ + { + "Path": "C:\\Windows\\SYSTEM32\\kernel32.dll", + "Process": "csrss.exe", + }, + { + "Path": "C:\\Windows\\system32\\USER32.dll", + "Process": "csrss.exe", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row( + expected_row, json_out, case_sensitive=False + ) class TestWindowsModules: - def test_windows_generic_modules(self, volatility, python, image): + def test_windows_generic_modules(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( - "windows.modules.Modules", image, volatility, python + "windows.modules.Modules", + image, + volatility, + python, + globalargs=("-r", "json"), ) assert rc == 0 - out = out.lower() - assert out.count(b"\n") > 10 - - -class TestWindowsHivelist: - def test_windows_generic_hivelist(self, volatility, python, image): - rc, out, _err = test_volatility.runvol_plugin( - "windows.registry.hivelist.HiveList", image, volatility, python - ) - assert rc == 0 - out = out.lower() - - not_xp = out.find(b"\\systemroot\\system32\\config\\software") - if not_xp == -1: - assert ( - out.find( - b"\\device\\harddiskvolume1\\windows\\system32\\config\\software" - ) - != -1 - ) - assert out.count(b"\n") > 10 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 110 + expected_rows = [ + { + "Name": "ntoskrnl.exe", + "Offset": 2185216944, + "Path": "\\WINDOWS\\system32\\ntoskrnl.exe", + "Size": 2179328, + }, + { + "Name": "hal.dll", + "Offset": 2185216840, + "Path": "\\WINDOWS\\system32\\hal.dll", + "Size": 81280, + }, + { + "Name": "netbios.sys", + "Offset": 2182050616, + "Path": "\\SystemRoot\\System32\\DRIVERS\\netbios.sys", + "Size": 36864, + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) class TestWindowsDumpfiles: @@ -173,14 +199,47 @@ class TestWindowsHandles: assert out.count(b"\n") > 500 -class TestWindowsSvcscan: - def test_windows_generic_svcscan(self, volatility, python, image): +class TestWindowsSvcList: + def test_windows_generic_svclist(self, volatility, python, image): + image = WindowsSamples.WINDOWS10_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( - "windows.svcscan.SvcScan", image, volatility, python + "windows.svclist.SvcList", + image, + volatility, + python, + globalargs=("-r", "json"), ) assert rc == 0 - assert out.find(b"Microsoft ACPI Driver") != -1 - assert out.count(b"\n") > 250 + json_out = json.loads(out) + assert len(json_out) > 250 + expected_row = { + "Binary": "\\Driver\\ACPI", + "Display": "ACPI", + "Name": "ACPI", + "Start": "SERVICE_BOOT_START", + "State": "SERVICE_RUNNING", + "Type": "SERVICE_KERNEL_DRIVER", + } + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsSvcScan: + def test_windows_generic_svcscan(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.svcscan.SvcScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert len(json_out) > 250 + expected_rows = [ + {"Name": "ACPI", "Type": "SERVICE_KERNEL_DRIVER"}, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) class TestWindowsThrdscan: @@ -210,20 +269,47 @@ class TestWindowsPrivileges: assert out.count(b"\n") > 20 -class TestWindowsGetsids: +class TestWindowsGetSIDs: def test_windows_generic_getsids(self, volatility, python, image): rc, out, _err = test_volatility.runvol_plugin( "windows.getsids.GetSIDs", image, volatility, python, - pluginargs=("--pid", "4"), + globalargs=("-r", "json"), ) assert rc == 0 - assert out.find(b"Local System") != -1 - assert out.find(b"Administrators") != -1 - assert out.find(b"Everyone") != -1 - assert out.find(b"Authenticated Users") != -1 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 400 + expected_rows = [ + { + "Name": "Local System", + "Process": "csrss.exe", + "SID": "S-1-5-18", + }, + { + "Name": "Administrators", + "Process": "csrss.exe", + "SID": "S-1-5-32-544", + }, + { + "Name": "Everyone", + "Process": "csrss.exe", + "SID": "S-1-1-0", + }, + { + "Name": "Authenticated Users", + "Process": "csrss.exe", + "SID": "S-1-5-11", + }, + { + "Name": "System Mandatory Level", + "Process": "csrss.exe", + "SID": "S-1-16-16384", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) class TestWindowsEnvars: @@ -253,16 +339,23 @@ class TestWindowsCallbacks: class TestWindowsVadwalk: - def test_windows_generic_vadwalk(self, volatility, python, image): + def test_windows_specific_vadwalk(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( - "windows.vadwalk.VadWalk", image, volatility, python + "windows.vadwalk.VadWalk", + image, + volatility, + python, + globalargs=("-r", "json"), + pluginargs=("--pid", "4"), ) assert rc == 0 - assert out.find(b"Vad") != -1 - assert out.find(b"VadS") != -1 - assert out.find(b"Vadl") != -1 - assert out.find(b"VadF") != -1 - assert out.find(b"0x0") != -1 + json_out = json.loads(out) + expected_rows = test_volatility.load_test_data( + "windows.vadwalk.VadWalk", "WINDOWS10_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) class TestWindowsDevicetree: @@ -324,3 +417,989 @@ class TestWindowsVadyarascan: ) assert rc == 0 assert out.count(b"\n") > 10 + + +class TestWindowsAmcache: + def test_windows_generic_amcache(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.amcache.Amcache", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 100 + # Win10+ expected package names + expected_rows = [ + { + "Path": "C:\\Windows\\SystemApps\\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy", + "ProductName": "Microsoft.Windows.StartMenuExperienceHost", + }, + { + "Path": "C:\\Windows\\SystemApps\\Microsoft.Windows.FileExplorer_cw5n1h2txyewy", + "ProductName": "c5e2524a-ea46-4f67-841f-6a9465d9d515", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsBigPools: + def test_windows_generic_bigpools(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.bigpools.BigPools", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 2000 + expected_rows = [ + { + "PoolType": "PagedPool", + }, + { + "PoolType": "PagedPoolCacheAligned", + }, + { + "PoolType": "NonPagedPoolNx", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +# FIXME: Empty on WIN10 and XP samples +# class TestWindowsCachedump: +# def test_windows_generic_cachedump(self, volatility, python, image): +# rc, out, _err = test_volatility.runvol_plugin( +# "windows.cachedump.Cachedump", +# image, +# volatility, +# python, +# globalargs=("-r", "json"), +# ) +# assert rc == 0 +# json_out = json.loads(out) + + +class TestWindowsCmdLine: + def test_windows_generic_cmdline(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.cmdline.CmdLine", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"\n") > 20 + out = out.lower() + assert ( + out.find(b"C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p".lower()) + != -1 + ) + assert ( + out.count( + b"C:\\Windows\\system32\\svchost.exe -k LocalServiceNetworkRestricted -p".lower() + ) + > 3 + ) + + +class TestWindowsCmdScan: + def test_windows_specific_cmdscan(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.cmdscan.CmdScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + expected_row = { + "Process": "conhost.exe", + "Property": "_COMMAND_HISTORY", + } + assert test_volatility.match_output_row(expected_row, json.loads(out)) + + +class TestWindowsConsoles: + def test_windows_specific_consoles(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.consoles.Consoles", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + expected_row = { + "Process": "conhost.exe", + "Property": "_CONSOLE_INFORMATION", + } + assert test_volatility.match_output_row(expected_row, json.loads(out)) + + +class TestWindowsCrashinfo: + def test_windows_specific_crashinfo(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.crashinfo.Crashinfo", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + expected_row = { + "BitmapHeaderSize": 176128, + "BitmapPages": 511191, + "BitmapSize": 1310720, + "Comment": "PAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGEPAGE", + "DirectoryTableBase": 4610162688, + "DumpType": "Bitmap Dump (0x5)", + "MachineImageType": 34404, + "MajorVersion": 15, + "MinorVersion": 19041, + "NumberProcessors": 1, + "Signature": "PAGE", + "SystemTime": "2025-03-06T17:59:20+00:00", + "SystemUpTime": "0:11:23.199374", + "__children": [], + } + assert test_volatility.match_output_row(expected_row, json.loads(out)) + + +class TestWindowsDriverIrp: + def test_windows_generic_driverirp(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.driverirp.DriverIrp", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"\n") > 2000 + assert out.count(b"ntoskrnl") > 400 + for irp in test_volatility.load_test_data( + "windows.driverirp.DriverIrp", "GENERIC" + ): + assert out.find(irp.encode()) != -1 + + +class TestWindowsDriverScan: + def test_windows_generic_driverscan(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.driverscan.DriverScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 50 + expected_rows = [ + { + "Name": "\\Driver\\ACPI_HAL", + "Service Key": "\\Driver\\ACPI_HAL", + }, + { + "Name": "\\Driver\\Tcpip", + "Service Key": "Tcpip", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsGetServiceSIDs: + def test_windows_generic_getservicesids(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.getservicesids.GetServiceSIDs", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"S-1-5-80-") > 90 + + +class TestWindowsIAT: + def test_windows_generic_iat(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.iat.IAT", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 2000 + expected_rows = [ + { + "Function": "NtTerminateProcess", + "Library": "ntdll.dll", + "Name": "csrss.exe", + }, + { + "Function": "RtlSetHeapInformation", + "Library": "ntdll.dll", + "Name": "csrss.exe", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsInfo: + def test_windows_specific_info(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.info.Info", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + expected_rows = test_volatility.load_test_data( + "windows.info.Info", "WINDOWS10_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsJobLinks: + def test_windows_specific_joblinks(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.joblinks.JobLinks", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 30 + expected_row = { + "Active": 1, + "JobLink": None, + "JobSess": 2, + "Name": "taskhostw.exe", + "Offset(V)": 145201782567040, + "PID": 4304, + "PPID": 1008, + "Process": "(Original Process)", + "Sess": 2, + "Term": 0, + "Total": 1, + "Wow64": False, + "__children": [ + { + "Active": 0, + "JobLink": "Yes", + "JobSess": 0, + "Name": "taskhostw.exe", + "Offset(V)": 145201782567040, + "PID": 4304, + "PPID": 1008, + "Process": "C:\\Windows\\system32\\taskhostw.exe", + "Sess": 2, + "Term": 0, + "Total": 0, + "Wow64": False, + "__children": [], + } + ], + } + + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsKPCRs: + def test_windows_generic_kpcrs(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.kpcrs.KPCRs", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + assert test_volatility.count_entries_flat(json.loads(out)) > 0 + + +class TestWindowsLdrModules: + def test_windows_generic_ldrmodules(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.ldrmodules.LdrModules", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"\n") > 800 + out = out.lower() + assert out.find(b"\\Windows\\System32\\ntdll.dll".lower()) > 10 + + +class TestWindowsLsadump: + def test_windows_specific_lsadump(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.lsadump.Lsadump", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 5 + expected_row = { + "Hex": "01 00 00 00 2b 2b f1 09 a3 b3 4b af 02 19 5a 61 2f 09 3a 88 03 52 51 64 8a 6c d2 a8 34 07 cb 61 41 ca a4 5d f1 fb 4c e0 41 72 69 32", + "Key": "DPAPI_SYSTEM", + } + + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsMBRScan: + def test_windows_specific_mbrscan(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.mbrscan.MBRScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 4300 + expected_rows = [ + { + "Bootcode MD5": "dbcef88b4d770658b0050bf20b2d3061", + "Disk Signature": "82-78-77-32", + "Full MBR MD5": "8eea93bb1c63863f6e7f95b084411672", + "Potential MBR at Physical Offset": 154029739, + }, + { + "Bootcode MD5": "591213a9dfef595735e419eff6eeb39d", + "Disk Signature": "7a-74-60-53", + "Full MBR MD5": "4e00711a5014941f5ad8b3a4cde69c9c", + "Potential MBR at Physical Offset": 437808348, + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsMemmap: + def test_windows_specific_memmap(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.memmap.Memmap", + image, + volatility, + python, + pluginargs=("--pid", "504"), + ) + assert rc == 0 + assert out.count(b"\n") > 12000 + + +class TestWindowsMFTscan: + def test_windows_specific_mftscan_ads_xp(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.mftscan.ADS", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + expected_rows = [ + { + "ADS Filename": "Zone.Identifier", + "Filename": "libby_hoeler_part1.wmv", + "Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a ZoneId=3.. "', + "MFT Type": "DATA", + "Offset": 55926304, + "Record Number": 323, + "Record Type": "FILE", + }, + { + "ADS Filename": "Zone.Identifier", + "Filename": "NetZeroQuickHelpLite.exe", + "Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a ZoneId=3.. "', + "MFT Type": "DATA", + "Offset": 56102400, + "Record Number": 347, + "Record Type": "FILE", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + def test_windows_specific_mftscan_ads_win10(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.mftscan.ADS", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + expected_rows = [ + { + "ADS Filename": "$Max", + "Filename": "$UsnJrnl", + "Hexdump": '"\n00 00 00 02 00 00 00 00 00 00 80 00 00 00 00 00 ................\nb9 dd f0 cc df 73 db 01 00 00 00 00 00 00 00 00 .....s.........."', + "MFT Type": "DATA", + "Offset": 1058018088, + "Record Number": 107240, + "Record Type": "FILE", + }, + { + "ADS Filename": "$Config", + "Filename": "$Repair", + "Hexdump": '"\n01 00 00 00 03 00 00 00 ........ "', + "MFT Type": "DATA", + "Offset": 5009678688, + "Record Number": 28, + "Record Type": "FILE", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + def test_windows_specific_mftscan_mftscan(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.mftscan.MFTScan", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"\n") > 15000 + assert out.count(b"STANDARD_INFORMATION") > 5000 + assert out.count(b"FILE_NAME") > 11000 + + def test_windows_specific_mftscan_residentdata_win10(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.mftscan.ResidentData", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 850 + expected_rows = [ + { + "Filename": "index", + "Hexdump": '"\n30 5c 72 a7 1b 6d fb fc 09 00 00 00 00 00 00 00 0\\r..m..........\n00 00 00 00 00 00 00 00 ........ "', + "MFT Type": "DATA", + "Offset": 4961536280, + "Record Number": 116474, + "Record Type": "FILE", + }, + { + "Filename": "0.2.filtertrie.intermediate.txt", + "Hexdump": '"\n30 09 32 0d 0a 0.2.. "', + "MFT Type": "DATA", + "Offset": 619242944, + "Record Number": 113013, + "Record Type": "FILE", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsModScan: + def test_windows_generic_modscan(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.modscan.ModScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 90 + expected_rows = [ + { + "Name": "ntoskrnl.exe", + "Offset": 37733296, + "Path": "\\WINDOWS\\system32\\ntoskrnl.exe", + "Size": 2179328, + }, + { + "Name": "hal.dll", + "Offset": 37733192, + "Path": "\\WINDOWS\\system32\\hal.dll", + "Size": 81280, + }, + { + "Name": "netbios.sys", + "Offset": 34566968, + "Path": "\\SystemRoot\\System32\\DRIVERS\\netbios.sys", + "Size": 36864, + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsMutantScan: + def test_windows_specific_mutantscan(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.mutantscan.MutantScan", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"\n") > 350 + + +class TestWindowsNetScan: + def test_windows_specific_netscan(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.netscan.NetScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 100 + expected_rows = [ + { + "Created": "2025-03-06T17:56:53+00:00", + "ForeignAddr": "13.107.246.254", + "ForeignPort": 443, + "LocalAddr": "10.0.0.4", + "LocalPort": 49929, + "Offset": 145201667934000, + "Owner": "SearchApp.exe", + "PID": 5644, + "Proto": "TCPv4", + "State": "CLOSE_WAIT", + }, + { + "Created": "2025-03-06T17:50:02+00:00", + "ForeignAddr": "168.63.129.16", + "ForeignPort": 80, + "LocalAddr": "10.0.0.4", + "LocalPort": 49689, + "Offset": 145201778694688, + "Owner": "WindowsAzureGu", + "PID": 1944, + "Proto": "TCPv4", + "State": "CLOSED", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsNetStat: + def test_windows_specific_netstat(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.netstat.NetStat", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 70 + expected_rows = [ + { + "Created": "2025-03-06T17:56:53+00:00", + "ForeignAddr": "13.107.246.254", + "ForeignPort": 443, + "LocalAddr": "10.0.0.4", + "LocalPort": 49929, + "Offset": 145201667934000, + "Owner": "SearchApp.exe", + "PID": 5644, + "Proto": "TCPv4", + "State": "CLOSE_WAIT", + }, + { + "Created": "2025-03-06T17:50:02+00:00", + "ForeignAddr": "168.63.129.16", + "ForeignPort": 80, + "LocalAddr": "10.0.0.4", + "LocalPort": 49688, + "Offset": 145201778506032, + "Owner": "WindowsAzureGu", + "PID": 1944, + "Proto": "TCPv4", + "State": "ESTABLISHED", + }, + ] + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsPESymbols: + def test_windows_specific_pe_symbols_processes(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.pe_symbols.PESymbols", + image, + volatility, + python, + globalargs=("-r", "json"), + pluginargs=( + "--source", + "processes", + "--module", + "ntdll.dll", + "--symbol", + "NtProtectVirtualMemory", + ), + ) + assert rc == 0 + expected_row = { + "Address": 2089868982, + "Module": "ntdll.dll", + "Symbol": "NtProtectVirtualMemory", + } + + assert test_volatility.match_output_row(expected_row, json.loads(out)) + + def test_windows_specific_pe_symbols_kernel(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.pe_symbols.PESymbols", + image, + volatility, + python, + globalargs=("-r", "json"), + pluginargs=( + "--source", + "kernel", + "--module", + "ntoskrnl.exe", + "--symbol", + "ZwOpenThread", + ), + ) + assert rc == 0 + expected_row = { + "Address": 2152583356, + "Module": "ntoskrnl.exe", + "Symbol": "ZwOpenThread", + } + + assert test_volatility.match_output_row(expected_row, json.loads(out)) + + +class TestWindowsPoolScanner: + def test_windows_specific_poolscanner(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.poolscanner.PoolScanner", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"\n") > 4800 + assert out.find(b"_FILE_OBJECT") != -1 + assert out.find(b"_ETHREAD") != -1 + assert out.find(b"_RTL_ATOM_TABLE") != -1 + assert out.find(b"_KMUTANT") != -1 + + +class TestWindowsPsTree: + def test_windows_specific_pstree(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.pstree.PsTree", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 110 + expected_row = test_volatility.load_test_data( + "windows.pstree.PsTree", "WINDOWS10_GENERIC" + ) + + assert test_volatility.match_output_row( + expected_row, json_out, children_recursive=True + ) + + +class TestWindowsRegistry: + def test_windows_specific_registry_certificates(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.registry.certificates.Certificates", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 30 + expected_row = { + "Certificate ID": "ProtectedRoots", + "Certificate path": "Software\\Microsoft\\SystemCertificates", + "Certificate section": "Root", + } + assert test_volatility.match_output_row(expected_row, json_out) + + def test_windows_generic_registry_hivelist(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.registry.hivelist.HiveList", image, volatility, python + ) + assert rc == 0 + out = out.lower() + + not_xp = out.find(b"\\systemroot\\system32\\config\\software") + if not_xp == -1: + assert ( + out.find( + b"\\device\\harddiskvolume1\\windows\\system32\\config\\software" + ) + != -1 + ) + assert out.count(b"\n") > 10 + + def test_windows_specific_registry_hivescan(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.registry.hivescan.HiveScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + expected_rows = test_volatility.load_test_data( + "windows.registry.hivescan.HiveScan", "WINDOWS10_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + def test_windows_specific_registry_printkey(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.registry.printkey.PrintKey", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 450 + expected_rows = test_volatility.load_test_data( + "windows.registry.printkey.PrintKey", "WINDOWS10_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + def test_windows_specific_registry_userassist(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.registry.userassist.UserAssist", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 35 + expected_row = test_volatility.load_test_data( + "windows.registry.userassist.UserAssist", "WINDOWS10_GENERIC" + ) + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsSessions: + def test_windows_specific_sessions(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.sessions.Sessions", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 115 + expected_rows = test_volatility.load_test_data( + "windows.sessions.Sessions", "WINDOWS10_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsShimcacheMem: + def test_windows_specific_shimcachemem(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.shimcachemem.ShimcacheMem", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + expected_rows = test_volatility.load_test_data( + "windows.shimcachemem.ShimcacheMem", "WINDOWS10_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsSSDT: + def test_windows_specific_ssdt(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.ssdt.SSDT", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"\n") > 770 + assert out.find(b"ntoskrnl") != -1 + assert out.find(b"Nt") != -1 + assert out.find(b"xHal") != -1 + + +class TestWindowsThreads: + def test_windows_specific_threads(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.threads.Threads", + image, + volatility, + python, + ) + assert rc == 0 + assert out.count(b"\n") > 1730 + + +class TestWindowsTimers: + def test_windows_specific_timers(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.timers.Timers", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + expected_rows = test_volatility.load_test_data( + "windows.timers.Timers", "WINDOWSXP_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsVadInfo: + def test_windows_specific_vadinfo(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.vadinfo.VadInfo", + image, + volatility, + python, + globalargs=("-r", "json"), + pluginargs=("--pid", "4"), + ) + assert rc == 0 + json_out = json.loads(out) + expected_rows = test_volatility.load_test_data( + "windows.vadinfo.VadInfo", "WINDOWS10_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsVerInfo: + def test_windows_specific_verinfo(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.verinfo.VerInfo", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 125 + expected_row = { + "Base": 2152558592, + "Build": 2622, + "Major": 5, + "Minor": 1, + "Name": "ntoskrnl.exe", + "Product": 2600, + "__children": [], + } + assert test_volatility.match_output_row(expected_row, json_out) + + +class TestWindowsVirtMap: + def test_windows_specific_virtmap(self, volatility, python): + image = WindowsSamples.WINDOWS10_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.virtmap.VirtMap", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + expected_rows = test_volatility.load_test_data( + "windows.virtmap.VirtMap", "WINDOWS10_GENERIC" + ) + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) From ff55a0ea6c475c8d245b44ce6fa75155bbc58fe8 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:25:47 +0100 Subject: [PATCH 0787/1352] use win10 generic sample as main testing --- .github/workflows/test.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 5fdc83327..202877e99 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -31,6 +31,8 @@ jobs: gunzip linux-sample-1.bin.gz curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz" gunzip win-xp-laptop-2005-06-25.img.gz + curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-10_19041-2025_03.dmp.gz" + gunzip win-10_19041-2025_03.dmp.gz cd - - name: Download and Extract symbols @@ -47,7 +49,7 @@ jobs: pytest ./test/plugins/linux/linux.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v # Volatility - pytest ./test/plugins/windows/windows.py --volatility=vol.py --image-dir=./test_images -k "test_windows and not test_windows_volshell" -v + pytest ./test/plugins/windows/windows.py --volatility=vol.py --image=./test_images/win-10_19041-2025_03.dmp -k "test_windows and not test_windows_volshell" -v pytest ./test/plugins/linux/linux.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v - name: Clean up post-test From 489265e86cd8e17126fec3bbcf8a59a4e7eb34b7 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:28:19 +0100 Subject: [PATCH 0788/1352] make modules test specific --- test/plugins/windows/windows.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 36596721d..fe2ea2d51 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -101,7 +101,7 @@ class TestWindowsDlllist: class TestWindowsModules: - def test_windows_generic_modules(self, volatility, python): + def test_windows_specific_modules(self, volatility, python): image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( "windows.modules.Modules", From c4054b4122699cc8a8d12f703811f580e0d986ee Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:51:14 +0100 Subject: [PATCH 0789/1352] correct pstree json name --- test/plugins/windows/test_data/windows.pstree.Pstree.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/plugins/windows/test_data/windows.pstree.Pstree.json b/test/plugins/windows/test_data/windows.pstree.Pstree.json index 76971ddd4..139931730 100644 --- a/test/plugins/windows/test_data/windows.pstree.Pstree.json +++ b/test/plugins/windows/test_data/windows.pstree.Pstree.json @@ -372,4 +372,4 @@ } ] } -} \ No newline at end of file +} From cd2d396c9ebcd4de6cd905db5d00a9b9d0882e0f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:54:49 +0100 Subject: [PATCH 0790/1352] tmp commit to resolve pstree case sensitive filename --- ...{windows.pstree.Pstree.json => windows.pstree.PsTree.json.tmp} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename test/plugins/windows/test_data/{windows.pstree.Pstree.json => windows.pstree.PsTree.json.tmp} (100%) diff --git a/test/plugins/windows/test_data/windows.pstree.Pstree.json b/test/plugins/windows/test_data/windows.pstree.PsTree.json.tmp similarity index 100% rename from test/plugins/windows/test_data/windows.pstree.Pstree.json rename to test/plugins/windows/test_data/windows.pstree.PsTree.json.tmp From 951d1f6c484c1f578d5e39ee82554798d10e7c7b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 16:55:20 +0100 Subject: [PATCH 0791/1352] fix pstree data test name --- ...{windows.pstree.PsTree.json.tmp => windows.pstree.PsTree.json} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename test/plugins/windows/test_data/{windows.pstree.PsTree.json.tmp => windows.pstree.PsTree.json} (100%) diff --git a/test/plugins/windows/test_data/windows.pstree.PsTree.json.tmp b/test/plugins/windows/test_data/windows.pstree.PsTree.json similarity index 100% rename from test/plugins/windows/test_data/windows.pstree.PsTree.json.tmp rename to test/plugins/windows/test_data/windows.pstree.PsTree.json From d46c02cb75f0a6aaba1d6111c5cb25b1888d037f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 17:33:47 +0100 Subject: [PATCH 0792/1352] more granular runtime debugging --- .github/workflows/test.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 202877e99..9a73303ed 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -45,12 +45,12 @@ jobs: - name: Testing... run: | # VolShell - pytest ./test/plugins/windows/windows.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v + pytest ./test/plugins/windows/windows.py --volatility=volshell.py --image=./test_images/win-10_19041-2025_03.dmp -k test_windows_volshell -v pytest ./test/plugins/linux/linux.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v # Volatility - pytest ./test/plugins/windows/windows.py --volatility=vol.py --image=./test_images/win-10_19041-2025_03.dmp -k "test_windows and not test_windows_volshell" -v - pytest ./test/plugins/linux/linux.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v + pytest ./test/plugins/windows/windows.py --volatility=vol.py --image=./test_images/win-10_19041-2025_03.dmp -k "test_windows and not test_windows_volshell" -v --durations=0 + pytest ./test/plugins/linux/linux.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v --durations=0 - name: Clean up post-test run: | From 8de7f114486ee40bd2d1f54a3c3ae2cb8d67aa3f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 12 Mar 2025 17:59:04 +0100 Subject: [PATCH 0793/1352] revert volshell test on image-dir --- .github/workflows/test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 9a73303ed..336ca48f3 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -45,7 +45,7 @@ jobs: - name: Testing... run: | # VolShell - pytest ./test/plugins/windows/windows.py --volatility=volshell.py --image=./test_images/win-10_19041-2025_03.dmp -k test_windows_volshell -v + pytest ./test/plugins/windows/windows.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v pytest ./test/plugins/linux/linux.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v # Volatility From c8791c241af545bca2396937f2775262354e8ee8 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 12:22:04 -0500 Subject: [PATCH 0794/1352] #1471 - move registry plugins to registry directory --- volatility3/framework/plugins/windows/{ => registry}/amcache.py | 0 volatility3/framework/plugins/windows/{ => registry}/cachedump.py | 0 volatility3/framework/plugins/windows/{ => registry}/hashdump.py | 0 volatility3/framework/plugins/windows/{ => registry}/lsadump.py | 0 .../framework/plugins/windows/{ => registry}/scheduled_tasks.py | 0 5 files changed, 0 insertions(+), 0 deletions(-) rename volatility3/framework/plugins/windows/{ => registry}/amcache.py (100%) rename volatility3/framework/plugins/windows/{ => registry}/cachedump.py (100%) rename volatility3/framework/plugins/windows/{ => registry}/hashdump.py (100%) rename volatility3/framework/plugins/windows/{ => registry}/lsadump.py (100%) rename volatility3/framework/plugins/windows/{ => registry}/scheduled_tasks.py (100%) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/registry/amcache.py similarity index 100% rename from volatility3/framework/plugins/windows/amcache.py rename to volatility3/framework/plugins/windows/registry/amcache.py diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/registry/cachedump.py similarity index 100% rename from volatility3/framework/plugins/windows/cachedump.py rename to volatility3/framework/plugins/windows/registry/cachedump.py diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/registry/hashdump.py similarity index 100% rename from volatility3/framework/plugins/windows/hashdump.py rename to volatility3/framework/plugins/windows/registry/hashdump.py diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/registry/lsadump.py similarity index 100% rename from volatility3/framework/plugins/windows/lsadump.py rename to volatility3/framework/plugins/windows/registry/lsadump.py diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py similarity index 100% rename from volatility3/framework/plugins/windows/scheduled_tasks.py rename to volatility3/framework/plugins/windows/registry/scheduled_tasks.py From 54f1f746cd81f8222c58a42b1a6c931f87fe828b Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 12:23:30 -0500 Subject: [PATCH 0795/1352] #1471 - import from correct location --- volatility3/framework/plugins/windows/registry/cachedump.py | 3 +-- volatility3/framework/plugins/windows/registry/lsadump.py | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/registry/cachedump.py b/volatility3/framework/plugins/windows/registry/cachedump.py index 7bc35945a..c46ea237e 100644 --- a/volatility3/framework/plugins/windows/registry/cachedump.py +++ b/volatility3/framework/plugins/windows/registry/cachedump.py @@ -12,8 +12,7 @@ from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions -from volatility3.plugins.windows import hashdump, lsadump -from volatility3.plugins.windows.registry import hivelist +from volatility3.plugins.windows.registry import hashdump, hivelist, lsadump vollog = logging.getLogger(__name__) diff --git a/volatility3/framework/plugins/windows/registry/lsadump.py b/volatility3/framework/plugins/windows/registry/lsadump.py index 72f2fa146..2154923ec 100644 --- a/volatility3/framework/plugins/windows/registry/lsadump.py +++ b/volatility3/framework/plugins/windows/registry/lsadump.py @@ -14,8 +14,7 @@ from volatility3.framework.exceptions import InvalidAddressException from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions -from volatility3.plugins.windows import hashdump -from volatility3.plugins.windows.registry import hivelist +from volatility3.plugins.windows.registry import hashdump, hivelist from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) From 474e8e69166b4edc1e230dd4f6504a541a52d546 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 12:31:26 -0500 Subject: [PATCH 0796/1352] #1471 - add deprecated plugins in old location --- .../framework/plugins/windows/amcache.py | 23 ++++++++++++++++++ .../framework/plugins/windows/cachedump.py | 23 ++++++++++++++++++ .../framework/plugins/windows/hashdump.py | 23 ++++++++++++++++++ .../framework/plugins/windows/lsadump.py | 23 ++++++++++++++++++ .../plugins/windows/scheduled_tasks.py | 24 +++++++++++++++++++ 5 files changed, 116 insertions(+) create mode 100644 volatility3/framework/plugins/windows/amcache.py create mode 100644 volatility3/framework/plugins/windows/cachedump.py create mode 100644 volatility3/framework/plugins/windows/hashdump.py create mode 100644 volatility3/framework/plugins/windows/lsadump.py create mode 100644 volatility3/framework/plugins/windows/scheduled_tasks.py diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py new file mode 100644 index 000000000..65ef041db --- /dev/null +++ b/volatility3/framework/plugins/windows/amcache.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import amcache + +vollog = logging.getLogger(__name__) + + +class Amcache(amcache.Amcache): + """Extract information on executed applications from the AmCache (deprecated).""" + + _required_framework_version = (2, 0, 0) + _version = (2, 0, 0) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.amcache.Amcache" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py new file mode 100644 index 000000000..73ab7c87b --- /dev/null +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import cachedump + +vollog = logging.getLogger(__name__) + + +class Cachedump(cachedump.Cachedump): + """Dumps lsa secrets from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 2) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.cachedump.Cachedump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py new file mode 100644 index 000000000..c875dda50 --- /dev/null +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import hashdump + +vollog = logging.getLogger(__name__) + + +class Hashdump(hashdump.Hashdump): + """Dumps user hashes from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 1, 1) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.hashdump.Hashdump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py new file mode 100644 index 000000000..65e58cc25 --- /dev/null +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import lsadump + +vollog = logging.getLogger(__name__) + + +class Lsadump(lsadump.Lsadump): + """Dumps lsa secrets from memory (deprecated)""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.lsadump.Lsadump" + ) + ) + return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py new file mode 100644 index 000000000..4b32f6be7 --- /dev/null +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -0,0 +1,24 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +import warnings +from volatility3.plugins.windows.registry import scheduled_tasks + +vollog = logging.getLogger(__name__) + + +class ScheduledTasks(scheduled_tasks.ScheduledTasks): + """Decodes scheduled task information from the Windows registry, including \ +information about triggers, actions, run times, and creation times (deprecated).""" + + _required_framework_version = (2, 11, 0) + _version = (2, 0, 0) + + def __getattr__(self, *args, **kwargs): + warnings.warn( + DeprecationWarning( + "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks" + ) + ) + return super().__getattr__(*args, **kwargs) From 3a6063f2709bccb95b633c20d6d68906cc6e19a1 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 15:51:42 -0500 Subject: [PATCH 0797/1352] #1471 - change DeprecationWarning to FutureWarning --- volatility3/framework/plugins/windows/amcache.py | 4 +--- volatility3/framework/plugins/windows/cachedump.py | 2 +- volatility3/framework/plugins/windows/hashdump.py | 2 +- volatility3/framework/plugins/windows/lsadump.py | 4 +--- volatility3/framework/plugins/windows/scheduled_tasks.py | 2 +- 5 files changed, 5 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 65ef041db..dade91a7d 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -16,8 +16,6 @@ class Amcache(amcache.Amcache): def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( - "This plugin is now called windows.registry.amcache.Amcache" - ) + FutureWarning("This plugin is now called windows.registry.amcache.Amcache") ) return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 73ab7c87b..7aa63e013 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -16,7 +16,7 @@ class Cachedump(cachedump.Cachedump): def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( + FutureWarning( "This plugin is now called windows.registry.cachedump.Cachedump" ) ) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index c875dda50..fa23541bc 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -16,7 +16,7 @@ class Hashdump(hashdump.Hashdump): def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( + FutureWarning( "This plugin is now called windows.registry.hashdump.Hashdump" ) ) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 65e58cc25..a360d6ca8 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -16,8 +16,6 @@ class Lsadump(lsadump.Lsadump): def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( - "This plugin is now called windows.registry.lsadump.Lsadump" - ) + FutureWarning("This plugin is now called windows.registry.lsadump.Lsadump") ) return super().__getattr__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 4b32f6be7..4861092ba 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -17,7 +17,7 @@ information about triggers, actions, run times, and creation times (deprecated). def __getattr__(self, *args, **kwargs): warnings.warn( - DeprecationWarning( + FutureWarning( "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks" ) ) From f0991a9cf6cbdd91a474a7ac845eb0d31cf9beb0 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 16:33:09 -0500 Subject: [PATCH 0798/1352] #1471 - getattribute instead of getattr, and removal date --- volatility3/framework/plugins/windows/amcache.py | 9 ++++++--- volatility3/framework/plugins/windows/cachedump.py | 7 ++++--- volatility3/framework/plugins/windows/hashdump.py | 7 ++++--- volatility3/framework/plugins/windows/lsadump.py | 9 ++++++--- .../plugins/windows/registry/scheduled_tasks.py | 4 ++-- .../framework/plugins/windows/scheduled_tasks.py | 11 ++++++----- 6 files changed, 28 insertions(+), 19 deletions(-) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index dade91a7d..90e0949c8 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -14,8 +14,11 @@ class Amcache(amcache.Amcache): _required_framework_version = (2, 0, 0) _version = (2, 0, 0) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( - FutureWarning("This plugin is now called windows.registry.amcache.Amcache") + FutureWarning( + "The windows.amcache.Amcache plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.amcache.Amcache instead." + ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 7aa63e013..8640ae5cf 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -14,10 +14,11 @@ class Cachedump(cachedump.Cachedump): _required_framework_version = (2, 0, 0) _version = (1, 0, 2) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( FutureWarning( - "This plugin is now called windows.registry.cachedump.Cachedump" + "The windows.cachedump.Cachedump plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.cachedump.Cachedump instead." ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index fa23541bc..ee6bdb477 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -14,10 +14,11 @@ class Hashdump(hashdump.Hashdump): _required_framework_version = (2, 0, 0) _version = (1, 1, 1) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( FutureWarning( - "This plugin is now called windows.registry.hashdump.Hashdump" + "The windows.hashdump.Hashdump plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.hashdump.Hashdump instead." ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index a360d6ca8..8ee173e89 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -14,8 +14,11 @@ class Lsadump(lsadump.Lsadump): _required_framework_version = (2, 0, 0) _version = (1, 0, 1) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( - FutureWarning("This plugin is now called windows.registry.lsadump.Lsadump") + FutureWarning( + "The windows.lsadump.Lsadump plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.lsadump.Lsadump instead." + ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py index ba54e19ec..3aa82a69e 100644 --- a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py @@ -1108,8 +1108,8 @@ class DynamicInfo: class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): - """Decodes scheduled task information from the Windows registry, including \ -information about triggers, actions, run times, and creation times.""" + """Decodes scheduled task information from the Windows registry, including + information about triggers, actions, run times, and creation times.""" _required_framework_version = (2, 11, 0) _version = (2, 0, 0) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 4861092ba..15d8abb93 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -9,16 +9,17 @@ vollog = logging.getLogger(__name__) class ScheduledTasks(scheduled_tasks.ScheduledTasks): - """Decodes scheduled task information from the Windows registry, including \ -information about triggers, actions, run times, and creation times (deprecated).""" + """Decodes scheduled task information from the Windows registry, including + information about triggers, actions, run times, and creation times (deprecated).""" _required_framework_version = (2, 11, 0) _version = (2, 0, 0) - def __getattr__(self, *args, **kwargs): + def __getattribute__(self, *args, **kwargs): warnings.warn( FutureWarning( - "This plugin is now called windows.registry.scheduled_tasks.ScheduledTasks" + "The windows.registry.scheduled_tasks.ScheduledTasks plugin is deprecated and will be removed on " + "September 19, 2025. Use windows.registry.scheduled_tasks.ScheduledTasks instead." ) ) - return super().__getattr__(*args, **kwargs) + return super().__getattribute__(*args, **kwargs) From 154999461fbecf374661f14c0ae5d3ec067e855e Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 12 Mar 2025 19:02:59 -0500 Subject: [PATCH 0799/1352] #1471 - use standard date format --- volatility3/framework/plugins/windows/amcache.py | 2 +- volatility3/framework/plugins/windows/cachedump.py | 2 +- volatility3/framework/plugins/windows/hashdump.py | 2 +- volatility3/framework/plugins/windows/lsadump.py | 2 +- volatility3/framework/plugins/windows/scheduled_tasks.py | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 90e0949c8..6e45d5b36 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -18,7 +18,7 @@ class Amcache(amcache.Amcache): warnings.warn( FutureWarning( "The windows.amcache.Amcache plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.amcache.Amcache instead." + "2025-09-25. Use windows.registry.amcache.Amcache instead." ) ) return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 8640ae5cf..14320312a 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -18,7 +18,7 @@ class Cachedump(cachedump.Cachedump): warnings.warn( FutureWarning( "The windows.cachedump.Cachedump plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.cachedump.Cachedump instead." + "2025-09-25. Use windows.registry.cachedump.Cachedump instead." ) ) return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index ee6bdb477..98baf7d53 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -18,7 +18,7 @@ class Hashdump(hashdump.Hashdump): warnings.warn( FutureWarning( "The windows.hashdump.Hashdump plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.hashdump.Hashdump instead." + "2025-09-25. Use windows.registry.hashdump.Hashdump instead." ) ) return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 8ee173e89..86cbe1949 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -18,7 +18,7 @@ class Lsadump(lsadump.Lsadump): warnings.warn( FutureWarning( "The windows.lsadump.Lsadump plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.lsadump.Lsadump instead." + "2025-09-25. Use windows.registry.lsadump.Lsadump instead." ) ) return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 15d8abb93..7241f07d1 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -19,7 +19,7 @@ class ScheduledTasks(scheduled_tasks.ScheduledTasks): warnings.warn( FutureWarning( "The windows.registry.scheduled_tasks.ScheduledTasks plugin is deprecated and will be removed on " - "September 19, 2025. Use windows.registry.scheduled_tasks.ScheduledTasks instead." + "2025-09-25. Use windows.registry.scheduled_tasks.ScheduledTasks instead." ) ) return super().__getattribute__(*args, **kwargs) From 48a5736a576a5b9c6119d64d85a46c8cc370bc31 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 13 Mar 2025 21:09:38 +0000 Subject: [PATCH 0800/1352] Properly reconstruct strings from memory buffers and allow for plugin-specified encodings --- volatility3/framework/constants/_version.py | 2 +- volatility3/framework/objects/utility.py | 27 ++++++++++++--------- 2 files changed, 17 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index aa8e8936f..1ea59c068 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 23 # Number of changes that only add to the interface +VERSION_MINOR = 24 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 500c0e9a5..1fcd305f7 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import re from typing import Optional, Union from volatility3.framework import interfaces, objects, constants @@ -33,6 +34,7 @@ def array_to_string( count: Optional[int] = None, errors: str = "replace", block_size=32, + encoding="utf-8", ) -> str: """Takes a Volatility 'Array' of characters and returns a Python string. @@ -60,6 +62,7 @@ def array_to_string( count=count, errors=errors, block_size=block_size, + encoding=encoding, ) @@ -68,6 +71,7 @@ def pointer_to_string( count: int, errors: str = "replace", block_size=32, + encoding="utf-8", ) -> str: """Takes a Volatility 'Pointer' to characters and returns a Python string. @@ -94,6 +98,7 @@ def pointer_to_string( count=count, errors=errors, block_size=block_size, + encoding=encoding, ) @@ -104,6 +109,7 @@ def address_to_string( count: int, errors: str = "replace", block_size=32, + encoding="utf-8", ) -> str: """Reads a null-terminated string from a given specified memory address, processing it in blocks for efficiency. @@ -126,18 +132,17 @@ def address_to_string( raise ValueError("Count must be greater than 0") layer = context.layers[layer_name] - text = b"" - while len(text) < count: - current_block_size = min(count - len(text), block_size) - temp_text = layer.read(address + len(text), current_block_size) - idx = temp_text.find(b"\x00") - if idx != -1: - temp_text = temp_text[:idx] - text += temp_text - break - text += temp_text - return text.decode(errors=errors) + # Purposely do not catch exception + data = layer.read(address, count) + + decoded_data = data.decode(encoding=encoding, errors=errors) + try: + idx = re.search("\ufffd|\x00", decoded_data).start() + except AttributeError: + idx = len(decoded_data) + + return decoded_data[:idx] def array_of_pointers( From 6f9f5c34b9767ed8dd531da0b0ba85c42fcc6fab Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 10 Mar 2025 11:03:18 -0500 Subject: [PATCH 0801/1352] Feature: Add support for IPython in volshell --- volatility3/cli/volshell/generic.py | 70 +++++++++++++++++++++-------- 1 file changed, 51 insertions(+), 19 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 2321408fe..8f915ac4a 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -8,6 +8,7 @@ import random import string import struct import sys +import textwrap from typing import Any, Dict, Iterable, List, Optional, Tuple, Type, Union from urllib import parse, request @@ -23,6 +24,14 @@ try: except ImportError: has_capstone = False +try: + from IPython import terminal + from traitlets import config as traitlets_config + + has_ipython = True +except ImportError: + has_ipython = False + class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" @@ -69,43 +78,66 @@ class Volshell(interfaces.plugins.PluginInterface): """ # Try to enable tab completion - try: - import readline - except ImportError: - pass - else: - import rlcompleter + if not has_ipython: + try: + import readline + except ImportError: + pass + else: + import rlcompleter - completer = rlcompleter.Completer(namespace=self._construct_locals_dict()) - readline.set_completer(completer.complete) - readline.parse_and_bind("tab: complete") - print("Readline imported successfully") + completer = rlcompleter.Completer( + namespace=self._construct_locals_dict() + ) + readline.set_completer(completer.complete) + readline.parse_and_bind("tab: complete") + print("Readline imported successfully") # TODO: provide help, consider generic functions (pslist?) and/or providing windows/linux functions mode = self.__module__.split(".")[-1] mode = mode[0].upper() + mode[1:] - banner = f""" - Call help() to see available functions + banner = textwrap.dedent( + f""" + Call help() to see available functions - Volshell mode : {mode} - Current Layer : {self.current_layer} - Current Symbol Table : {self.current_symbol_table} - Current Kernel Name : {self.current_kernel_name} -""" + Volshell mode : {mode} + Current Layer : {self.current_layer} + Current Symbol Table : {self.current_symbol_table} + Current Kernel Name : {self.current_kernel_name} + """ + ) sys.ps1 = f"({self.current_layer}) >>> " # Dict self._construct_locals_dict() will have priority on keys combined_locals = additional_locals.copy() combined_locals.update(self._construct_locals_dict()) - self.__console = code.InteractiveConsole(locals=combined_locals) + if has_ipython: + + class LayerNamePrompt(terminal.prompts.Prompts): + def in_prompt_tokens(self, cli=None): + slf = self.shell.user_ns.get("self") + layer_name = slf.current_layer if slf else "no_layer" + return [(terminal.prompts.Token.Prompt, f"[{layer_name}]> ")] + + c = traitlets_config.Config() + c.TerminalInteractiveShell.prompts_class = LayerNamePrompt + c.InteractiveShellEmbed.banner2 = banner + self.__console = terminal.embed.InteractiveShellEmbed( + config=c, user_ns=combined_locals + ) + else: + self.__console = code.InteractiveConsole(locals=combined_locals) # Since we have to do work to add the option only once for all different modes of volshell, we can't # rely on the default having been set if self.config.get("script", None) is not None: self.run_script(location=self.config["script"]) - self.__console.interact(banner=banner) + if has_ipython: + self.__console() + else: + self.__console.interact(banner=banner) return renderers.TreeGrid([("Terminating", str)], None) From fa2a93ade493380e94c1391a980777b477daeae8 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 13 Mar 2025 17:09:56 -0500 Subject: [PATCH 0802/1352] Volshell: Fix import logic around readline + rlcomplete --- volatility3/cli/volshell/generic.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 8f915ac4a..c45f9d1d4 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -81,9 +81,6 @@ class Volshell(interfaces.plugins.PluginInterface): if not has_ipython: try: import readline - except ImportError: - pass - else: import rlcompleter completer = rlcompleter.Completer( @@ -92,6 +89,8 @@ class Volshell(interfaces.plugins.PluginInterface): readline.set_completer(completer.complete) readline.parse_and_bind("tab: complete") print("Readline imported successfully") + except ImportError: + pass # TODO: provide help, consider generic functions (pslist?) and/or providing windows/linux functions From c3123e883944e27b89d1231fb823ba4e0ea328e0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 13 Mar 2025 17:17:17 -0500 Subject: [PATCH 0803/1352] Volshell: Handle script running in ipython shell --- volatility3/cli/volshell/generic.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index c45f9d1d4..c86e221f7 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -539,10 +539,11 @@ class Volshell(interfaces.plugins.PluginInterface): location = "file:" + request.pathname2url(location) print(f"Running code from {location}\n") accessor = resources.ResourceAccessor() - with accessor.open(url=location) as fp: - self.__console.runsource( - io.TextIOWrapper(fp, encoding="utf-8").read(), symbol="exec" - ) + with io.TextIOWrapper(accessor.open(url=location), encoding="utf-8") as fp: + if has_ipython: + self.__console.ex(fp.read()) + else: + self.__console.runsource(fp.read(), symbol="exec") print("\nCode complete") def load_file(self, location: str): From d76288f99407c93b719c130b9da6ba86471446db Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 13 Mar 2025 22:53:51 +0000 Subject: [PATCH 0804/1352] Update nearly all callers of now deprecated Linux kernel APIs --- .../framework/plugins/linux/check_idt.py | 23 ++++++------ .../framework/plugins/linux/hidden_modules.py | 8 ++-- .../plugins/linux/keyboard_notifiers.py | 34 ++++++++++------- .../framework/plugins/linux/kthreads.py | 37 +++++++++---------- .../framework/plugins/linux/tty_check.py | 32 +++++++++------- 5 files changed, 69 insertions(+), 65 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index dbdb0e9be..c85f291cc 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -10,7 +10,6 @@ from volatility3.framework import interfaces, renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import linux -from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -39,9 +38,6 @@ class Check_idt(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) - ), ] @staticmethod @@ -82,10 +78,8 @@ class Check_idt(interfaces.plugins.PluginInterface): vmlinux = self.context.modules[self.config["kernel"]] - modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name) - - handlers = linux.LinuxUtilities.generate_kernel_handler_info( - self.context, vmlinux.name, modules + known_modules = linux_utilities_modules.Modules.run_modules_scanners( + self.context, self.config["kernel"], run_hidden_modules=True ) idt_table_size = 256 @@ -134,19 +128,24 @@ class Check_idt(interfaces.plugins.PluginInterface): module_name = renderers.NotAvailableValue() symbol_name = renderers.NotAvailableValue() else: - module_name, symbol_name = ( - linux_utilities_modules.Modules.lookup_module_address( - self.context, vmlinux.name, handlers, idt_addr + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self.context, vmlinux.name, known_modules, idt_addr ) ) + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + yield ( 0, [ format_hints.Hex(i), format_hints.Hex(idt_addr), module_name, - symbol_name, + symbol_name or renderers.NotAvailableValue(), ], ) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 9891bf138..8999126b1 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -10,7 +10,6 @@ from volatility3.framework import renderers, interfaces, exceptions, deprecation from volatility3.framework.constants import architectures from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements -from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -29,9 +28,6 @@ class Hidden_modules(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) - ), requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, @@ -163,7 +159,9 @@ class Hidden_modules(interfaces.plugins.PluginInterface): known_module_addresses = { vmlinux_layer.canonicalize(module.vol.offset) - for module in lsmod.Lsmod.list_modules(context, vmlinux_module_name) + for module in linux_utilities_modules.Modules.list_modules( + context, vmlinux_module_name + ) } return known_module_addresses diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index 8fd2846c1..beebc4248 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -9,7 +9,6 @@ from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import linux -from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -32,9 +31,6 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): component=linux_utilities_modules.Modules, version=(2, 0, 0), ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) - ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), @@ -43,12 +39,6 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] - modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name) - - handlers = linux.LinuxUtilities.generate_kernel_handler_info( - self.context, vmlinux.name, modules - ) - try: knl_addr = vmlinux.object_from_symbol("keyboard_notifier_list") except exceptions.SymbolError: @@ -65,6 +55,10 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): vollog.error("The head of the keyboard notifier list is paged out.") return + known_modules = linux_utilities_modules.Modules.run_modules_scanners( + self.context, self.config["kernel"], run_hidden_modules=True + ) + knl = vmlinux.object( object_type="atomic_notifier_head", offset=knl_addr.vol.offset, @@ -76,13 +70,25 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): ): call_addr = call_back.notifier_call - module_name, symbol_name = ( - linux_utilities_modules.Modules.lookup_module_address( - self.context, vmlinux.name, handlers, call_addr + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self.context, vmlinux.name, known_modules, call_addr ) ) - yield (0, [format_hints.Hex(call_addr), module_name, symbol_name]) + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + + yield ( + 0, + [ + format_hints.Hex(call_addr), + module_name, + symbol_name or renderers.NotAvailableValue(), + ], + ) def run(self): return renderers.TreeGrid( diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index 60d24f06e..99a1b57a9 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -5,14 +5,14 @@ import logging from typing import List import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import constants, exceptions, interfaces, renderers +from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import linux from volatility3.framework.constants import architectures from volatility3.framework.objects import utility -from volatility3.plugins.linux import pslist, lsmod +from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) @@ -42,28 +42,22 @@ class Kthreads(plugins.PluginInterface): requirements.PluginRequirement( name="pslist", plugin=pslist.PsList, version=(4, 0, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) - ), ] def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] - modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name) - handlers = linux.LinuxUtilities.generate_kernel_handler_info( - self.context, vmlinux.name, modules - ) - - kthread_type = vmlinux.get_type( - vmlinux.symbol_table_name + constants.BANG + "kthread" - ) + kthread_type = vmlinux.get_type("kthread") if not kthread_type.has_member("threadfn"): raise exceptions.VolatilityException( "Unsupported kthread implementation. This plugin only works with kernels >= 5.8" ) + known_modules = linux_utilities_modules.Modules.run_modules_scanners( + self.context, self.config["kernel"], run_hidden_modules=True + ) + for task in pslist.PsList.list_tasks( self.context, vmlinux.name, include_threads=True ): @@ -86,9 +80,7 @@ class Kthreads(plugins.PluginInterface): if not (threadfn and threadfn.is_readable()): continue - task_name = utility.array_to_string(task.comm) - - thread_name = task_name + thread_name = utility.array_to_string(task.comm) # kernels >= 5.17 in d6986ce24fc00b0638bd29efe8fb7ba7619ed2aa full_name was added to kthread if kthread.has_member("full_name"): @@ -101,18 +93,23 @@ class Kthreads(plugins.PluginInterface): f"full_name pointer for thread at {kthread.vol.offset:#x} is paged out." ) - module_name, symbol_name = ( - linux_utilities_modules.Modules.lookup_module_address( - self.context, vmlinux.name, handlers, threadfn + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self.context, vmlinux.name, known_modules, threadfn ) ) + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + fields = [ task.pid, thread_name, format_hints.Hex(threadfn), module_name, - symbol_name, + symbol_name or renderers.NotAvailableValue(), ] yield 0, fields diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index 281d46eda..b45272eb6 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -12,7 +12,6 @@ from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import linux -from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -35,9 +34,6 @@ class tty_check(plugins.PluginInterface): component=linux_utilities_modules.Modules, version=(2, 0, 0), ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) - ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), @@ -46,12 +42,6 @@ class tty_check(plugins.PluginInterface): def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] - modules = lsmod.Lsmod.list_modules(self.context, vmlinux.name) - - handlers = linux.LinuxUtilities.generate_kernel_handler_info( - self.context, vmlinux.name, modules - ) - try: tty_drivers = vmlinux.object_from_symbol("tty_drivers").cast("list_head") except exceptions.SymbolError: @@ -64,6 +54,10 @@ class tty_check(plugins.PluginInterface): "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." ) + known_modules = linux_utilities_modules.Modules.run_modules_scanners( + self.context, self.config["kernel"], run_hidden_modules=True + ) + for tty in tty_drivers.to_list( vmlinux.symbol_table_name + constants.BANG + "tty_driver", "tty_drivers" ): @@ -87,13 +81,23 @@ class tty_check(plugins.PluginInterface): except exceptions.InvalidAddressException: continue - module_name, symbol_name = ( - linux_utilities_modules.Modules.lookup_module_address( - self.context, vmlinux.name, handlers, recv_buf + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self.context, vmlinux.name, known_modules, recv_buf ) ) - yield (0, (name, format_hints.Hex(recv_buf), module_name, symbol_name)) + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + + yield 0, ( + name, + format_hints.Hex(recv_buf), + module_name, + symbol_name or renderers.NotAvailableValue(), + ) def run(self): return renderers.TreeGrid( From 39d39292f0a0c2b1429041713696d3c5e0190978 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 13 Mar 2025 22:55:47 +0000 Subject: [PATCH 0805/1352] Update symbol splitting to handle symbols without attached module name --- volatility3/framework/symbols/linux/utilities/modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 0eeb2b33c..ef20ed044 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -98,7 +98,7 @@ class Modules(interfaces.configuration.VersionableInterface): module = kernel.object("module", offset=module.offset, absolute=True) symbol_name = module.get_symbol_by_address(target_address) - if symbol_name: + if symbol_name and symbol_name.find(constants.BANG) != -1: symbol_name = symbol_name.split(constants.BANG)[1] return match, symbol_name From c318e7c32664352f036aeed1453a8ed40ad6c90f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 01:52:16 +0000 Subject: [PATCH 0806/1352] Make configurable to sources --- .../framework/plugins/linux/check_idt.py | 6 +- .../framework/plugins/linux/check_modules.py | 2 +- .../framework/plugins/linux/hidden_modules.py | 2 +- .../plugins/linux/keyboard_notifiers.py | 6 +- .../framework/plugins/linux/kthreads.py | 6 +- volatility3/framework/plugins/linux/lsmod.py | 2 +- .../framework/plugins/linux/modxview.py | 15 +- .../framework/plugins/linux/netfilter.py | 2 +- .../framework/plugins/linux/tracing/ftrace.py | 6 +- .../plugins/linux/tracing/tracepoints.py | 6 +- .../framework/plugins/linux/tty_check.py | 6 +- .../symbols/linux/utilities/modules.py | 207 ++++++++++++++---- 12 files changed, 199 insertions(+), 67 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index c85f291cc..119531836 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -33,7 +33,7 @@ class Check_idt(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) @@ -79,7 +79,9 @@ class Check_idt(interfaces.plugins.PluginInterface): vmlinux = self.context.modules[self.config["kernel"]] known_modules = linux_utilities_modules.Modules.run_modules_scanners( - self.context, self.config["kernel"], run_hidden_modules=True + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, ) idt_table_size = 256 diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 76f75ec50..40f3f638c 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -33,7 +33,7 @@ class Check_modules(plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), ] diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 8999126b1..5be8e7174 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -31,7 +31,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), ] diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index beebc4248..b4f9dd3ca 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -29,7 +29,7 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) @@ -56,7 +56,9 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): return known_modules = linux_utilities_modules.Modules.run_modules_scanners( - self.context, self.config["kernel"], run_hidden_modules=True + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, ) knl = vmlinux.object( diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index 99a1b57a9..7d6abcecc 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -34,7 +34,7 @@ class Kthreads(plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) @@ -55,7 +55,9 @@ class Kthreads(plugins.PluginInterface): ) known_modules = linux_utilities_modules.Modules.run_modules_scanners( - self.context, self.config["kernel"], run_hidden_modules=True + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, ) for task in pslist.PsList.list_tasks( diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index b4f881801..a3ace9a24 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -33,7 +33,7 @@ class Lsmod(plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), ] diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index f6a6f7727..4373ffb7c 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -34,7 +34,7 @@ spot modules presence and taints.""" requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), requirements.VersionRequirement( name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) @@ -93,13 +93,22 @@ spot modules presence and taints.""" kernel = self.context.modules[kernel_name] + wanted_sources = [ + linux_utilities_modules.Modules.source_lsmod_identifier, + linux_utilities_modules.Modules.source_sysfs_identifier, + linux_utilities_modules.Modules.source_hidden_identifier, + ] + run_results = linux_utilities_modules.Modules.run_modules_scanners( - self.context, kernel_name, flatten=False + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_sources=wanted_sources, + flatten=False, ) aggregated_modules = {} # We want to be explicit on the plugins results we are interested in - for plugin_name in ["lsmod", "check_modules", "hidden_modules"]: + for plugin_name in wanted_sources: # Iterate over each recovered module for mod_info in run_results[plugin_name]: # Use offsets as unique keys, whether a module diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index 9c0055a54..e8a33be61 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -726,7 +726,7 @@ class Netfilter(interfaces.plugins.PluginInterface): _version = (1, 1, 1) - _required_linux_utilities_modules_version = (2, 0, 0) + _required_linux_utilities_modules_version = (3, 0, 0) _required_linuxutils_version = (2, 1, 0) _required_lsmod_version = (2, 0, 0) _required_linuxnet_version = (1, 0, 0) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 17766cc74..146230f02 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -79,7 +79,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), requirements.BooleanRequirement( name="show_ftrace_flags", @@ -223,7 +223,9 @@ class CheckFtrace(interfaces.plugins.PluginInterface): return known_modules = linux_utilities_modules.Modules.run_modules_scanners( - self.context, kernel_name, run_hidden_modules=True + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, ) for ftrace_ops in self.iterate_ftrace_ops_list(self.context, kernel_name): diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index fe6d11af9..83903b19b 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -52,7 +52,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), ] @@ -229,7 +229,9 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): return known_modules = linux_utilities_modules.Modules.run_modules_scanners( - self.context, kernel_name, run_hidden_modules=False + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, ) tracepoints = self.iterate_tracepoints_array(self.context, kernel_name) diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index b45272eb6..f4b581756 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -32,7 +32,7 @@ class tty_check(plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, - version=(2, 0, 0), + version=(3, 0, 0), ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) @@ -55,7 +55,9 @@ class tty_check(plugins.PluginInterface): ) known_modules = linux_utilities_modules.Modules.run_modules_scanners( - self.context, self.config["kernel"], run_hidden_modules=True + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, ) for tty in tty_drivers.to_list( diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 0eeb2b33c..dac52dce3 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -19,11 +19,26 @@ vollog = logging.getLogger(__name__) class Modules(interfaces.configuration.VersionableInterface): """Kernel modules related utilities.""" - _version = (2, 0, 0) + _version = (3, 0, 0) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) + # Valid sources of kernel modules to send to `run_module_scanners` + source_kernel_identifier = "kernel" + source_lsmod_identifier = "lsmod" + source_sysfs_identifier = "check_modules" + source_hidden_identifier = "hidden_modules" + + # With few exceptions, rootkit checking plugins want all sources + # This provides a stable identifier as new sources are added over time + all_sources_identifier = [ + source_kernel_identifier, + source_lsmod_identifier, + source_sysfs_identifier, + source_hidden_identifier, + ] + class ModuleInfo(NamedTuple): """ Used to track the name and boundary of a kernel module @@ -34,13 +49,13 @@ class Modules(interfaces.configuration.VersionableInterface): start: int end: int - @staticmethod + @classmethod def module_lookup_by_address( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str, modules: Iterable[ModuleInfo], target_address: int, - run_hidden_modules: bool = True, ) -> Optional[Tuple[ModuleInfo, Optional[str]]]: """ Determine if a target address lies in a module memory space. @@ -195,7 +210,7 @@ class Modules(interfaces.configuration.VersionableInterface): def get_kernel_module_info( context: interfaces.context.ContextInterface, kernel_module_name: str, - ) -> ModuleInfo: + ) -> Iterator[ModuleInfo]: """ Returns a ModuleInfo instance that encodes the kernel This is required to map function pointers to the kerenl executable @@ -210,77 +225,173 @@ class Modules(interfaces.configuration.VersionableInterface): end_addr = kernel.object_from_symbol("_etext") end_addr = end_addr.vol.offset & address_mask - return Modules.ModuleInfo( - start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr + return [ + Modules.ModuleInfo( + start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr + ) + ] + + @classmethod + def _get_hidden_modules_results( + cls, + context: str, + kernel_module_name: str, + run_results: Dict[str, List[ModuleInfo]], + ): + known_modules_addresses = set() + + kernel = context.modules[kernel_module_name] + + # Walk each sources' results + for results in run_results.values(): + for modinfo in results: + address = context.layers[kernel.layer_name].canonicalize(modinfo.start) + known_modules_addresses.add(address) + + modules_memory_boundaries = cls.get_modules_memory_boundaries( + context, kernel_module_name ) + hidden_results = [] + + address_mask = context.layers[kernel.layer_name].address_mask + + for module in cls.get_hidden_modules( + context, + kernel_module_name, + known_modules_addresses, + modules_memory_boundaries, + ): + modinfo = cls.get_module_info_for_module(address_mask, module) + if modinfo: + hidden_results.append(modinfo) + + return hidden_results + + @classmethod + def _get_list_modules( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str + ) -> List[ModuleInfo]: + """ + Gather `module` instances from lsmod + """ + yield from cls.list_modules(context, kernel_module_name) + + @classmethod + def _get_sysfs_modules( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str + ) -> List[ModuleInfo]: + """ + Gather the `module` instances from sysfs + """ + kernel = context.modules[kernel_module_name] + + sysfs_modules: dict = cls.get_kset_modules(context, kernel_module_name) + + for m_offset in sysfs_modules.values(): + yield kernel.object(object_type="module", offset=m_offset, absolute=True) + + @classmethod + def _validated_sources(cls, caller_wanted_sources) -> List[str]: + """ + Called by `run_modules_scanners` to validate the caller supplied sources list + An exception is thrown if an empty source list is given or a list containing an invalid source + """ + if not caller_wanted_sources: + raise ValueError("`caller_wanted_sources` must have at least one source.") + + if ( + len(caller_wanted_sources) == 1 + and caller_wanted_sources[0] == Modules.source_hidden_identifier + ): + raise ValueError( + f"{Modules.source_hidden_identifier} cannot be the only source or there is nothing to compare against." + ) + + wanted_sources = [] + + for source in caller_wanted_sources: + if source not in Modules.all_sources_identifier: + raise ValueError( + f"Invalid source sent through `caller_wanted_sources`: {source}" + ) + + wanted_sources.append(source) + + return wanted_sources + @classmethod def run_modules_scanners( cls, context: interfaces.context.ContextInterface, - kernel_name: str, - run_hidden_modules: bool = True, + kernel_module_name: str, + caller_wanted_sources: List[str], flatten: bool = True, ) -> Dict[str, List[ModuleInfo]]: """Run module scanning plugins and aggregate the results. It is designed to not operate any inter-plugin results triage. + Rules for `caller_wanted_sources`: + + If `Modules.all_sources_identifier` is specified then every source will be populated + + If `Modules.source_hidden_identifier` is in the list, then at least one other sources must be + specified so a comparison will be populated + + If empty or an invalid source is specified then a ValueError is thrown + Args: - run_hidden_modules: specify if the hidden_modules plugin should be run + called_wanted_sources: The list of sources to gather modules. + flatten: Whether to de-duplicate modules across sources Returns: Dictionary mapping each plugin to its corresponding result """ - kernel = context.modules[kernel_name] + module_gatherers = { + Modules.source_kernel_identifier: cls.get_kernel_module_info, + Modules.source_lsmod_identifier: cls._get_list_modules, + Modules.source_sysfs_identifier: cls._get_sysfs_modules, + } + + kernel = context.modules[kernel_module_name] address_mask = context.layers[kernel.layer_name].address_mask + wanted_sources = Modules._validated_sources(caller_wanted_sources) + run_results = {} - # the kernel module boundaries - run_results["kernel"] = [cls.get_kernel_module_info(context, kernel_name)] + run_hidden_modules = False - # lsmod - run_results["lsmod"] = [] + # Special case hidden modules since it gathers modules on its own + if Modules.source_hidden_identifier in wanted_sources: + run_hidden_modules = True + wanted_sources.remove(Modules.source_hidden_identifier) - for module in cls.list_modules(context, kernel_name): - modinfo = cls.get_module_info_for_module(address_mask, module) - if modinfo: - run_results["lsmod"].append(modinfo) + # Walk each source, gathering modules + for wanted_source in wanted_sources: + run_results[wanted_source] = [] - # check_modules - run_results["check_modules"] = [] + gatherer = module_gatherers[wanted_source] - sysfs_modules: dict = cls.get_kset_modules(context, kernel_name) + # process each module coming from back the current source + for module in gatherer(context, kernel_module_name): + # the kernel sends back a ModuleInfo directly + if wanted_source == Modules.source_kernel_identifier: + modinfo = module + else: + modinfo = cls.get_module_info_for_module(address_mask, module) - for m_offset in sysfs_modules.values(): - module = kernel.object(object_type="module", offset=m_offset, absolute=True) - modinfo = cls.get_module_info_for_module(address_mask, module) - if modinfo: - run_results["check_modules"].append(modinfo) - - # hidden_modules - if run_hidden_modules: - known_modules_addresses = set( - context.layers[kernel.layer_name].canonicalize(modinfo.start) - for modinfo in run_results["kernel"] - + run_results["lsmod"] - + run_results["check_modules"] - ) - modules_memory_boundaries = cls.get_modules_memory_boundaries( - context, kernel_name - ) - run_results["hidden_modules"] = [] - - for module in cls.get_hidden_modules( - context, - kernel_name, - known_modules_addresses, - modules_memory_boundaries, - ): - modinfo = cls.get_module_info_for_module(address_mask, module) if modinfo: - run_results["hidden_modules"].append(modinfo) + run_results[wanted_source].append(modinfo) + + # run hidden modules against the other sources + if run_hidden_modules: + run_results[Modules.source_hidden_identifier] = ( + cls._get_hidden_modules_results( + context, kernel_module_name, run_results + ) + ) if flatten: return cls.flatten_run_modules_results(run_results) From 4606495ded4f71c2bdd9066b260556947729e618 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 02:09:08 +0000 Subject: [PATCH 0807/1352] Bump dep versions --- volatility3/framework/plugins/linux/check_modules.py | 2 +- volatility3/framework/plugins/linux/hidden_modules.py | 8 ++++---- volatility3/framework/plugins/linux/lsmod.py | 2 +- volatility3/framework/plugins/linux/modxview.py | 4 ++-- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 40f3f638c..44cb568e6 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -41,7 +41,7 @@ class Check_modules(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_kset_modules, removal_date="2025-09-25", - replacement_version=(2, 0, 0), + replacement_version=(3, 0, 0), ) def get_kset_modules( cls, context: interfaces.context.ContextInterface, vmlinux_name: str diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 5be8e7174..985d4cfcb 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -39,7 +39,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, removal_date="2025-09-25", - replacement_version=(2, 0, 0), + replacement_version=(3, 0, 0), ) def get_modules_memory_boundaries( context: interfaces.context.ContextInterface, @@ -52,7 +52,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_module_address_alignment, removal_date="2025-09-25", - replacement_version=(2, 0, 0), + replacement_version=(3, 0, 0), ) @classmethod def _get_module_address_alignment( @@ -80,7 +80,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_hidden_modules, removal_date="2025-09-25", - replacement_version=(2, 0, 0), + replacement_version=(3, 0, 0), ) @classmethod def get_hidden_modules( @@ -120,7 +120,7 @@ class Hidden_modules(interfaces.plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.validate_alignment_patterns, removal_date="2025-09-25", - replacement_version=(2, 0, 0), + replacement_version=(3, 0, 0), ) def _validate_alignment_patterns( addresses: Iterable[int], diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index a3ace9a24..466bfa0b4 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -40,7 +40,7 @@ class Lsmod(plugins.PluginInterface): @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.list_modules, - replacement_version=(2, 0, 0), + replacement_version=(3, 0, 0), removal_date="2025-09-25", ) def list_modules( diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index 4373ffb7c..e43672974 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -50,7 +50,7 @@ spot modules presence and taints.""" @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.flatten_run_modules_results, - replacement_version=(2, 0, 0), + replacement_version=(3, 0, 0), removal_date="2025-09-25", ) def flatten_run_modules_results( @@ -73,7 +73,7 @@ spot modules presence and taints.""" @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.run_modules_scanners, - replacement_version=(2, 0, 0), + replacement_version=(3, 0, 0), removal_date="2025-09-25", ) def run_modules_scanners( From 7ab62365fbbaf3184942eed0a13848cd8781ef00 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 03:05:11 +0000 Subject: [PATCH 0808/1352] Vastly improve string reading while keeping intended behaviour --- volatility3/framework/objects/utility.py | 97 +++++++++++++++++++++--- 1 file changed, 87 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 1fcd305f7..a1ad4fdf5 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -2,10 +2,9 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import re from typing import Optional, Union -from volatility3.framework import interfaces, objects, constants +from volatility3.framework import interfaces, objects, constants, exceptions def rol(value: int, count: int, max_bits: int = 64) -> int: @@ -102,6 +101,64 @@ def pointer_to_string( ) +def gather_contiguous_bytes_from_address(layer, address: int, count: int) -> bytes: + """ + This method reconstructs a string from memory while also carefully examining each page + + It goes page-by-page reading the bytes. This is done by calculating page boundaries + and then only reading one page at a time. + + If a page is missing, the code initially catches the exception. + If data is non-empty (meaning at least one read succeeded), then we return what was read + If the first page fails, then we re-raise the exception + """ + + data = b"" + + left_to_read = count + + # read as many pages as possible that are contiguous + # if the first page is missed, we re-raise the InvalidAddressException + # if we have at least 1 page that was read succesfully, + # then we try to construct a string from it + while left_to_read > 0: + # compute aligned address of current page and next the page + aligned = address & ~0xFFF + next_page = aligned + 0xFFF + 1 + + # all fits on the current page, last read + if address + left_to_read < next_page: + try: + data += layer.read(address, left_to_read) + except exceptions.InvalidAddressException: + # if we have data, just break the loop + if data: + break + # Raise if no data was read as this means the first page was invalid + else: + raise + + left_to_read = 0 + + else: + # how many bytes are left on the current page + len_to_read = next_page - address + + try: + data += layer.read(address, len_to_read) + except exceptions.InvalidAddressException: + if data: + break + # Raise if no data was read as this means the first page was invalid + else: + raise + + address += len_to_read + left_to_read -= len_to_read + + return data + + def address_to_string( context: interfaces.context.ContextInterface, layer_name: str, @@ -131,18 +188,38 @@ def address_to_string( if count < 1: raise ValueError("Count must be greater than 0") + encodings = {"utf8": 1, "utf16": 2, "utf32": 4} + if encoding not in encodings: + raise ValueError( + f"Encoding ({encoding} is invalid. Must be one of {[e for e in encodings]}." + ) + layer = context.layers[layer_name] - # Purposely do not catch exception - data = layer.read(address, count) + data = gather_contiguous_bytes_from_address(layer, address, count) - decoded_data = data.decode(encoding=encoding, errors=errors) - try: - idx = re.search("\ufffd|\x00", decoded_data).start() - except AttributeError: - idx = len(decoded_data) + # we need to find the ending nulls, which the amount of nulls varies based on encoding + ending_nulls = b"\x00" * encodings[encoding] - return decoded_data[:idx] + end_idx = data.find(ending_nulls) + # send back the bytes even if the ending nulls aren't found (can be on the next page) + if end_idx == -1: + return data + + # cut at the nulls + data = data[:end_idx] + + # For utf16 and utf32, just looking for the nulls cuts the final null from the string when its ascii characters + # This occurs as the string 'vol.py' in utf-16 will look like this, with two ending nulls: + # "v\x00o\x00l\x00.\x00p\x00y\x00\x00\x00" + # By cutting at the first \x00\x00, we are taking the second byte of the character for 'y' + # With real unicode strings this character can be non-zero + # This check and added null, pads out the last byte(s) to the width of each character to avoid this issue + end_size = len(ending_nulls) + if len(data) > end_size and len(data) % end_size != 0: + data += b"\x00" * (end_size - (len(data) % end_size)) + + return data.decode(encoding=encoding, errors=errors) def array_of_pointers( From 36b3c2885974e7c697a160bfc8820800e680286b Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 03:12:06 +0000 Subject: [PATCH 0809/1352] Update encodings --- volatility3/framework/objects/utility.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index a1ad4fdf5..13031e1f1 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -188,7 +188,14 @@ def address_to_string( if count < 1: raise ValueError("Count must be greater than 0") - encodings = {"utf8": 1, "utf16": 2, "utf32": 4} + encodings = { + "utf-8": 1, + "utf8": 1, + "utf-16": 2, + "utf16": 2, + "utf32": 4, + "utf-32": 4, + } if encoding not in encodings: raise ValueError( f"Encoding ({encoding} is invalid. Must be one of {[e for e in encodings]}." From 4225adce56d1c73ff0194d944b948ad6befa2b87 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 16:32:54 +0000 Subject: [PATCH 0810/1352] Convert to .mapping and let Python had all encodings --- volatility3/framework/objects/utility.py | 131 ++++++++++------------- 1 file changed, 58 insertions(+), 73 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 13031e1f1..b014e37fa 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -2,6 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import re + from typing import Optional, Union from volatility3.framework import interfaces, objects, constants, exceptions @@ -101,7 +103,9 @@ def pointer_to_string( ) -def gather_contiguous_bytes_from_address(layer, address: int, count: int) -> bytes: +def gather_contiguous_bytes_from_address( + context, data_layer, starting_address: int, count: int +) -> bytes: """ This method reconstructs a string from memory while also carefully examining each page @@ -115,50 +119,65 @@ def gather_contiguous_bytes_from_address(layer, address: int, count: int) -> byt data = b"" - left_to_read = count + last_address = None - # read as many pages as possible that are contiguous - # if the first page is missed, we re-raise the InvalidAddressException - # if we have at least 1 page that was read succesfully, - # then we try to construct a string from it - while left_to_read > 0: - # compute aligned address of current page and next the page - aligned = address & ~0xFFF - next_page = aligned + 0xFFF + 1 + for address, length, _, _, _ in data_layer.mapping( + offset=starting_address, length=count, ignore_errors=True + ): + # Used to track when we hit a paged out page + if not last_address: + last_address = address + length - # all fits on the current page, last read - if address + left_to_read < next_page: - try: - data += layer.read(address, left_to_read) - except exceptions.InvalidAddressException: - # if we have data, just break the loop - if data: - break - # Raise if no data was read as this means the first page was invalid - else: - raise + # we hit a swapped out page + elif last_address and last_address != address: + break - left_to_read = 0 + data += data_layer.read(address, length) - else: - # how many bytes are left on the current page - len_to_read = next_page - address - - try: - data += layer.read(address, len_to_read) - except exceptions.InvalidAddressException: - if data: - break - # Raise if no data was read as this means the first page was invalid - else: - raise - - address += len_to_read - left_to_read -= len_to_read + # if we were able to read from the first page, we want to try and construct the string + # if the first page fails -> throw exception + if data: + return data + else: + raise exceptions.InvalidAddressException( + layer_name=data_layer, invalid_address=starting_address + ) return data +def bytes_to_decoded_string(data: bytes, encoding: str, errors: str) -> bytes: + """ + This function takes a bytes buffer that contains at a string of unknown + length starting at the first byte, and returns the properly decoded string + + It starts by using Python's `bytes.decode` to attempt to decode the entire string + It then finds the termination character (\ufffd or \x00) and splices the string + Finally, it returns this spliced string after its been decoded with the + caller-specified encoding + """ + # this is the standard byte used to replace bad unicode characters + unicode_replacement_char = "\ufffd" + + # used to find the terminating byte + termination_re = re.compile(f"{unicode_replacement_char}|\x00") + + # run over the entire string, letting Python replace invalid characters + full_decoded_string = data.decode(encoding=encoding, errors="replace") + + # stop at the first terminating character or get the whole string if not found + try: + idx = termination_re.search(full_decoded_string).start() + except AttributeError: + idx = len(full_decoded_string) + + # cut at terminating byte, if found + data = data[:idx] + + # return with caller-specified encoding and errors + return data.decode(encoding=encoding, errors=errors) + + def address_to_string( context: interfaces.context.ContextInterface, layer_name: str, @@ -188,45 +207,11 @@ def address_to_string( if count < 1: raise ValueError("Count must be greater than 0") - encodings = { - "utf-8": 1, - "utf8": 1, - "utf-16": 2, - "utf16": 2, - "utf32": 4, - "utf-32": 4, - } - if encoding not in encodings: - raise ValueError( - f"Encoding ({encoding} is invalid. Must be one of {[e for e in encodings]}." - ) - layer = context.layers[layer_name] - data = gather_contiguous_bytes_from_address(layer, address, count) + data = gather_contiguous_bytes_from_address(context, layer, address, count) - # we need to find the ending nulls, which the amount of nulls varies based on encoding - ending_nulls = b"\x00" * encodings[encoding] - - end_idx = data.find(ending_nulls) - # send back the bytes even if the ending nulls aren't found (can be on the next page) - if end_idx == -1: - return data - - # cut at the nulls - data = data[:end_idx] - - # For utf16 and utf32, just looking for the nulls cuts the final null from the string when its ascii characters - # This occurs as the string 'vol.py' in utf-16 will look like this, with two ending nulls: - # "v\x00o\x00l\x00.\x00p\x00y\x00\x00\x00" - # By cutting at the first \x00\x00, we are taking the second byte of the character for 'y' - # With real unicode strings this character can be non-zero - # This check and added null, pads out the last byte(s) to the width of each character to avoid this issue - end_size = len(ending_nulls) - if len(data) > end_size and len(data) % end_size != 0: - data += b"\x00" * (end_size - (len(data) % end_size)) - - return data.decode(encoding=encoding, errors=errors) + return bytes_to_decoded_string(data=data, errors=errors, encoding=encoding) def array_of_pointers( From 196bf8187dbb777f0ad43b2c9d18a0d9e069fe7d Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 14 Mar 2025 12:21:11 -0500 Subject: [PATCH 0811/1352] Volshell: Address comments from code review - Add failure message when readline or rlcompleter can't be imported - Fix unclosed file handle in context manager --- volatility3/cli/volshell/generic.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index c86e221f7..143e26500 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -90,7 +90,9 @@ class Volshell(interfaces.plugins.PluginInterface): readline.parse_and_bind("tab: complete") print("Readline imported successfully") except ImportError: - pass + print( + "Readline or rlcompleter module could not be imported. Tab completion will not be available." + ) # TODO: provide help, consider generic functions (pslist?) and/or providing windows/linux functions @@ -539,7 +541,9 @@ class Volshell(interfaces.plugins.PluginInterface): location = "file:" + request.pathname2url(location) print(f"Running code from {location}\n") accessor = resources.ResourceAccessor() - with io.TextIOWrapper(accessor.open(url=location), encoding="utf-8") as fp: + with accessor.open(url=location) as handle, io.TextIOWrapper( + handle, encoding="utf-8" + ) as fp: if has_ipython: self.__console.ex(fp.read()) else: From cf8bb3dfbc12897445220d24912a43bc1cea75ac Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 20:27:25 +0000 Subject: [PATCH 0812/1352] Adjust run_modules_scanners to avoid special handling of hidden modules, adjust modxview to new API, add classes and version requirements on module gathering interface --- .../framework/plugins/linux/check_idt.py | 7 +- .../plugins/linux/keyboard_notifiers.py | 7 +- .../framework/plugins/linux/kthreads.py | 7 +- .../framework/plugins/linux/modxview.py | 43 +-- .../framework/plugins/linux/tracing/ftrace.py | 16 +- .../plugins/linux/tracing/tracepoints.py | 13 +- .../framework/plugins/linux/tty_check.py | 7 +- .../symbols/linux/utilities/modules.py | 333 +++++++++--------- 8 files changed, 229 insertions(+), 204 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index 119531836..e199d98d3 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -35,6 +35,11 @@ class Check_idt(interfaces.plugins.PluginInterface): component=linux_utilities_modules.Modules, version=(3, 0, 0), ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), @@ -81,7 +86,7 @@ class Check_idt(interfaces.plugins.PluginInterface): known_modules = linux_utilities_modules.Modules.run_modules_scanners( context=self.context, kernel_module_name=self.config["kernel"], - caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, ) idt_table_size = 256 diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index b4f9dd3ca..215704350 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -31,6 +31,11 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): component=linux_utilities_modules.Modules, version=(3, 0, 0), ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), @@ -58,7 +63,7 @@ class Keyboard_notifiers(interfaces.plugins.PluginInterface): known_modules = linux_utilities_modules.Modules.run_modules_scanners( context=self.context, kernel_module_name=self.config["kernel"], - caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, ) knl = vmlinux.object( diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index 7d6abcecc..06e94b221 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -36,6 +36,11 @@ class Kthreads(plugins.PluginInterface): component=linux_utilities_modules.Modules, version=(3, 0, 0), ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) ), @@ -57,7 +62,7 @@ class Kthreads(plugins.PluginInterface): known_modules = linux_utilities_modules.Modules.run_modules_scanners( context=self.context, kernel_module_name=self.config["kernel"], - caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, ) for task in pslist.PsList.list_tasks( diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index e43672974..b04eb74ca 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -36,6 +36,11 @@ spot modules presence and taints.""" component=linux_utilities_modules.Modules, version=(3, 0, 0), ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) ), @@ -89,44 +94,42 @@ spot modules presence and taints.""" ) def _generator(self): - kernel_name = self.config["kernel"] + kernel = self.context.modules[self.config["kernel"]] - kernel = self.context.modules[kernel_name] - - wanted_sources = [ - linux_utilities_modules.Modules.source_lsmod_identifier, - linux_utilities_modules.Modules.source_sysfs_identifier, - linux_utilities_modules.Modules.source_hidden_identifier, + wanted_gatherers = [ + linux_utilities_modules.ModuleGathererLsmod, + linux_utilities_modules.ModuleGathererSysFs, + linux_utilities_modules.ModuleGathererScanner, ] run_results = linux_utilities_modules.Modules.run_modules_scanners( context=self.context, kernel_module_name=self.config["kernel"], - caller_wanted_sources=wanted_sources, + caller_wanted_gatherers=wanted_gatherers, flatten=False, ) aggregated_modules = {} # We want to be explicit on the plugins results we are interested in - for plugin_name in wanted_sources: + for gatherer in wanted_gatherers: # Iterate over each recovered module - for mod_info in run_results[plugin_name]: + for mod_info in run_results[gatherer]: # Use offsets as unique keys, whether a module # appears in many plugin runs or not if aggregated_modules.get(mod_info.offset, None) is not None: # Append the plugin to the list of originating plugins - aggregated_modules[mod_info.offset].append(plugin_name) + aggregated_modules[mod_info.offset].append(gatherer) else: - aggregated_modules[mod_info.offset] = [plugin_name] + aggregated_modules[mod_info.offset] = [gatherer] - for module_offset, originating_plugins in aggregated_modules.items(): - # Tainting parsing capabilities applied to the module + for module_offset, gatherers in aggregated_modules.items(): module = kernel.object("module", offset=module_offset, absolute=True) + # Tainting parsing capabilities applied to the module if self.config.get("plain_taints"): taints = tainting.Tainting.get_taints_as_plain_string( self.context, - kernel_name, + self.config["kernel"], module.taints, True, ) @@ -134,7 +137,7 @@ spot modules presence and taints.""" taints = ",".join( tainting.Tainting.get_taints_parsed( self.context, - kernel_name, + self.config["kernel"], module.taints, True, ) @@ -145,9 +148,9 @@ spot modules presence and taints.""" ( module.get_name() or NotAvailableValue(), format_hints.Hex(module_offset), - "lsmod" in originating_plugins, - "check_modules" in originating_plugins, - "hidden_modules" in originating_plugins, + linux_utilities_modules.ModuleGathererLsmod in gatherers, + linux_utilities_modules.ModuleGathererSysFs in gatherers, + linux_utilities_modules.ModuleGathererScanner in gatherers, taints or NotAvailableValue(), ), ) @@ -158,7 +161,7 @@ spot modules presence and taints.""" ("Address", format_hints.Hex), ("In procfs", bool), ("In sysfs", bool), - ("Hidden", bool), + ("In scan", bool), ("Taints", str), ] diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index 146230f02..c5e4f9ef8 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -5,7 +5,7 @@ # Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf import logging -from typing import Dict, List, Generator +from typing import List, Generator from enum import Enum from dataclasses import dataclass @@ -65,7 +65,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): Investigate the ftrace infrastructure to uncover kernel attached callbacks, which can be leveraged to hook kernel functions and modify their behaviour.""" - _version = (3, 0, 0) + _version = (4, 0, 0) _required_framework_version = (2, 19, 0) @classmethod @@ -81,6 +81,11 @@ class CheckFtrace(interfaces.plugins.PluginInterface): component=linux_utilities_modules.Modules, version=(3, 0, 0), ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), requirements.BooleanRequirement( name="show_ftrace_flags", description="Show ftrace flags associated with an ftrace_ops struct", @@ -127,9 +132,8 @@ class CheckFtrace(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, kernel_module_name: str, - known_modules: Dict[str, List[linux_utilities_modules.Modules.ModuleInfo]], + known_modules: List[linux_utilities_modules.ModuleInfo], ftrace_ops: interfaces.objects.ObjectInterface, - run_hidden_modules: bool = True, ) -> Generator[ParsedFtraceOps, None, None]: """Parse an ftrace_ops struct to highlight ftrace kernel hooking. Iterates over embedded ftrace_func_entry entries, which point to hooked memory areas. @@ -137,8 +141,6 @@ class CheckFtrace(interfaces.plugins.PluginInterface): Args: known_modules: A dict of known modules, used to locate callbacks origin. Typically obtained through run_modules_scanners(). ftrace_ops: The ftrace_ops struct to parse - run_hidden_modules: Whether to run the hidden_modules plugin or not. Note: it won't be run, even if specified, \ - if the "hidden_modules" key is present in known_modules. Yields: An iterable of ParsedFtraceOps dataclasses, containing a selection of useful fields (callback, hook, module) related to an ftrace_ops struct @@ -225,7 +227,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): known_modules = linux_utilities_modules.Modules.run_modules_scanners( context=self.context, kernel_module_name=self.config["kernel"], - caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, ) for ftrace_ops in self.iterate_ftrace_ops_list(self.context, kernel_name): diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 83903b19b..9d4a4a2e3 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -5,7 +5,7 @@ # Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf import logging -from typing import Dict, Iterable, List, Optional +from typing import Iterable, List, Optional from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules @@ -38,7 +38,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): Investigate the tracepoints subsystem to uncover kernel attached probes, which can be leveraged to hook kernel functions and modify their behaviour.""" - _version = (1, 0, 0) + _version = (2, 0, 0) _required_framework_version = (2, 19, 0) @classmethod @@ -54,6 +54,11 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): component=linux_utilities_modules.Modules, version=(3, 0, 0), ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), ] @classmethod @@ -96,7 +101,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, kernel_module_name: str, - known_modules: Dict[str, List[linux_utilities_modules.Modules.ModuleInfo]], + known_modules: List[linux_utilities_modules.ModuleInfo], tracepoint: interfaces.objects.ObjectInterface, run_hidden_modules: bool = True, ) -> Optional[Iterable[ParsedTracepointFunc]]: @@ -231,7 +236,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): known_modules = linux_utilities_modules.Modules.run_modules_scanners( context=self.context, kernel_module_name=self.config["kernel"], - caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, ) tracepoints = self.iterate_tracepoints_array(self.context, kernel_name) diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index f4b581756..7d30b84ee 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -34,6 +34,11 @@ class tty_check(plugins.PluginInterface): component=linux_utilities_modules.Modules, version=(3, 0, 0), ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), @@ -57,7 +62,7 @@ class tty_check(plugins.PluginInterface): known_modules = linux_utilities_modules.Modules.run_modules_scanners( context=self.context, kernel_module_name=self.config["kernel"], - caller_wanted_sources=linux_utilities_modules.Modules.all_sources_identifier, + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, ) for tty in tty_drivers.to_list( diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index dac52dce3..a930bef20 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -1,6 +1,18 @@ import logging import warnings -from typing import Iterable, Iterator, List, Optional, Tuple, NamedTuple, Dict, Set +from typing import ( + Iterable, + Iterator, + List, + Optional, + Tuple, + NamedTuple, + Dict, + Set, + Generator, + Union, +) +from abc import ABCMeta, abstractmethod from volatility3 import framework from volatility3.framework import ( @@ -10,12 +22,44 @@ from volatility3.framework import ( exceptions, objects, ) + from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions vollog = logging.getLogger(__name__) +class ModuleInfo(NamedTuple): + """ + Used to track the name and boundary of a kernel module + """ + + offset: int + name: str + start: int + end: int + + +class ModuleGathererInterface( + interfaces.configuration.VersionableInterface, metaclass=ABCMeta +): + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + framework.require_interface_version(*_required_framework_version) + + gatherer_return_type = Generator[Union[ModuleInfo, "extensions.module"], None, None] + + @classmethod + @abstractmethod + def gather_modules( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str + ) -> gatherer_return_type: + """ + This method must return a generator (yield) of each `gatherer_return_type` found from its source + """ + + class Modules(interfaces.configuration.VersionableInterface): """Kernel modules related utilities.""" @@ -24,31 +68,6 @@ class Modules(interfaces.configuration.VersionableInterface): framework.require_interface_version(*_required_framework_version) - # Valid sources of kernel modules to send to `run_module_scanners` - source_kernel_identifier = "kernel" - source_lsmod_identifier = "lsmod" - source_sysfs_identifier = "check_modules" - source_hidden_identifier = "hidden_modules" - - # With few exceptions, rootkit checking plugins want all sources - # This provides a stable identifier as new sources are added over time - all_sources_identifier = [ - source_kernel_identifier, - source_lsmod_identifier, - source_sysfs_identifier, - source_hidden_identifier, - ] - - class ModuleInfo(NamedTuple): - """ - Used to track the name and boundary of a kernel module - """ - - offset: int - name: str - start: int - end: int - @classmethod def module_lookup_by_address( cls, @@ -204,138 +223,41 @@ class Modules(interfaces.configuration.VersionableInterface): end = start + module.get_core_size() - return Modules.ModuleInfo(module.vol.offset, mod_name, start, end) - - @staticmethod - def get_kernel_module_info( - context: interfaces.context.ContextInterface, - kernel_module_name: str, - ) -> Iterator[ModuleInfo]: - """ - Returns a ModuleInfo instance that encodes the kernel - This is required to map function pointers to the kerenl executable - """ - kernel = context.modules[kernel_module_name] - - address_mask = context.layers[kernel.layer_name].address_mask - - start_addr = kernel.object_from_symbol("_text") - start_addr = start_addr.vol.offset & address_mask - - end_addr = kernel.object_from_symbol("_etext") - end_addr = end_addr.vol.offset & address_mask - - return [ - Modules.ModuleInfo( - start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr - ) - ] + return ModuleInfo(module.vol.offset, mod_name, start, end) @classmethod - def _get_hidden_modules_results( - cls, - context: str, - kernel_module_name: str, - run_results: Dict[str, List[ModuleInfo]], - ): - known_modules_addresses = set() - - kernel = context.modules[kernel_module_name] - - # Walk each sources' results - for results in run_results.values(): - for modinfo in results: - address = context.layers[kernel.layer_name].canonicalize(modinfo.start) - known_modules_addresses.add(address) - - modules_memory_boundaries = cls.get_modules_memory_boundaries( - context, kernel_module_name - ) - - hidden_results = [] - - address_mask = context.layers[kernel.layer_name].address_mask - - for module in cls.get_hidden_modules( - context, - kernel_module_name, - known_modules_addresses, - modules_memory_boundaries, - ): - modinfo = cls.get_module_info_for_module(address_mask, module) - if modinfo: - hidden_results.append(modinfo) - - return hidden_results - - @classmethod - def _get_list_modules( - cls, context: interfaces.context.ContextInterface, kernel_module_name: str - ) -> List[ModuleInfo]: + def _validate_gatherers(cls, caller_wanted_gatherers) -> List[str]: """ - Gather `module` instances from lsmod + Called by `run_modules_scanners` to validate the caller supplied gatherers list + An exception is thrown if an empty gatherers list is given or a list containing an invalid source """ - yield from cls.list_modules(context, kernel_module_name) - - @classmethod - def _get_sysfs_modules( - cls, context: interfaces.context.ContextInterface, kernel_module_name: str - ) -> List[ModuleInfo]: - """ - Gather the `module` instances from sysfs - """ - kernel = context.modules[kernel_module_name] - - sysfs_modules: dict = cls.get_kset_modules(context, kernel_module_name) - - for m_offset in sysfs_modules.values(): - yield kernel.object(object_type="module", offset=m_offset, absolute=True) - - @classmethod - def _validated_sources(cls, caller_wanted_sources) -> List[str]: - """ - Called by `run_modules_scanners` to validate the caller supplied sources list - An exception is thrown if an empty source list is given or a list containing an invalid source - """ - if not caller_wanted_sources: - raise ValueError("`caller_wanted_sources` must have at least one source.") - - if ( - len(caller_wanted_sources) == 1 - and caller_wanted_sources[0] == Modules.source_hidden_identifier - ): + if not caller_wanted_gatherers: raise ValueError( - f"{Modules.source_hidden_identifier} cannot be the only source or there is nothing to compare against." + "`caller_wanted_gatherers` must have at least one gatherer." ) - wanted_sources = [] - - for source in caller_wanted_sources: - if source not in Modules.all_sources_identifier: + for gatherer in caller_wanted_gatherers: + if gatherer not in ModuleGatherers.all_gatherers_identifier: raise ValueError( - f"Invalid source sent through `caller_wanted_sources`: {source}" + f"Invalid gatherer sent through `caller_wanted_gatherers`: {gatherer}" ) - wanted_sources.append(source) - - return wanted_sources - @classmethod def run_modules_scanners( cls, context: interfaces.context.ContextInterface, kernel_module_name: str, - caller_wanted_sources: List[str], + caller_wanted_gatherers: List[ModuleGathererInterface], flatten: bool = True, - ) -> Dict[str, List[ModuleInfo]]: + ) -> Dict[ModuleGathererInterface, List[ModuleInfo]]: """Run module scanning plugins and aggregate the results. It is designed to not operate any inter-plugin results triage. Rules for `caller_wanted_sources`: - If `Modules.all_sources_identifier` is specified then every source will be populated + If `ModuleGathers.all_gathers_identifier` is specified then every source will be populated - If `Modules.source_hidden_identifier` is in the list, then at least one other sources must be + If `ModuleGathers.Scanner` is in the list, then at least one other sources must be specified so a comparison will be populated If empty or an invalid source is specified then a ValueError is thrown @@ -346,52 +268,30 @@ class Modules(interfaces.configuration.VersionableInterface): Returns: Dictionary mapping each plugin to its corresponding result """ - - module_gatherers = { - Modules.source_kernel_identifier: cls.get_kernel_module_info, - Modules.source_lsmod_identifier: cls._get_list_modules, - Modules.source_sysfs_identifier: cls._get_sysfs_modules, - } + # Throws ValueError if invalid gatherers sent in + Modules._validate_gatherers(caller_wanted_gatherers) kernel = context.modules[kernel_module_name] address_mask = context.layers[kernel.layer_name].address_mask - wanted_sources = Modules._validated_sources(caller_wanted_sources) + run_results: Dict[ModuleGathererInterface, List[ModuleInfo]] = {} - run_results = {} - - run_hidden_modules = False - - # Special case hidden modules since it gathers modules on its own - if Modules.source_hidden_identifier in wanted_sources: - run_hidden_modules = True - wanted_sources.remove(Modules.source_hidden_identifier) - - # Walk each source, gathering modules - for wanted_source in wanted_sources: - run_results[wanted_source] = [] - - gatherer = module_gatherers[wanted_source] + # Walk each source gathering modules + for gatherer in caller_wanted_gatherers: + run_results[gatherer] = [] # process each module coming from back the current source - for module in gatherer(context, kernel_module_name): + for module in gatherer.gather_modules(context, kernel_module_name): + # the kernel sends back a ModuleInfo directly - if wanted_source == Modules.source_kernel_identifier: + if gatherer == ModuleGathererKernel: modinfo = module else: modinfo = cls.get_module_info_for_module(address_mask, module) if modinfo: - run_results[wanted_source].append(modinfo) - - # run hidden modules against the other sources - if run_hidden_modules: - run_results[Modules.source_hidden_identifier] = ( - cls._get_hidden_modules_results( - context, kernel_module_name, run_results - ) - ) + run_results[gatherer].append(modinfo) if flatten: return cls.flatten_run_modules_results(run_results) @@ -449,7 +349,7 @@ class Modules(interfaces.configuration.VersionableInterface): Returns: List of ModuleInfo objects """ - uniq_modules: List[Modules.ModuleInfo] = [] + uniq_modules: List[ModuleInfo] = [] seen_addresses: int = set() @@ -645,3 +545,98 @@ class Modules(interfaces.configuration.VersionableInterface): True if all the addresses meet the alignment """ return all(addr % address_alignment == 0 for addr in addresses) + + +class ModuleGathererLsmod(ModuleGathererInterface): + """ + Gathers modules from the main kernel list + """ + + @classmethod + def gather_modules( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str + ) -> ModuleGathererInterface.gatherer_return_type: + yield from Modules.list_modules(context, kernel_module_name) + + +class ModuleGathererSysFs(ModuleGathererInterface): + """ + Gathers modules from the sysfs /sys/modules objects + """ + + @classmethod + def gather_modules( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str + ) -> ModuleGathererInterface.gatherer_return_type: + kernel = context.modules[kernel_module_name] + + sysfs_modules: dict = Modules.get_kset_modules(context, kernel_module_name) + + for m_offset in sysfs_modules.values(): + yield kernel.object(object_type="module", offset=m_offset, absolute=True) + + +class ModuleGathererScanner(ModuleGathererInterface): + """ + Gathers modules by scanning memory + """ + + @classmethod + def gather_modules( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str + ) -> ModuleGathererInterface.gatherer_return_type: + modules_memory_boundaries = Modules.get_modules_memory_boundaries( + context, kernel_module_name + ) + + # Send in an empty list to not filter on any modules + yield from Modules.get_hidden_modules( + context=context, + vmlinux_module_name=kernel_module_name, + known_module_addresses=[], + modules_memory_boundaries=modules_memory_boundaries, + ) + + +class ModuleGathererKernel(ModuleGathererInterface): + """ + Creates a ModuleInfo instance for the kernel so that plugins + can determine when function pointers reference the kernel + """ + + @classmethod + def gather_modules( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str + ) -> ModuleGathererInterface.gatherer_return_type: + """ + Returns a ModuleInfo instance that encodes the kernel + This is required to map function pointers to the kerenl executable + """ + kernel = context.modules[kernel_module_name] + + address_mask = context.layers[kernel.layer_name].address_mask + + start_addr = kernel.object_from_symbol("_text") + start_addr = start_addr.vol.offset & address_mask + + end_addr = kernel.object_from_symbol("_etext") + end_addr = end_addr.vol.offset & address_mask + + yield ModuleInfo(start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr) + + +class ModuleGatherers(interfaces.configuration.VersionableInterface): + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + framework.require_interface_version(*_required_framework_version) + + # Valid sources of cores kernel module gatherers to send to `run_module_scanners` + # With few exceptions, rootkit checking plugins want all sources + # This provides a stable identifier as new sources are added over time + all_gatherers_identifier = [ + ModuleGathererLsmod, + ModuleGathererSysFs, + ModuleGathererScanner, + ModuleGathererKernel, + ] From 2e93b8ed0982de47d0745975fb516b1b580f84b2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 20:43:12 +0000 Subject: [PATCH 0813/1352] Prevent CodeQL from losing its mind. Properly checking for instances of the interface --- .../symbols/linux/utilities/modules.py | 33 ++++++++----------- 1 file changed, 14 insertions(+), 19 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index a930bef20..ee48ebc28 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -225,23 +225,6 @@ class Modules(interfaces.configuration.VersionableInterface): return ModuleInfo(module.vol.offset, mod_name, start, end) - @classmethod - def _validate_gatherers(cls, caller_wanted_gatherers) -> List[str]: - """ - Called by `run_modules_scanners` to validate the caller supplied gatherers list - An exception is thrown if an empty gatherers list is given or a list containing an invalid source - """ - if not caller_wanted_gatherers: - raise ValueError( - "`caller_wanted_gatherers` must have at least one gatherer." - ) - - for gatherer in caller_wanted_gatherers: - if gatherer not in ModuleGatherers.all_gatherers_identifier: - raise ValueError( - f"Invalid gatherer sent through `caller_wanted_gatherers`: {gatherer}" - ) - @classmethod def run_modules_scanners( cls, @@ -268,8 +251,20 @@ class Modules(interfaces.configuration.VersionableInterface): Returns: Dictionary mapping each plugin to its corresponding result """ - # Throws ValueError if invalid gatherers sent in - Modules._validate_gatherers(caller_wanted_gatherers) + if not caller_wanted_gatherers: + raise ValueError( + "`caller_wanted_gatherers` must have at least one gatherer." + ) + + if not isinstance(caller_wanted_gatherers, Iterable): + raise ValueError("`caller_wanted_gatherers` must be iterable") + + for gatherer in caller_wanted_gatherers: + if not issubclass(gatherer, ModuleGathererInterface): + raise ValueError( + f"Invalid gatherer sent through `caller_wanted_gatherers`: {gatherer}" + ) + kernel = context.modules[kernel_module_name] From f5ae7928a300e1eeec2c19fd67b9d7d883a9d2e1 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 20:45:14 +0000 Subject: [PATCH 0814/1352] Black fix --- volatility3/framework/symbols/linux/utilities/modules.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index ee48ebc28..c3700ae60 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -265,7 +265,6 @@ class Modules(interfaces.configuration.VersionableInterface): f"Invalid gatherer sent through `caller_wanted_gatherers`: {gatherer}" ) - kernel = context.modules[kernel_module_name] address_mask = context.layers[kernel.layer_name].address_mask From f38ddaf7155dce6c9171ad052bbfb6db0c9be3a8 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 20:53:02 +0000 Subject: [PATCH 0815/1352] Fix string scanning code --- volatility3/framework/objects/utility.py | 30 ++++++++++++++---------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index b014e37fa..f1ee701bf 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -119,20 +119,26 @@ def gather_contiguous_bytes_from_address( data = b"" - last_address = None + if isinstance(data_layer, interfaces.layers.TranslationLayerInterface): + last_address = None + + for address, length, _, _, _ in data_layer.mapping( + offset=starting_address, length=count, ignore_errors=True + ): + # Used to track when we hit a paged out page + if not last_address: + last_address = address + length + + # we hit a swapped out page + elif last_address and last_address != address: + break + + data += data_layer.read(address, length) - for address, length, _, _, _ in data_layer.mapping( - offset=starting_address, length=count, ignore_errors=True - ): - # Used to track when we hit a paged out page - if not last_address: last_address = address + length - # we hit a swapped out page - elif last_address and last_address != address: - break - - data += data_layer.read(address, length) + elif starting_address + count < data_layer.maximum_address: + data = data_layer.read(starting_address, count) # if we were able to read from the first page, we want to try and construct the string # if the first page fails -> throw exception @@ -143,8 +149,6 @@ def gather_contiguous_bytes_from_address( layer_name=data_layer, invalid_address=starting_address ) - return data - def bytes_to_decoded_string(data: bytes, encoding: str, errors: str) -> bytes: """ From bb0a17004f004b6eac4113a3e9377acdc4bc6e6c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 20:59:15 +0000 Subject: [PATCH 0816/1352] Add return_truncated for plugin-specified handling of truncated strings --- volatility3/framework/objects/utility.py | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index f1ee701bf..a29b65875 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -150,8 +150,19 @@ def gather_contiguous_bytes_from_address( ) -def bytes_to_decoded_string(data: bytes, encoding: str, errors: str) -> bytes: +def bytes_to_decoded_string( + data: bytes, encoding: str, errors: str, return_truncated: bool = True +) -> bytes: """ + Args: + data: The `bytes` buffer containing the string of a string at offset 0 + encoding: An encoding value for the encoding paramater of `bytes.decode` + errors: An errors value for the errors parameter of `bytes.decode` + return_truncated: Dictates whether truncated strings should be returned or + if a ValueError should be thrown if a truncated (broken) string was decoded + Returns: + bytes: The decoded string starting at offset of data + This function takes a bytes buffer that contains at a string of unknown length starting at the first byte, and returns the properly decoded string @@ -173,7 +184,12 @@ def bytes_to_decoded_string(data: bytes, encoding: str, errors: str) -> bytes: try: idx = termination_re.search(full_decoded_string).start() except AttributeError: - idx = len(full_decoded_string) + if return_truncated: + idx = len(full_decoded_string) + else: + raise ValueError( + "return_truncated set to False and truncated string decoded." + ) # cut at terminating byte, if found data = data[:idx] From a0f3cba6f6d71648a4feb884502491b773815255 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 21:08:15 +0000 Subject: [PATCH 0817/1352] Fix stale comments --- volatility3/framework/symbols/linux/utilities/modules.py | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index c3700ae60..957d7b5b4 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -237,14 +237,9 @@ class Modules(interfaces.configuration.VersionableInterface): to not operate any inter-plugin results triage. Rules for `caller_wanted_sources`: - - If `ModuleGathers.all_gathers_identifier` is specified then every source will be populated - - If `ModuleGathers.Scanner` is in the list, then at least one other sources must be - specified so a comparison will be populated + If `ModuleGatherers.all_gathers_identifier` is specified then every source will be populated If empty or an invalid source is specified then a ValueError is thrown - Args: called_wanted_sources: The list of sources to gather modules. flatten: Whether to de-duplicate modules across sources From b2ec21fcf28e657f42f178c27c144af7d1d7893e Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 21:15:03 +0000 Subject: [PATCH 0818/1352] Simplify last_address handling --- volatility3/framework/objects/utility.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index a29b65875..018b4a138 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -120,17 +120,13 @@ def gather_contiguous_bytes_from_address( data = b"" if isinstance(data_layer, interfaces.layers.TranslationLayerInterface): - last_address = None + last_address = starting_address for address, length, _, _, _ in data_layer.mapping( offset=starting_address, length=count, ignore_errors=True ): - # Used to track when we hit a paged out page - if not last_address: - last_address = address + length - # we hit a swapped out page - elif last_address and last_address != address: + if last_address != address: break data += data_layer.read(address, length) From 53e32e36f6128fa3ec53e77f3e7fb859cbc1d173 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 14 Mar 2025 22:34:06 +0000 Subject: [PATCH 0819/1352] Add versioning on gatherers, make check non-specific to kernel gatherer, add requirements to ModuleGatherers --- .../symbols/linux/utilities/modules.py | 40 ++++++++++++++++++- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 957d7b5b4..70b45fbd9 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -23,6 +23,7 @@ from volatility3.framework import ( objects, ) +from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions @@ -274,7 +275,7 @@ class Modules(interfaces.configuration.VersionableInterface): for module in gatherer.gather_modules(context, kernel_module_name): # the kernel sends back a ModuleInfo directly - if gatherer == ModuleGathererKernel: + if isinstance(module, ModuleInfo): modinfo = module else: modinfo = cls.get_module_info_for_module(address_mask, module) @@ -541,6 +542,10 @@ class ModuleGathererLsmod(ModuleGathererInterface): Gathers modules from the main kernel list """ + _version = (1, 0, 0) + + name = "Lsmod" + @classmethod def gather_modules( cls, context: interfaces.context.ContextInterface, kernel_module_name: str @@ -553,6 +558,10 @@ class ModuleGathererSysFs(ModuleGathererInterface): Gathers modules from the sysfs /sys/modules objects """ + _version = (1, 0, 0) + + name = "SysFs" + @classmethod def gather_modules( cls, context: interfaces.context.ContextInterface, kernel_module_name: str @@ -570,6 +579,10 @@ class ModuleGathererScanner(ModuleGathererInterface): Gathers modules by scanning memory """ + _version = (1, 0, 0) + + name = "Scanner" + @classmethod def gather_modules( cls, context: interfaces.context.ContextInterface, kernel_module_name: str @@ -593,6 +606,10 @@ class ModuleGathererKernel(ModuleGathererInterface): can determine when function pointers reference the kernel """ + _version = (1, 0, 0) + + name = "kernel" + @classmethod def gather_modules( cls, context: interfaces.context.ContextInterface, kernel_module_name: str @@ -614,7 +631,10 @@ class ModuleGathererKernel(ModuleGathererInterface): yield ModuleInfo(start_addr, constants.linux.KERNEL_NAME, start_addr, end_addr) -class ModuleGatherers(interfaces.configuration.VersionableInterface): +class ModuleGatherers( + interfaces.configuration.VersionableInterface, + interfaces.configuration.ConfigurableInterface, +): _version = (1, 0, 0) _required_framework_version = (2, 0, 0) @@ -629,3 +649,19 @@ class ModuleGatherers(interfaces.configuration.VersionableInterface): ModuleGathererScanner, ModuleGathererKernel, ] + + @classmethod + def get_requirements(cls): + reqs = [] + + # for now, all versions are 1, this will be broken out if/when that changes + for gatherer in ModuleGatherers.all_gatherers_identifier: + reqs.append( + requirements.VersionRequirement( + name=gatherer.name.replace(" ", ""), + component=gatherer, + version=(1, 0, 0), + ) + ) + + return reqs From 674cc045d21694647857f9d47ca3ff94f49a8c51 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Mar 2025 17:22:31 +0000 Subject: [PATCH 0820/1352] Update to using str dictionary key. Add requirements for each gatherer in modxview. Validate names are unique while sanity checking. --- .../framework/plugins/linux/modxview.py | 24 ++++++++++----- .../symbols/linux/utilities/modules.py | 30 ++++++++++++++----- 2 files changed, 40 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index b04eb74ca..cf31a3a33 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -38,7 +38,17 @@ spot modules presence and taints.""" ), requirements.VersionRequirement( name="linux_utilities_module_gatherers", - component=linux_utilities_modules.ModuleGatherers, + component=linux_utilities_modules.ModuleGathererLsmod, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGathererSysFs, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGathererScanner, version=(1, 0, 0), ), requirements.VersionRequirement( @@ -113,14 +123,14 @@ spot modules presence and taints.""" # We want to be explicit on the plugins results we are interested in for gatherer in wanted_gatherers: # Iterate over each recovered module - for mod_info in run_results[gatherer]: + for mod_info in run_results[gatherer.name]: # Use offsets as unique keys, whether a module # appears in many plugin runs or not if aggregated_modules.get(mod_info.offset, None) is not None: # Append the plugin to the list of originating plugins - aggregated_modules[mod_info.offset].append(gatherer) + aggregated_modules[mod_info.offset].append(gatherer.name) else: - aggregated_modules[mod_info.offset] = [gatherer] + aggregated_modules[mod_info.offset] = [gatherer.name] for module_offset, gatherers in aggregated_modules.items(): module = kernel.object("module", offset=module_offset, absolute=True) @@ -148,9 +158,9 @@ spot modules presence and taints.""" ( module.get_name() or NotAvailableValue(), format_hints.Hex(module_offset), - linux_utilities_modules.ModuleGathererLsmod in gatherers, - linux_utilities_modules.ModuleGathererSysFs in gatherers, - linux_utilities_modules.ModuleGathererScanner in gatherers, + linux_utilities_modules.ModuleGathererLsmod.name in gatherers, + linux_utilities_modules.ModuleGathererSysFs.name in gatherers, + linux_utilities_modules.ModuleGathererScanner.name in gatherers, taints or NotAvailableValue(), ), ) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 70b45fbd9..eeee98a01 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -233,19 +233,21 @@ class Modules(interfaces.configuration.VersionableInterface): kernel_module_name: str, caller_wanted_gatherers: List[ModuleGathererInterface], flatten: bool = True, - ) -> Dict[ModuleGathererInterface, List[ModuleInfo]]: + ) -> Dict[str, List[ModuleInfo]]: """Run module scanning plugins and aggregate the results. It is designed to not operate any inter-plugin results triage. - Rules for `caller_wanted_sources`: + Rules for `caller_wanted_gatherers`: If `ModuleGatherers.all_gathers_identifier` is specified then every source will be populated - If empty or an invalid source is specified then a ValueError is thrown + If empty or an invalid gatherer is specified then a ValueError is thrown + + All gatherer names must be unique Args: called_wanted_sources: The list of sources to gather modules. - flatten: Whether to de-duplicate modules across sources + flatten: Whether to de-duplicate modules across gatherers Returns: - Dictionary mapping each plugin to its corresponding result + Dictionary mapping each gatherer to its corresponding result """ if not caller_wanted_gatherers: raise ValueError( @@ -255,12 +257,26 @@ class Modules(interfaces.configuration.VersionableInterface): if not isinstance(caller_wanted_gatherers, Iterable): raise ValueError("`caller_wanted_gatherers` must be iterable") + seen_names = set() + for gatherer in caller_wanted_gatherers: if not issubclass(gatherer, ModuleGathererInterface): raise ValueError( f"Invalid gatherer sent through `caller_wanted_gatherers`: {gatherer}" ) + if not hasattr(gatherer, "name"): + raise ValueError( + f"{gatherer} does not have a name attribute, which is required." + ) + + if gatherer.name in seen_names: + raise ValueError( + f"{gatherer} has a name {gatherer.name} which has already been processed. Names must be unique." + ) + + seen_names.add(gatherer.name) + kernel = context.modules[kernel_module_name] address_mask = context.layers[kernel.layer_name].address_mask @@ -269,7 +285,7 @@ class Modules(interfaces.configuration.VersionableInterface): # Walk each source gathering modules for gatherer in caller_wanted_gatherers: - run_results[gatherer] = [] + run_results[gatherer.name] = [] # process each module coming from back the current source for module in gatherer.gather_modules(context, kernel_module_name): @@ -281,7 +297,7 @@ class Modules(interfaces.configuration.VersionableInterface): modinfo = cls.get_module_info_for_module(address_mask, module) if modinfo: - run_results[gatherer].append(modinfo) + run_results[gatherer.name].append(modinfo) if flatten: return cls.flatten_run_modules_results(run_results) From 0f5dd10aa9ba8370c8153dd6d36fb600dd03f888 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Mar 2025 13:23:01 -0500 Subject: [PATCH 0821/1352] Apply suggestions from code review Co-authored-by: ikelos --- volatility3/framework/plugins/linux/modxview.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index cf31a3a33..ed21acfd1 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -37,17 +37,17 @@ spot modules presence and taints.""" version=(3, 0, 0), ), requirements.VersionRequirement( - name="linux_utilities_module_gatherers", + name="linux_utilities_module_gatherer_lsmod", component=linux_utilities_modules.ModuleGathererLsmod, version=(1, 0, 0), ), requirements.VersionRequirement( - name="linux_utilities_module_gatherers", + name="linux_utilities_module_gatherer_sysfs", component=linux_utilities_modules.ModuleGathererSysFs, version=(1, 0, 0), ), requirements.VersionRequirement( - name="linux_utilities_module_gatherers", + name="linux_utilities_module_gatherer_scanner", component=linux_utilities_modules.ModuleGathererScanner, version=(1, 0, 0), ), From e79f03691a1aa84afa3e2a1fe5fc9746709a5d70 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Mar 2025 19:01:52 +0000 Subject: [PATCH 0822/1352] Add name to interface and validate it in processing loop --- volatility3/framework/symbols/linux/utilities/modules.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index eeee98a01..b711f4e2c 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -51,6 +51,9 @@ class ModuleGathererInterface( gatherer_return_type = Generator[Union[ModuleInfo, "extensions.module"], None, None] + # Must be set to a unique, descriptive name of the gathering technique or data structure source + name = None + @classmethod @abstractmethod def gather_modules( @@ -265,9 +268,9 @@ class Modules(interfaces.configuration.VersionableInterface): f"Invalid gatherer sent through `caller_wanted_gatherers`: {gatherer}" ) - if not hasattr(gatherer, "name"): + if gatherer.name is None or len(gatherer.name) == 0: raise ValueError( - f"{gatherer} does not have a name attribute, which is required." + f"{gatherer} does not have a valid name attribute, which is required. It must be a non-zero length string." ) if gatherer.name in seen_names: From 9da147df1b6b79a5c9ab0a67ed3593829bb6c598 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Mar 2025 19:10:00 +0000 Subject: [PATCH 0823/1352] simplify check --- volatility3/framework/symbols/linux/utilities/modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index b711f4e2c..52dfe77e4 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -268,7 +268,7 @@ class Modules(interfaces.configuration.VersionableInterface): f"Invalid gatherer sent through `caller_wanted_gatherers`: {gatherer}" ) - if gatherer.name is None or len(gatherer.name) == 0: + if not gatherer.name: raise ValueError( f"{gatherer} does not have a valid name attribute, which is required. It must be a non-zero length string." ) From 9550db82a99d8ac5220048605152092ee92db0cd Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Mar 2025 20:31:01 +0000 Subject: [PATCH 0824/1352] Bump the ruff action --- .github/workflows/ruff.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ruff.yaml b/.github/workflows/ruff.yaml index 77e3aa864..98a05a616 100644 --- a/.github/workflows/ruff.yaml +++ b/.github/workflows/ruff.yaml @@ -9,7 +9,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: astral-sh/ruff-action@v1 + - uses: astral-sh/ruff-action@v3.2.1 with: args: check src: "." From fbb4003a3224a6fc24f0a872b0b4253d778697c3 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Mar 2025 20:59:14 +0000 Subject: [PATCH 0827/1352] Fix broken truncation from Vol3 bytes to string conversion --- volatility3/framework/objects/utility.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 018b4a138..473c5a349 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -188,7 +188,7 @@ def bytes_to_decoded_string( ) # cut at terminating byte, if found - data = data[:idx] + data = bytes(full_decoded_string[:idx], encoding=encoding) # return with caller-specified encoding and errors return data.decode(encoding=encoding, errors=errors) From 2d2228b06e89bc08ae53aba05059488327ad5ec2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Mar 2025 21:25:39 +0000 Subject: [PATCH 0828/1352] Fix signature --- volatility3/framework/objects/utility.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 473c5a349..57d1bca4c 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -105,7 +105,7 @@ def pointer_to_string( def gather_contiguous_bytes_from_address( context, data_layer, starting_address: int, count: int -) -> bytes: +) -> str: """ This method reconstructs a string from memory while also carefully examining each page From bad34a112aabfc4c7a0e3eb29f3d7716fa839faf Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sat, 15 Mar 2025 22:58:07 +0000 Subject: [PATCH 0829/1352] Add the windows plugin and associated extensions updates --- .../framework/plugins/windows/windows.py | 137 ++++++++++++ .../symbols/windows/extensions/gui.py | 199 +++++++++++++++++- .../windows/gui/gui-win10-10586-x64.json | 6 + .../windows/gui/gui-win10-15063-x64.json | 6 + .../windows/gui/gui-win10-16299-x64.json | 6 + .../windows/gui/gui-win10-17134-x64.json | 10 +- .../windows/gui/gui-win10-17735-x64.json | 10 +- .../windows/gui/gui-win10-17763-x64.json | 10 +- .../windows/gui/gui-win10-18362-x64.json | 10 +- .../windows/gui/gui-win10-19041-x64.json | 10 +- .../windows/gui/gui-win10-19577-x64.json | 10 +- .../symbols/windows/gui/gui-win7sp0-x64.json | 6 + .../symbols/windows/gui/gui-win7sp1-x64.json | 6 + .../symbols/windows/gui/gui-win8-x64.json | 6 + 14 files changed, 418 insertions(+), 14 deletions(-) create mode 100644 volatility3/framework/plugins/windows/windows.py diff --git a/volatility3/framework/plugins/windows/windows.py b/volatility3/framework/plugins/windows/windows.py new file mode 100644 index 000000000..5e3059e45 --- /dev/null +++ b/volatility3/framework/plugins/windows/windows.py @@ -0,0 +1,137 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List, Iterable + +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.objects import utility +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import windowstations + +vollog = logging.getLogger(__name__) + + +class Windows(interfaces.plugins.PluginInterface): + """Enumerates the Windows of Desktop instances""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="windowstations", + component=windowstations.WindowStations, + version=(1, 0, 0), + ), + ] + + @classmethod + def list_windows( + cls, + context: interfaces.context.ContextInterface, + config_path: str, + kernel_module_name: str, + ) -> Iterable[interfaces.objects.ObjectInterface]: + """ + Enumerates the desktops of each window station + For each found, enumerates its windows within the desktop + """ + kernel = context.modules[kernel_module_name] + + for ( + winsta, + station_name, + session_id, + ) in windowstations.WindowStations.scan_window_stations( + context, config_path, kernel_module_name + ): + # for each window station, walk its list of desktops + for desktop, desktop_name in winsta.desktops(kernel.symbol_table_name): + try: + top_window = desktop.pDeskInfo.spwnd + except exceptions.InvalidAddressException: + vollog.debug( + f"Desktop with name {desktop_name} in window station {station_name} has a broken window pointer." + ) + continue + + for window, window_name in desktop.windows(top_window): + yield station_name, desktop_name, window, window_name + + def _generator(self): + kernel_name = self.config["kernel"] + + # call the implementation for finding windows and gather attributes + for station_name, desktop_name, window, window_name in self.list_windows( + self.context, self.config_path, kernel_name + ): + # We need a valid process and session id for the window to display it + process = window.get_process() + process_name = None + if process: + try: + process_name = utility.array_to_string(process.ImageFileName) + process_pid = process.UniqueProcessId + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to read name and pid of the process for window {window.vol.offset:#x}" + ) + + if process_name is None: + vollog.warning( + f"Invalid process reference for the process hosting window {window.vol.offset:#x}" + ) + continue + + sess_id = window.get_session_id() + if sess_id is None: + vollog.debug( + f"Unable to read session id of the process for window {window.vol.offset:#x} in process {process_name}" + ) + continue + + # procedures can be empty, but if set, should be a valid pointer + window_proc = window.get_window_procedure() + if window_proc is None or window_proc == 0 or window_proc > 0x1000: + window_proc = format_hints.Hex(window_proc) + else: + vollog.warning( + f"Invalid window procedure for the window {window.vol.offset:#x}" + ) + continue + + yield 0, ( + format_hints.Hex(window.vol.offset), + station_name, + sess_id, + desktop_name, + window_name or renderers.NotAvailableValue(), + window_proc, + process_name, + process_pid, + ) + + def run(self): + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Station", str), + ("Session", int), + ("Desktop", str), + ("Window", str), + ("Procedure", format_hints.Hex), + ("Process", str), + ("PID", int), + ], + self._generator(), + ) diff --git a/volatility3/framework/symbols/windows/extensions/gui.py b/volatility3/framework/symbols/windows/extensions/gui.py index 92693dba5..559fda095 100644 --- a/volatility3/framework/symbols/windows/extensions/gui.py +++ b/volatility3/framework/symbols/windows/extensions/gui.py @@ -2,13 +2,17 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Optional, Tuple, Iterator +import logging +from typing import Optional, Tuple, Iterator, Generator from volatility3.framework import exceptions, constants, interfaces from volatility3.framework import objects from volatility3.framework.objects import utility +from volatility3.framework.symbols.windows import extensions from volatility3.framework.symbols.windows.extensions import pool +vollog = logging.getLogger(__name__) + class tagWINDOWSTATION(objects.StructType, pool.ExecutiveObject): def is_valid(self) -> bool: @@ -77,7 +81,7 @@ class tagWINDOWSTATION(objects.StructType, pool.ExecutiveObject): class tagDESKTOP(objects.StructType, pool.ExecutiveObject): def is_valid(self) -> bool: """ - Enforce a valid sid + owning window station + Enforce a valid sid + name """ sid = self.get_session_id() @@ -89,12 +93,18 @@ class tagDESKTOP(objects.StructType, pool.ExecutiveObject): return False def get_window_station(self) -> Optional["tagWINDOWSTATION"]: + """ + Attempts to return the window station for this desktop + """ try: return self.rpwinstaParent.dereference() except exceptions.InvalidAddressException: return None def get_session_id(self) -> Optional[int]: + """ + Attempts to return the session ID for this desktop + """ winsta = self.get_window_station() if winsta: return winsta.get_session_id() @@ -120,8 +130,193 @@ class tagDESKTOP(objects.StructType, pool.ExecutiveObject): yield thread, process_name, process_pid + def _do_get_windows( + self, window, max_windows + ) -> Generator[Tuple[interfaces.objects.ObjectInterface, str], None, None]: + """ + Recusively walks and yields the adjacent and child windows + """ + seen_windows = set() + seen_children = set() + + if window.vol.offset == 0: + return + + yield window, window.get_name() + + seen_windows.add(window) + + # Walk adjacent windows + while len(seen_windows) < max_windows: + try: + window = window.spwndNext.dereference() + except exceptions.InvalidAddressException: + break + + if window.vol.offset == 0: + break + + if window.vol.offset in seen_windows: + break + + yield window, window.get_name() + + seen_windows.add(window) + + # Walk children windows and recursively yield them + for window in seen_windows: + child = window + + while len(seen_windows) + len(seen_children) < max_windows: + try: + child = child.spwndChild + except exceptions.InvalidAddressException: + break + + if child.vol.offset == 0: + break + + if child in seen_children: + break + seen_children.add(child) + + yield from self._do_get_windows(child, max_windows) + + def windows( + self, window, max_windows=10000 + ) -> Generator[Tuple[interfaces.objects.ObjectInterface, str], None, None]: + """ + Enumerates all windows adjacent to and children of `window` + + Args: + window: The window to enumerate windows from + + Returns: + A generator of tuples containing the window and its name + """ + seen_windows = set() + + for window, window_name in self._do_get_windows(window, max_windows): + if window.vol.offset in seen_windows: + continue + + seen_windows.add(window.vol.offset) + + yield window, window_name + + if len(seen_windows) == max_windows: + break + + +class tagWND(objects.StructType, pool.ExecutiveObject): + + def is_valid(self) -> bool: + """ + Enforce a valid sid + """ + sid = self.get_session_id() + + return sid is not None and 0 <= sid < 256 + + def get_name(self) -> Optional[str]: + """ + directName appeared in later Windows 10 versions and is pointer + strName is a unicode string directly in the structure + """ + if self.has_member("directName"): + try: + return utility.pointer_to_string( + self.directName, count=256, encoding="utf16" + ) + except exceptions.InvalidAddressException: + vollog.debug( + f"directname for window at {self.vol.offset:#x} in layer {self.vol.layer_name} is invalid" + ) + + try: + return self.strName.get_string() + except exceptions.InvalidAddressException: + vollog.debug( + f"strName for window at {self.vol.offset:#x} in layer {self.vol.layer_name} is invalid" + ) + + return None + + def get_session_id(self) -> Optional[int]: + """ + Uses its tagDESKTOP pointer to find its session + """ + desktop = self.get_desktop() + if desktop: + return desktop.get_session_id() + + return None + + def get_desktop(self) -> Optional[tagDESKTOP]: + """ + Attempts to return the host desktop (tagDESKTOP) for this window + """ + try: + return self.head.rpdesk.dereference() + except exceptions.InvalidAddressException: + vollog.debug( + f"Reading the desktop pointer for window {self.vol.offset:#x} caused a page fault" + ) + return None + + def get_process(self) -> Optional["extensions.EPROCESS"]: + """ + Attempts to return the host process (_EPROCESS) for this window + """ + try: + return self.head.pti.ppi.Process.dereference() + except exceptions.InvalidAddressException: + vollog.debug( + f"Reading the process pointer for window {self.vol.offset:#x} caused a page fault" + ) + return None + + def get_window_procedure(self): + """ + Attempts to return the window procedure for this windows + """ + try: + # >= 17134 + if hasattr(self, "subPointer"): + return self.subPointer.lpfnWndProc + else: + return self.lpfnWndProc + except exceptions.InvalidAddressException: + vollog.debug(f"Invalid window procedure for window {self.vol.offset:#x}") + return None + + +# This is copy/paste from UNICODE_STRING in `symbols/windows/extensions/__init__.py` +# The versioning of modules would get very ugly if we let different modules share implementations +# across different data structures +class LARGE_UNICODE_STRING(objects.StructType): + """A class for Windows unicode string structures.""" + + def get_string(self) -> interfaces.objects.ObjectInterface: + # We explicitly do *not* catch errors here, we allow an exception to be thrown + # (otherwise there's no way to determine anything went wrong) + # It's up to the user of this method to catch exceptions + + # We manually construct an object rather than casting a dereferenced pointer in case + # the buffer length is 0 and the pointer is a NULL pointer + return self._context.object( + self.vol.type_name.split(constants.BANG)[0] + constants.BANG + "string", + layer_name=self.Buffer.vol.native_layer_name, + offset=self.Buffer, + max_length=self.Length, + errors="replace", + encoding="utf16", + ) + class_types = { "tagWINDOWSTATION": tagWINDOWSTATION, "tagDESKTOP": tagDESKTOP, + "tagWND": tagWND, + "_LARGE_UNICODE_STRING": LARGE_UNICODE_STRING, } diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json index a542d4778..0308f4c7d 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-10586-x64.json @@ -18036,6 +18036,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json index 7c4af02e1..a69cbb7c3 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-15063-x64.json @@ -18036,6 +18036,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json index 1ff5fdcd9..54e8aeec3 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-16299-x64.json @@ -18036,6 +18036,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json index f74c8dd5b..48b97a1c2 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17134-x64.json @@ -12464,8 +12464,8 @@ "directName": { "type": { "subtype": { - "kind": "struct", - "name": "nt_symbols!String" + "kind": "base", + "name": "char" }, "kind": "pointer" }, @@ -18079,6 +18079,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json index 88e419100..affaf8731 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17735-x64.json @@ -12464,8 +12464,8 @@ "directName": { "type": { "subtype": { - "kind": "struct", - "name": "nt_symbols!String" + "kind": "base", + "name": "char" }, "kind": "pointer" }, @@ -18079,6 +18079,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json index ed183f39b..33db6c28d 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-17763-x64.json @@ -12464,8 +12464,8 @@ "directName": { "type": { "subtype": { - "kind": "struct", - "name": "nt_symbols!String" + "kind": "base", + "name": "char" }, "kind": "pointer" }, @@ -18079,6 +18079,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json index f568eedbe..bb1c74f7f 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-18362-x64.json @@ -12464,8 +12464,8 @@ "directName": { "type": { "subtype": { - "kind": "struct", - "name": "nt_symbols!String" + "kind": "base", + "name": "char" }, "kind": "pointer" }, @@ -18079,6 +18079,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json index be4341cfd..74868f1a7 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-19041-x64.json @@ -12464,8 +12464,8 @@ "directName": { "type": { "subtype": { - "kind": "struct", - "name": "nt_symbols!String" + "kind": "base", + "name": "char" }, "kind": "pointer" }, @@ -18079,6 +18079,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json b/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json index 68692dcf4..e718710cf 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win10-19577-x64.json @@ -12464,8 +12464,8 @@ "directName": { "type": { "subtype": { - "kind": "struct", - "name": "nt_symbols!String" + "kind": "base", + "name": "char" }, "kind": "pointer" }, @@ -18079,6 +18079,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json b/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json index ec81241b2..9b413baaa 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win7sp0-x64.json @@ -18619,6 +18619,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json b/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json index ae844e535..b856506a7 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win7sp1-x64.json @@ -17985,6 +17985,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", diff --git a/volatility3/framework/symbols/windows/gui/gui-win8-x64.json b/volatility3/framework/symbols/windows/gui/gui-win8-x64.json index e7581413f..8662bf62b 100644 --- a/volatility3/framework/symbols/windows/gui/gui-win8-x64.json +++ b/volatility3/framework/symbols/windows/gui/gui-win8-x64.json @@ -17992,6 +17992,12 @@ "signed": false, "size": 1 }, + "char": { + "kind": "char", + "endian": "little", + "signed": false, + "size": 1 + }, "float": { "kind": "float", "endian": "little", From d22d513716804bb4af002cefbe8cbeed2afcadb1 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 16 Mar 2025 16:40:53 +0000 Subject: [PATCH 0830/1352] Re-type the correct function --- volatility3/framework/objects/utility.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 57d1bca4c..ef702060c 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -105,7 +105,7 @@ def pointer_to_string( def gather_contiguous_bytes_from_address( context, data_layer, starting_address: int, count: int -) -> str: +) -> bytes: """ This method reconstructs a string from memory while also carefully examining each page @@ -148,7 +148,7 @@ def gather_contiguous_bytes_from_address( def bytes_to_decoded_string( data: bytes, encoding: str, errors: str, return_truncated: bool = True -) -> bytes: +) -> str: """ Args: data: The `bytes` buffer containing the string of a string at offset 0 From c8869d87cd447e258ae2f9172f2db158a75d841f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 16 Mar 2025 17:15:43 +0000 Subject: [PATCH 0831/1352] Version the GUI extensions. Correctly check windows procedure --- .../framework/plugins/windows/windows.py | 6 +- .../symbols/windows/extensions/gui.py | 502 +++++++++--------- 2 files changed, 260 insertions(+), 248 deletions(-) diff --git a/volatility3/framework/plugins/windows/windows.py b/volatility3/framework/plugins/windows/windows.py index 5e3059e45..a7c350ea9 100644 --- a/volatility3/framework/plugins/windows/windows.py +++ b/volatility3/framework/plugins/windows/windows.py @@ -102,11 +102,13 @@ class Windows(interfaces.plugins.PluginInterface): # procedures can be empty, but if set, should be a valid pointer window_proc = window.get_window_procedure() - if window_proc is None or window_proc == 0 or window_proc > 0x1000: + if window_proc is None: + window_proc = renderers.NotAvailableValue() + elif window_proc == 0 or window_proc > 0x1000: window_proc = format_hints.Hex(window_proc) else: vollog.warning( - f"Invalid window procedure for the window {window.vol.offset:#x}" + f"Invalid window procedure {window_proc} for the window {window.vol.offset:#x}" ) continue diff --git a/volatility3/framework/symbols/windows/extensions/gui.py b/volatility3/framework/symbols/windows/extensions/gui.py index 559fda095..48ec2eba4 100644 --- a/volatility3/framework/symbols/windows/extensions/gui.py +++ b/volatility3/framework/symbols/windows/extensions/gui.py @@ -5,6 +5,7 @@ import logging from typing import Optional, Tuple, Iterator, Generator +from volatility3 import framework from volatility3.framework import exceptions, constants, interfaces from volatility3.framework import objects from volatility3.framework.objects import utility @@ -13,310 +14,319 @@ from volatility3.framework.symbols.windows.extensions import pool vollog = logging.getLogger(__name__) +class GUIExtensions(interfaces.configuration.VersionableInterface): + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) -class tagWINDOWSTATION(objects.StructType, pool.ExecutiveObject): - def is_valid(self) -> bool: - sid = self.get_session_id() - return sid is not None and 0 <= sid < 256 + framework.require_interface_version(*_required_framework_version) - def get_session_id(self) -> Optional[int]: - try: - return self.dwSessionId - except exceptions.InvalidAddressException: - return None + class tagWINDOWSTATION(objects.StructType, pool.ExecutiveObject): + def is_valid(self) -> bool: + sid = self.get_session_id() + return sid is not None and 0 <= sid < 256 - def traverse(self, max_stations: int = 15): - """ - Traverses the window stations referenced in the list of stations - """ - seen = set() - - # include the first window station - yield self - - while len(seen) < max_stations: + def get_session_id(self) -> Optional[int]: try: - winsta = self.rpwinstaNext.dereference() + return self.dwSessionId except exceptions.InvalidAddressException: - break + return None - if winsta.vol.offset in seen: - break + def traverse(self, max_stations: int = 15): + """ + Traverses the window stations referenced in the list of stations + """ + seen = set() - yield winsta + # include the first window station + yield self - seen.add(winsta.vol.offset) + while len(seen) < max_stations: + try: + winsta = self.rpwinstaNext.dereference() + except exceptions.InvalidAddressException: + break + + if winsta.vol.offset in seen: + break + + yield winsta + + seen.add(winsta.vol.offset) + + def get_info(self, kernel_symbol_table_name) -> Optional[Tuple[str, int]]: + try: + name = self.get_name(kernel_symbol_table_name) + session_id = self.get_session_id() + except exceptions.InvalidAddressException: + return None, None + + # attempt to avoid smear + if session_id is not None and session_id < 256 and name and len(name) > 1: + return name, session_id - def get_info(self, kernel_symbol_table_name) -> Optional[Tuple[str, int]]: - try: - name = self.get_name(kernel_symbol_table_name) - session_id = self.get_session_id() - except exceptions.InvalidAddressException: return None, None - # attempt to avoid smear - if session_id is not None and session_id < 256 and name and len(name) > 1: - return name, session_id + def desktops(self, symbol_table_name, max_desktops: int = 12): + seen = set() - return None, None + while len(seen) < max_desktops: + try: + desktop = self.rpdeskList.dereference() + name = desktop.get_name(symbol_table_name) + except exceptions.InvalidAddressException: + break - def desktops(self, symbol_table_name, max_desktops: int = 12): - seen = set() + if desktop.vol.offset in seen: + break - while len(seen) < max_desktops: + yield desktop, name + + seen.add(desktop.vol.offset) + + + class tagDESKTOP(objects.StructType, pool.ExecutiveObject): + def is_valid(self) -> bool: + """ + Enforce a valid session ID and Window station + We aren't interested in terminated desktops as there are so many pointers + going from station -> desktop -> windows, that we would just be processing junk. + Even if the pointers were still in tact by some miracle, its not that helpful to + have a floating desktop appear in the output as you can't do much with it. + """ + sid = self.get_session_id() + + valid_sid = sid is not None and 0 <= sid < 256 + + if valid_sid: + return self.get_window_station() is not None + + return False + + def get_window_station(self) -> Optional["tagWINDOWSTATION"]: + """ + Attempts to return the window station for this desktop + """ try: - desktop = self.rpdeskList.dereference() - name = desktop.get_name(symbol_table_name) + return self.rpwinstaParent.dereference() except exceptions.InvalidAddressException: - break + return None - if desktop.vol.offset in seen: - break + def get_session_id(self) -> Optional[int]: + """ + Attempts to return the session ID for this desktop + """ + winsta = self.get_window_station() + if winsta: + return winsta.get_session_id() - yield desktop, name - - seen.add(desktop.vol.offset) - - -class tagDESKTOP(objects.StructType, pool.ExecutiveObject): - def is_valid(self) -> bool: - """ - Enforce a valid sid + name - """ - sid = self.get_session_id() - - valid_sid = sid is not None and 0 <= sid < 256 - - if valid_sid: - return self.get_window_station() is not None - - return False - - def get_window_station(self) -> Optional["tagWINDOWSTATION"]: - """ - Attempts to return the window station for this desktop - """ - try: - return self.rpwinstaParent.dereference() - except exceptions.InvalidAddressException: return None - def get_session_id(self) -> Optional[int]: - """ - Attempts to return the session ID for this desktop - """ - winsta = self.get_window_station() - if winsta: - return winsta.get_session_id() + def get_threads( + self, + ) -> Iterator[Tuple[interfaces.objects.ObjectInterface, str, int]]: + """ + Returns the threads of each desktop along with owning process information + """ + symbol_table_name = self.vol.type_name.split(constants.BANG)[0] - return None + for thread in self.PtiList.to_list( + symbol_table_name + constants.BANG + "tagTHREADINFO", "PtiLink" + ): + try: + process_name = utility.array_to_string(thread.ppi.Process.ImageFileName) + process_pid = thread.ppi.Process.UniqueProcessId + except exceptions.InvalidAddressException: + continue - def get_threads( - self, - ) -> Iterator[Tuple[interfaces.objects.ObjectInterface, str, int]]: - """ - Returns the threads of each desktop along with owning process information - """ - symbol_table_name = self.vol.type_name.split(constants.BANG)[0] + yield thread, process_name, process_pid - for thread in self.PtiList.to_list( - symbol_table_name + constants.BANG + "tagTHREADINFO", "PtiLink" - ): - try: - process_name = utility.array_to_string(thread.ppi.Process.ImageFileName) - process_pid = thread.ppi.Process.UniqueProcessId - except exceptions.InvalidAddressException: - continue + def _do_get_windows( + self, window, max_windows + ) -> Generator[Tuple[interfaces.objects.ObjectInterface, str], None, None]: + """ + Recusively walks and yields the adjacent and child windows + """ + seen_windows = set() + seen_children = set() - yield thread, process_name, process_pid - - def _do_get_windows( - self, window, max_windows - ) -> Generator[Tuple[interfaces.objects.ObjectInterface, str], None, None]: - """ - Recusively walks and yields the adjacent and child windows - """ - seen_windows = set() - seen_children = set() - - if window.vol.offset == 0: - return - - yield window, window.get_name() - - seen_windows.add(window) - - # Walk adjacent windows - while len(seen_windows) < max_windows: - try: - window = window.spwndNext.dereference() - except exceptions.InvalidAddressException: - break - - if window.vol.offset == 0: - break - - if window.vol.offset in seen_windows: - break + if not window.vol.offset: + return yield window, window.get_name() seen_windows.add(window) - # Walk children windows and recursively yield them - for window in seen_windows: - child = window - - while len(seen_windows) + len(seen_children) < max_windows: + # Walk adjacent windows + while len(seen_windows) < max_windows: try: - child = child.spwndChild + window = window.spwndNext.dereference() except exceptions.InvalidAddressException: break - if child.vol.offset == 0: + if not window.vol.offset: break - if child in seen_children: + if window.vol.offset in seen_windows: break - seen_children.add(child) - yield from self._do_get_windows(child, max_windows) + yield window, window.get_name() - def windows( - self, window, max_windows=10000 - ) -> Generator[Tuple[interfaces.objects.ObjectInterface, str], None, None]: - """ - Enumerates all windows adjacent to and children of `window` + seen_windows.add(window) - Args: - window: The window to enumerate windows from + # Walk children windows and recursively yield them + for window in seen_windows: + child = window - Returns: - A generator of tuples containing the window and its name - """ - seen_windows = set() + while len(seen_windows) + len(seen_children) < max_windows: + try: + child = child.spwndChild + except exceptions.InvalidAddressException: + break - for window, window_name in self._do_get_windows(window, max_windows): - if window.vol.offset in seen_windows: - continue + if not child.vol.offset: + break - seen_windows.add(window.vol.offset) + if child in seen_children: + break + seen_children.add(child) - yield window, window_name + yield from self._do_get_windows(child, max_windows) - if len(seen_windows) == max_windows: - break + def windows( + self, window, max_windows=10000 + ) -> Generator[Tuple[interfaces.objects.ObjectInterface, str], None, None]: + """ + Enumerates all windows adjacent to and children of `window` + + Args: + window: The window to enumerate windows from + + Returns: + A generator of tuples containing the window and its name + """ + seen_windows = set() + + for window, window_name in self._do_get_windows(window, max_windows): + if window.vol.offset in seen_windows: + continue + + seen_windows.add(window.vol.offset) + + yield window, window_name + + if len(seen_windows) == max_windows: + break -class tagWND(objects.StructType, pool.ExecutiveObject): + class tagWND(objects.StructType, pool.ExecutiveObject): - def is_valid(self) -> bool: - """ - Enforce a valid sid - """ - sid = self.get_session_id() + def is_valid(self) -> bool: + """ + Enforce a valid sid + """ + sid = self.get_session_id() - return sid is not None and 0 <= sid < 256 + return sid is not None and 0 <= sid < 256 + + def get_name(self) -> Optional[str]: + """ + directName appeared in later Windows 10 versions and is pointer + strName is a unicode string directly in the structure + """ + if self.has_member("directName"): + try: + return utility.pointer_to_string( + self.directName, count=256, encoding="utf16" + ) + except exceptions.InvalidAddressException: + vollog.debug( + f"directname for window at {self.vol.offset:#x} in layer {self.vol.layer_name} is invalid" + ) - def get_name(self) -> Optional[str]: - """ - directName appeared in later Windows 10 versions and is pointer - strName is a unicode string directly in the structure - """ - if self.has_member("directName"): try: - return utility.pointer_to_string( - self.directName, count=256, encoding="utf16" - ) + return self.strName.get_string() except exceptions.InvalidAddressException: vollog.debug( - f"directname for window at {self.vol.offset:#x} in layer {self.vol.layer_name} is invalid" + f"strName for window at {self.vol.offset:#x} in layer {self.vol.layer_name} is invalid" ) - try: - return self.strName.get_string() - except exceptions.InvalidAddressException: - vollog.debug( - f"strName for window at {self.vol.offset:#x} in layer {self.vol.layer_name} is invalid" - ) - - return None - - def get_session_id(self) -> Optional[int]: - """ - Uses its tagDESKTOP pointer to find its session - """ - desktop = self.get_desktop() - if desktop: - return desktop.get_session_id() - - return None - - def get_desktop(self) -> Optional[tagDESKTOP]: - """ - Attempts to return the host desktop (tagDESKTOP) for this window - """ - try: - return self.head.rpdesk.dereference() - except exceptions.InvalidAddressException: - vollog.debug( - f"Reading the desktop pointer for window {self.vol.offset:#x} caused a page fault" - ) return None - def get_process(self) -> Optional["extensions.EPROCESS"]: - """ - Attempts to return the host process (_EPROCESS) for this window - """ - try: - return self.head.pti.ppi.Process.dereference() - except exceptions.InvalidAddressException: - vollog.debug( - f"Reading the process pointer for window {self.vol.offset:#x} caused a page fault" + def get_session_id(self) -> Optional[int]: + """ + Uses its tagDESKTOP pointer to find its session + """ + desktop = self.get_desktop() + if desktop: + return desktop.get_session_id() + + return None + + def get_desktop(self) -> Optional["GUIExtensions.tagDESKTOP"]: + """ + Attempts to return the host desktop (tagDESKTOP) for this window + """ + try: + return self.head.rpdesk.dereference() + except exceptions.InvalidAddressException: + vollog.debug( + f"Reading the desktop pointer for window {self.vol.offset:#x} caused a page fault" + ) + return None + + def get_process(self) -> Optional["extensions.EPROCESS"]: + """ + Attempts to return the host process (_EPROCESS) for this window + """ + try: + return self.head.pti.ppi.Process.dereference() + except exceptions.InvalidAddressException: + vollog.debug( + f"Reading the process pointer for window {self.vol.offset:#x} caused a page fault" + ) + return None + + def get_window_procedure(self): + """ + Attempts to return the window procedure for this windows + """ + try: + # >= 17134 + if hasattr(self, "subPointer"): + return self.subPointer.lpfnWndProc + else: + return self.lpfnWndProc + except exceptions.InvalidAddressException: + vollog.debug(f"Invalid window procedure for window {self.vol.offset:#x}") + return None + + + # This is copy/paste from UNICODE_STRING in `symbols/windows/extensions/__init__.py` + # The versioning of modules would get very ugly if we let different modules share implementations + # across different data structures + class LARGE_UNICODE_STRING(objects.StructType): + """A class for Windows unicode string structures.""" + + def get_string(self) -> interfaces.objects.ObjectInterface: + # We explicitly do *not* catch errors here, we allow an exception to be thrown + # (otherwise there's no way to determine anything went wrong) + # It's up to the user of this method to catch exceptions + + # We manually construct an object rather than casting a dereferenced pointer in case + # the buffer length is 0 and the pointer is a NULL pointer + return self._context.object( + self.vol.type_name.split(constants.BANG)[0] + constants.BANG + "string", + layer_name=self.Buffer.vol.native_layer_name, + offset=self.Buffer, + max_length=self.Length, + errors="replace", + encoding="utf16", ) - return None - - def get_window_procedure(self): - """ - Attempts to return the window procedure for this windows - """ - try: - # >= 17134 - if hasattr(self, "subPointer"): - return self.subPointer.lpfnWndProc - else: - return self.lpfnWndProc - except exceptions.InvalidAddressException: - vollog.debug(f"Invalid window procedure for window {self.vol.offset:#x}") - return None - - -# This is copy/paste from UNICODE_STRING in `symbols/windows/extensions/__init__.py` -# The versioning of modules would get very ugly if we let different modules share implementations -# across different data structures -class LARGE_UNICODE_STRING(objects.StructType): - """A class for Windows unicode string structures.""" - - def get_string(self) -> interfaces.objects.ObjectInterface: - # We explicitly do *not* catch errors here, we allow an exception to be thrown - # (otherwise there's no way to determine anything went wrong) - # It's up to the user of this method to catch exceptions - - # We manually construct an object rather than casting a dereferenced pointer in case - # the buffer length is 0 and the pointer is a NULL pointer - return self._context.object( - self.vol.type_name.split(constants.BANG)[0] + constants.BANG + "string", - layer_name=self.Buffer.vol.native_layer_name, - offset=self.Buffer, - max_length=self.Length, - errors="replace", - encoding="utf16", - ) class_types = { - "tagWINDOWSTATION": tagWINDOWSTATION, - "tagDESKTOP": tagDESKTOP, - "tagWND": tagWND, - "_LARGE_UNICODE_STRING": LARGE_UNICODE_STRING, + "tagWINDOWSTATION": GUIExtensions.tagWINDOWSTATION, + "tagDESKTOP": GUIExtensions.tagDESKTOP, + "tagWND": GUIExtensions.tagWND, + "_LARGE_UNICODE_STRING": GUIExtensions.LARGE_UNICODE_STRING, } From 7e5a34ae49df25acc76da4bb93336fc7550e1c21 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 16 Mar 2025 17:17:46 +0000 Subject: [PATCH 0832/1352] Black and Ruff fixes --- .../framework/symbols/windows/extensions/gui.py | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/gui.py b/volatility3/framework/symbols/windows/extensions/gui.py index 48ec2eba4..f811f4313 100644 --- a/volatility3/framework/symbols/windows/extensions/gui.py +++ b/volatility3/framework/symbols/windows/extensions/gui.py @@ -14,6 +14,7 @@ from volatility3.framework.symbols.windows.extensions import pool vollog = logging.getLogger(__name__) + class GUIExtensions(interfaces.configuration.VersionableInterface): _version = (1, 0, 0) _required_framework_version = (2, 0, 0) @@ -83,14 +84,13 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): seen.add(desktop.vol.offset) - class tagDESKTOP(objects.StructType, pool.ExecutiveObject): def is_valid(self) -> bool: """ Enforce a valid session ID and Window station We aren't interested in terminated desktops as there are so many pointers going from station -> desktop -> windows, that we would just be processing junk. - Even if the pointers were still in tact by some miracle, its not that helpful to + Even if the pointers were still in tact by some miracle, its not that helpful to have a floating desktop appear in the output as you can't do much with it. """ sid = self.get_session_id() @@ -102,7 +102,7 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): return False - def get_window_station(self) -> Optional["tagWINDOWSTATION"]: + def get_window_station(self) -> Optional["GUIExtensions.tagWINDOWSTATION"]: """ Attempts to return the window station for this desktop """ @@ -133,7 +133,9 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): symbol_table_name + constants.BANG + "tagTHREADINFO", "PtiLink" ): try: - process_name = utility.array_to_string(thread.ppi.Process.ImageFileName) + process_name = utility.array_to_string( + thread.ppi.Process.ImageFileName + ) process_pid = thread.ppi.Process.UniqueProcessId except exceptions.InvalidAddressException: continue @@ -217,7 +219,6 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): if len(seen_windows) == max_windows: break - class tagWND(objects.StructType, pool.ExecutiveObject): def is_valid(self) -> bool: @@ -297,10 +298,11 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): else: return self.lpfnWndProc except exceptions.InvalidAddressException: - vollog.debug(f"Invalid window procedure for window {self.vol.offset:#x}") + vollog.debug( + f"Invalid window procedure for window {self.vol.offset:#x}" + ) return None - # This is copy/paste from UNICODE_STRING in `symbols/windows/extensions/__init__.py` # The versioning of modules would get very ugly if we let different modules share implementations # across different data structures From 4e1ddadb4080b6269521ab40e73c160706a28880 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 16 Mar 2025 17:53:55 +0000 Subject: [PATCH 0833/1352] Fix version requirements --- volatility3/framework/plugins/windows/deskscan.py | 4 ++++ volatility3/framework/plugins/windows/desktops.py | 4 ++++ volatility3/framework/plugins/windows/windows.py | 8 ++++++-- volatility3/framework/plugins/windows/windowstations.py | 5 ++++- 4 files changed, 18 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/deskscan.py b/volatility3/framework/plugins/windows/deskscan.py index 6a8ff9e65..2db9c8234 100644 --- a/volatility3/framework/plugins/windows/deskscan.py +++ b/volatility3/framework/plugins/windows/deskscan.py @@ -8,6 +8,7 @@ from volatility3.framework import interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import desktops, windowstations +from volatility3.framework.symbols.windows.extensions import gui vollog = logging.getLogger(__name__) @@ -39,6 +40,9 @@ class DeskScan(desktops.Desktops): plugin=windowstations.WindowStations, version=(1, 0, 0), ), + requirements.VersionRequirement( + name="GUIExtensions", component=gui.GUIExtensions, version=(1, 0, 0) + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/desktops.py b/volatility3/framework/plugins/windows/desktops.py index 1085ff36d..dd1d238d6 100644 --- a/volatility3/framework/plugins/windows/desktops.py +++ b/volatility3/framework/plugins/windows/desktops.py @@ -8,6 +8,7 @@ from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import windowstations +from volatility3.framework.symbols.windows.extensions import gui vollog = logging.getLogger(__name__) @@ -36,6 +37,9 @@ class Desktops(interfaces.plugins.PluginInterface): plugin=windowstations.WindowStations, version=(1, 0, 0), ), + requirements.VersionRequirement( + name="GUIExtensions", component=gui.GUIExtensions, version=(1, 0, 0) + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/windows.py b/volatility3/framework/plugins/windows/windows.py index a7c350ea9..ade1df9dc 100644 --- a/volatility3/framework/plugins/windows/windows.py +++ b/volatility3/framework/plugins/windows/windows.py @@ -9,6 +9,7 @@ from volatility3.framework.objects import utility from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import windowstations +from volatility3.framework.symbols.windows.extensions import gui vollog = logging.getLogger(__name__) @@ -33,6 +34,9 @@ class Windows(interfaces.plugins.PluginInterface): component=windowstations.WindowStations, version=(1, 0, 0), ), + requirements.VersionRequirement( + name="GUIExtensions", component=gui.GUIExtensions, version=(1, 0, 0) + ), ] @classmethod @@ -88,7 +92,7 @@ class Windows(interfaces.plugins.PluginInterface): ) if process_name is None: - vollog.warning( + vollog.debug( f"Invalid process reference for the process hosting window {window.vol.offset:#x}" ) continue @@ -107,7 +111,7 @@ class Windows(interfaces.plugins.PluginInterface): elif window_proc == 0 or window_proc > 0x1000: window_proc = format_hints.Hex(window_proc) else: - vollog.warning( + vollog.debug( f"Invalid window procedure {window_proc} for the window {window.vol.offset:#x}" ) continue diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index cd02938cd..ad1709bfa 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -10,8 +10,8 @@ from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import versions -from volatility3.framework.symbols.windows.extensions import gui from volatility3.plugins.windows import poolscanner, modules +from volatility3.framework.symbols.windows.extensions import gui vollog = logging.getLogger(__name__) @@ -52,6 +52,9 @@ class WindowStations(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="modules", component=modules.Modules, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="GUIExtensions", component=gui.GUIExtensions, version=(1, 0, 0) + ), ] @staticmethod From dae430ff5872784d7a750f60cf3eb36bc77ef043 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 16 Mar 2025 22:19:41 +0000 Subject: [PATCH 0834/1352] Address feedback --- volatility3/framework/plugins/windows/deskscan.py | 4 ---- volatility3/framework/plugins/windows/desktops.py | 4 ---- volatility3/framework/plugins/windows/windows.py | 4 ---- .../framework/plugins/windows/windowstations.py | 2 +- .../framework/symbols/windows/extensions/gui.py | 13 ++++++------- 5 files changed, 7 insertions(+), 20 deletions(-) diff --git a/volatility3/framework/plugins/windows/deskscan.py b/volatility3/framework/plugins/windows/deskscan.py index 2db9c8234..6a8ff9e65 100644 --- a/volatility3/framework/plugins/windows/deskscan.py +++ b/volatility3/framework/plugins/windows/deskscan.py @@ -8,7 +8,6 @@ from volatility3.framework import interfaces from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import desktops, windowstations -from volatility3.framework.symbols.windows.extensions import gui vollog = logging.getLogger(__name__) @@ -40,9 +39,6 @@ class DeskScan(desktops.Desktops): plugin=windowstations.WindowStations, version=(1, 0, 0), ), - requirements.VersionRequirement( - name="GUIExtensions", component=gui.GUIExtensions, version=(1, 0, 0) - ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/desktops.py b/volatility3/framework/plugins/windows/desktops.py index dd1d238d6..1085ff36d 100644 --- a/volatility3/framework/plugins/windows/desktops.py +++ b/volatility3/framework/plugins/windows/desktops.py @@ -8,7 +8,6 @@ from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import windowstations -from volatility3.framework.symbols.windows.extensions import gui vollog = logging.getLogger(__name__) @@ -37,9 +36,6 @@ class Desktops(interfaces.plugins.PluginInterface): plugin=windowstations.WindowStations, version=(1, 0, 0), ), - requirements.VersionRequirement( - name="GUIExtensions", component=gui.GUIExtensions, version=(1, 0, 0) - ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/windows.py b/volatility3/framework/plugins/windows/windows.py index ade1df9dc..9d4317df9 100644 --- a/volatility3/framework/plugins/windows/windows.py +++ b/volatility3/framework/plugins/windows/windows.py @@ -9,7 +9,6 @@ from volatility3.framework.objects import utility from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import windowstations -from volatility3.framework.symbols.windows.extensions import gui vollog = logging.getLogger(__name__) @@ -34,9 +33,6 @@ class Windows(interfaces.plugins.PluginInterface): component=windowstations.WindowStations, version=(1, 0, 0), ), - requirements.VersionRequirement( - name="GUIExtensions", component=gui.GUIExtensions, version=(1, 0, 0) - ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/windowstations.py b/volatility3/framework/plugins/windows/windowstations.py index ad1709bfa..1f95b0531 100644 --- a/volatility3/framework/plugins/windows/windowstations.py +++ b/volatility3/framework/plugins/windows/windowstations.py @@ -99,7 +99,7 @@ class WindowStations(interfaces.plugins.PluginInterface): config_path=config_path, sub_path=os.path.join("windows", "gui"), filename=symbol_filename, - class_types=gui.class_types, + class_types=gui.GUIExtensions.class_types, table_mapping=table_mapping, ) diff --git a/volatility3/framework/symbols/windows/extensions/gui.py b/volatility3/framework/symbols/windows/extensions/gui.py index f811f4313..d1835631f 100644 --- a/volatility3/framework/symbols/windows/extensions/gui.py +++ b/volatility3/framework/symbols/windows/extensions/gui.py @@ -325,10 +325,9 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): encoding="utf16", ) - -class_types = { - "tagWINDOWSTATION": GUIExtensions.tagWINDOWSTATION, - "tagDESKTOP": GUIExtensions.tagDESKTOP, - "tagWND": GUIExtensions.tagWND, - "_LARGE_UNICODE_STRING": GUIExtensions.LARGE_UNICODE_STRING, -} + class_types = { + "tagWINDOWSTATION": tagWINDOWSTATION, + "tagDESKTOP": tagDESKTOP, + "tagWND": tagWND, + "_LARGE_UNICODE_STRING": LARGE_UNICODE_STRING, + } From 04cd65ef2b439914277d3ca47d4b3d4975b4fced Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 15:23:44 +0000 Subject: [PATCH 0835/1352] Update netfilter to current rookit detection API and update displayed columns to current standards --- .../framework/plugins/linux/netfilter.py | 83 ++++++++++--------- 1 file changed, 45 insertions(+), 38 deletions(-) diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index e8a33be61..9079adef9 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -13,12 +13,11 @@ from volatility3.framework import ( interfaces, renderers, exceptions, + deprecation, ) from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements -from volatility3.framework.symbols import linux from volatility3.framework.symbols.linux import network -from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -82,22 +81,18 @@ class AbstractNetfilter(ABC): self.ptr_size = self.vmlinux.get_type("pointer").size self.list_head_size = self.vmlinux.get_type("list_head").size - lsmod_required_version = Netfilter._required_lsmod_version - lsmod_current_version = lsmod.Lsmod.version + linuxutils_modulegatherers_required_version = ( + Netfilter._required_linuxutils_gatherers_version + ) + linuxutils_modulegatherers_current_version = ( + linux_utilities_modules.ModuleGatherers.version + ) if not requirements.VersionRequirement.matches_required( - lsmod_required_version, lsmod_current_version + linuxutils_modulegatherers_required_version, + linuxutils_modulegatherers_current_version, ): raise exceptions.PluginRequirementException( - f"linux.lsmod.Lsmod version not suitable: required {lsmod_required_version} found {lsmod_current_version}" - ) - - linuxutils_required_version = Netfilter._required_linuxutils_version - linuxutils_current_version = linux.LinuxUtilities.version - if not requirements.VersionRequirement.matches_required( - linuxutils_required_version, linuxutils_current_version - ): - raise exceptions.PluginRequirementException( - f"linux.LinuxUtilities version not suitable: required {linuxutils_required_version} found {linuxutils_current_version}" + f"linux_utilities_modules.ModuleGatherer version not suitable: required {linuxutils_modulegatherers_required_version} found {linuxutils_modulegatherers_current_version}" ) linux_net_required_version = Netfilter._required_linuxnet_version @@ -123,12 +118,13 @@ class AbstractNetfilter(ABC): f"linux_utilities_modules.Modules version not suitable: required {linux_utilities_modules_required_version} found {linux_utilities_modules_current_version}" ) - symbol_table = self._context.symbol_space[self.vmlinux.symbol_table_name] + symbol_table = context.symbol_space[self.vmlinux.symbol_table_name] network.NetSymbols.apply(symbol_table) - modules = lsmod.Lsmod.list_modules(context, kernel_module_name) - self.handlers = linux.LinuxUtilities.generate_kernel_handler_info( - context, kernel_module_name, modules + self.handlers = linux_utilities_modules.Modules.run_modules_scanners( + context=context, + kernel_module_name=kernel_module_name, + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, ) @classmethod @@ -217,10 +213,17 @@ class AbstractNetfilter(ABC): priority = int(hook_ops.priority) hook_ops_hook = hook_ops.hook - module_name = self.get_module_name_for_address(hook_ops_hook) - hooked = module_name is None + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self._context, + self.vmlinux.name, + self.handlers, + hook_ops_hook, + ) + ) + hooked = module_info is None - yield netns, proto_name, hook_name, priority, hook_ops_hook, module_name, hooked + yield netns, proto_name, hook_name, priority, hook_ops_hook, module_info, symbol_name, hooked @classmethod @abstractmethod @@ -300,6 +303,10 @@ class AbstractNetfilter(ABC): # in other parts of the kernel source code. return ("IPV4", "ARP", "BRIDGE", "IPV6", "DECNET") + @deprecation.method_being_removed( + removal_date="2025-09-25", + message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`", + ) def get_module_name_for_address(self, addr) -> str: """Helper to obtain the module and symbol name in the format needed for the output of this plugin. @@ -724,11 +731,10 @@ class Netfilter(interfaces.plugins.PluginInterface): _required_framework_version = (2, 22, 0) - _version = (1, 1, 1) + _version = (2, 0, 0) _required_linux_utilities_modules_version = (3, 0, 0) - _required_linuxutils_version = (2, 1, 0) - _required_lsmod_version = (2, 0, 0) + _required_linuxutils_gatherers_version = (1, 0, 0) _required_linuxnet_version = (1, 0, 0) @classmethod @@ -740,17 +746,9 @@ class Netfilter(interfaces.plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=cls._required_linux_utilities_modules_version, - ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=cls._required_lsmod_version - ), - requirements.VersionRequirement( - name="linuxutils", - component=linux.LinuxUtilities, - version=cls._required_linuxutils_version, + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=cls._required_linuxutils_gatherers_version, ), requirements.VersionRequirement( name="linuxnet", @@ -766,16 +764,24 @@ class Netfilter(interfaces.plugins.PluginInterface): hook_name, priority, hook_func, - module_name, + module_info, + symbol_name, hooked, ) = fields + + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + return ( netns, proto_name, hook_name, priority, format_hints.Hex(hook_func), - module_name or renderers.NotAvailableValue(), + module_name, + symbol_name or renderers.NotAvailableValue(), str(hooked), ) @@ -794,6 +800,7 @@ class Netfilter(interfaces.plugins.PluginInterface): ("Priority", int), ("Handler", format_hints.Hex), ("Module", str), + ("Symbol", str), ("Is Hooked", str), ] return renderers.TreeGrid(headers, self._generator()) From 18abe9c50815b2e6186f0cf6201b2411b617272f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 15:25:43 +0000 Subject: [PATCH 0836/1352] Fix first set of ELF parsing unhandled smear protection --- .../framework/symbols/linux/extensions/__init__.py | 8 ++++++-- volatility3/framework/symbols/linux/extensions/elf.py | 5 ++++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 39605cf52..dd0f23d34 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -256,14 +256,18 @@ class module(generic.GenericIntelProcess): elf_sym_obj.cached_strtab = self.section_strtab yield elf_sym_obj - def get_symbols_names_and_addresses(self) -> Iterable[Tuple[str, int]]: + def get_symbols_names_and_addresses(self, max_symbols: int = 4096) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module Yields: A tuple for each symbol containing the symbol name and its corresponding value """ layer = self._context.layers[self.vol.layer_name] - for elf_sym_obj in self.get_symbols(): + for iteration_counter, elf_sym_obj in enumerate(self.get_symbols()): + if iteration_counter > max_symbols: + vollog.debug(f"Hit maximum symbols ({max_symbols}) for ELF at {self.vol.offset:#x} in layer {self.vol.layer_name}") + return + sym_name = elf_sym_obj.get_name() if not sym_name: continue diff --git a/volatility3/framework/symbols/linux/extensions/elf.py b/volatility3/framework/symbols/linux/extensions/elf.py index 7105a05ea..564439c64 100644 --- a/volatility3/framework/symbols/linux/extensions/elf.py +++ b/volatility3/framework/symbols/linux/extensions/elf.py @@ -329,7 +329,10 @@ class elf_sym(objects.StructType): def get_name(self) -> Optional[str]: """Returns the symbol name""" - addr = self._cached_strtab + self.st_name + try: + addr = self._cached_strtab + self.st_name + except exceptions.InvalidAddressException: + return None layer = self._context.layers[self.vol.layer_name] name_bytes = layer.read(addr, self._MAX_NAME_LENGTH, pad=True) From 4b403d50ef291920cb50aa7008ab6ce96c1280d9 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 15:29:28 +0000 Subject: [PATCH 0837/1352] Fix first set of ELF parsing unhandled smear protection --- .../framework/symbols/linux/extensions/__init__.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index dd0f23d34..2094d63da 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -256,7 +256,9 @@ class module(generic.GenericIntelProcess): elf_sym_obj.cached_strtab = self.section_strtab yield elf_sym_obj - def get_symbols_names_and_addresses(self, max_symbols: int = 4096) -> Iterable[Tuple[str, int]]: + def get_symbols_names_and_addresses( + self, max_symbols: int = 4096 + ) -> Iterable[Tuple[str, int]]: """Get names and addresses for each symbol of the module Yields: @@ -265,7 +267,9 @@ class module(generic.GenericIntelProcess): layer = self._context.layers[self.vol.layer_name] for iteration_counter, elf_sym_obj in enumerate(self.get_symbols()): if iteration_counter > max_symbols: - vollog.debug(f"Hit maximum symbols ({max_symbols}) for ELF at {self.vol.offset:#x} in layer {self.vol.layer_name}") + vollog.debug( + f"Hit maximum symbols ({max_symbols}) for ELF at {self.vol.offset:#x} in layer {self.vol.layer_name}" + ) return sym_name = elf_sym_obj.get_name() From f697287784e5a2901e8c16eecd82db0c8641ed77 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 19:09:05 +0000 Subject: [PATCH 0838/1352] Prevent backtrace on corrupt system call table entry --- volatility3/framework/plugins/linux/check_syscall.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index 9ffd4c497..724a67810 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -172,8 +172,11 @@ class Check_syscall(plugins.PluginInterface): count=tblsz, ) - for i, call_addr in enumerate(table): - if not call_addr: + for i in range(len(table)): + try: + call_addr = table[i] + except exceptions.InvalidAddressException: + vollog.debug(f"Failed to get system call table entry at index {i}") continue symbols = list(vmlinux.get_symbols_by_absolute_location(call_addr)) From ee35fa1ef9b90520931812b06ecb619ce8672366 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 19:10:23 +0000 Subject: [PATCH 0839/1352] Prevent backtrace on smeared iomem entry --- volatility3/framework/plugins/linux/iomem.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/iomem.py b/volatility3/framework/plugins/linux/iomem.py index 6732084db..5be6627fc 100644 --- a/volatility3/framework/plugins/linux/iomem.py +++ b/volatility3/framework/plugins/linux/iomem.py @@ -59,7 +59,7 @@ class IOMem(interfaces.plugins.PluginInterface): f"Unable to create resource object at {resource_offset:#x}. This resource, " "its sibling, and any of it's children and will be missing from the output." ) - return None + return # get name with protection against smear as following a pointer try: @@ -71,6 +71,15 @@ class IOMem(interfaces.plugins.PluginInterface): ) name = renderers.UnreadableValue() + try: + start = resource.start + end = resource.end + except exceptions.InvalidAddressException: + vollog.warning( + f"Unable to follow pointer to start and end for resource object at {resource_offset:#x}. Skipping entry." + ) + return + # mark this resource as seen in the seen set. Normally this should not be needed but will protect # against possible infinite loops. Warn the user if an infinite loop would have happened. if resource_offset in seen: @@ -79,12 +88,12 @@ class IOMem(interfaces.plugins.PluginInterface): "this should not normally occur. No further results from related resources will be " "displayed to protect against infinite loops." ) - return None + return else: seen.add(resource_offset) # yield information on this resource - yield depth, (name, resource.start, resource.end) + yield depth, (name, start, end) # process child resource if this exists if resource.child != 0: From b8a427c13063d55fdc52688c8fe6b2e1f09d84a1 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 17:08:27 -0500 Subject: [PATCH 0840/1352] Fix bugs in kallsyms and the related pscallstack found in testing and switch calls to deprecated functions --- .../framework/plugins/linux/kallsyms.py | 2 + .../framework/plugins/linux/pscallstack.py | 10 +- .../symbols/linux/extensions/__init__.py | 17 +- .../framework/symbols/linux/kallsyms.py | 164 ++++++++++++------ 4 files changed, 137 insertions(+), 56 deletions(-) diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py index 7dd4f06e6..47861d91a 100644 --- a/volatility3/framework/plugins/linux/kallsyms.py +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -106,6 +106,8 @@ class Kallsyms(plugins.PluginInterface): for symbols_generator in symbol_generators: for kassymbol in symbols_generator: + if not kassymbol: + continue # Symbol sizes are calculated using the address of the next non-aliased # symbol or the end of the kernel text area _end/_etext. However, some kernel # symbols are located beyond that area, which causes this method to fail for diff --git a/volatility3/framework/plugins/linux/pscallstack.py b/volatility3/framework/plugins/linux/pscallstack.py index 8931ca581..6d7a24942 100644 --- a/volatility3/framework/plugins/linux/pscallstack.py +++ b/volatility3/framework/plugins/linux/pscallstack.py @@ -118,9 +118,15 @@ class PsCallStack(plugins.PluginInterface): current_sp = rsp_start idx = 0 while current_sp < task_top_of_stack: - stack_value_bytes = task_layer.read(current_sp, pointer_size) + try: + stack_value_bytes = task_layer.read(current_sp, pointer_size) + except exceptions.InvalidAddressException: + break stack_value = int.from_bytes(stack_value_bytes, byteorder=byte_order) - + if not stack_value: + idx += 1 + current_sp += pointer_size + continue kassymbol = kas.lookup_address(stack_value) sp_address = current_sp & vmlinux_layer.address_mask stack_value &= vmlinux_layer.address_mask diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 2094d63da..a4e04d950 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1994,7 +1994,10 @@ class bpf_prog(objects.StructType): # 'prog_aux' was added in kernels 3.18 return None - return self.aux.get_name() + try: + return self.aux.get_name() + except exceptions.InvalidAddressException: + return None def bpf_jit_binary_hdr_address(self) -> int: """Return the jitted BPF program start address @@ -2056,11 +2059,13 @@ class bpf_prog_aux(objects.StructType): # 'name' was added in kernels 4.15 return None - if not self.name: + try: + if not self.name: + return None + return utility.array_to_string(self.name) + except exceptions.InvalidAddressException: return None - return utility.array_to_string(self.name) - class cred(objects.StructType): # struct cred was added in kernels 2.6.29 @@ -2996,7 +3001,9 @@ class latch_tree_root(objects.StructType): rb_node = rb_node_ptr.dereference() lt_node = self._get_lt_node_from_rb_node(rb_node, idx) c = comp_function(key, lt_node) - if c < 0: + if c is None: + return None + elif c < 0: rb_node_ptr = rb_node.rb_left elif c > 0: rb_node_ptr = rb_node.rb_right diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index 298725a7a..368169757 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -6,12 +6,12 @@ import functools import logging from typing import Iterator, List, Optional, Tuple +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.constants import linux as linux_constants from volatility3.framework.objects import utility from volatility3.framework.symbols import linux -from volatility3.plugins.linux import lsmod vollog = logging.getLogger(__name__) @@ -304,28 +304,35 @@ class Kallsyms(interfaces.configuration.VersionableInterface): @classmethod def _assert_versions(cls) -> None: """Verify versions of shared dependencies""" - lsmod_version_required = (2, 0, 0) + linux_utilities_modules_version_required = (3, 0, 0) if not requirements.VersionRequirement.matches_required( - lsmod_version_required, lsmod.Lsmod.version + linux_utilities_modules_version_required, + linux_utilities_modules.Modules.version, ): raise exceptions.VolatilityException( - "Lsmod version not suitable: " - f"required {lsmod_version_required} found {lsmod.Lsmod.version}", + "linux_utilities_modules.Modules version not suitable: " + f"required {linux_utilities_modules_version_required} found {linux_utilities_modules.Modules.version}", ) return None - def _read_bytes(self, address: int, size: int) -> bytes: + def _read_bytes(self, address: int, size: int) -> Optional[bytes]: layer = self._context.layers[self._layer_name] - return layer.read(address, size).decode() + try: + return layer.read(address, size).decode() + except exceptions.InvalidAddressException: + return None - def _read_int(self, address: int, size: int, signed: bool = False) -> int: + def _read_int(self, address: int, size: int, signed: bool = False) -> Optional[int]: layer = self._context.layers[self._layer_name] - return int.from_bytes( - layer.read(address, size), - byteorder=self._endian, - signed=signed, - ) + try: + return int.from_bytes( + layer.read(address, size), + byteorder=self._endian, + signed=signed, + ) + except exceptions.InvalidAddressException: + return None def _bootstrap(self) -> None: layer = self._context.layers[self._layer_name] @@ -402,7 +409,20 @@ class Kallsyms(interfaces.configuration.VersionableInterface): """ current_offset = 0 for sym_idx in range(self._kallsyms_num_syms): - kassymbol, compressed_length = self._get_symbol(current_offset, sym_idx) + try: + kassymbol, compressed_length = self._get_symbol(current_offset, sym_idx) + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to reconstruct core symbol at offset {current_offset:#x} and index {sym_idx}" + ) + continue + + if compressed_length is None: + vollog.debug( + f"Unable to reconstruct compressed_length at offset {current_offset:#x} and index {sym_idx}" + ) + break + if kassymbol: yield kassymbol @@ -485,7 +505,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): ) return kassymbolbasic, compressed_length - def _get_symbol_address_by_index(self, index: int) -> int: + def _get_symbol_address_by_index(self, index: int) -> Optional[int]: """Return symbol address based on the symbol index in the kallsyms arrays. Based on kallsyms_sym_address() @@ -502,6 +522,8 @@ class Kallsyms(interfaces.configuration.VersionableInterface): signed_int_size = 4 sym_offset_ptr = self._kallsyms_offsets_address + (index * signed_int_size) sym_addr = self._read_int(sym_offset_ptr, signed_int_size, signed=True) + if sym_addr is None: + return None if sym_addr < 0: # Negative offsets are relative to kallsyms_relative_base - 1 @@ -517,35 +539,56 @@ class Kallsyms(interfaces.configuration.VersionableInterface): self._long_size, signed=False, ) + if kallsyms_address is None: + return None + return kallsyms_address & layer.address_mask else: raise exceptions.VolatilityException("Unsupported kernel") @functools.lru_cache - def _get_symbol_pos(self, address: int) -> Tuple[int, int]: + def _get_symbol_pos(self, address: int) -> Optional[Tuple[int, int]]: """Returns the symbol position in the kallsyms arrays and its size.""" low = 0 high = self._kallsyms_num_syms while high - low > 1: mid = low + (high - low) // 2 - if self._get_symbol_address_by_index(mid) <= address: + symbol_index = self._get_symbol_address_by_index(mid) + if symbol_index is None: + return None, None + elif symbol_index <= address: low = mid else: high = mid + # prevent accidental bleed through + symbol_index = None + # Search for the first aliased symbol. *Aliased symbols* are symbols with the same address. - while low and self._get_symbol_address_by_index( - low - 1 - ) == self._get_symbol_address_by_index(low): - low -= 1 + while low: + symbol_index = self._get_symbol_address_by_index(low - 1) + if symbol_index is None: + return None, None + + if symbol_index == self._get_symbol_address_by_index(low): + low -= 1 + else: + break symbol_start = self._get_symbol_address_by_index(low) + if symbol_start is None: + return None, None + symbol_end = 0 # Search for next non-aliased symbol. for idx in range(low + 1, self._kallsyms_num_syms): - if self._get_symbol_address_by_index(idx) > symbol_start: + symbol_index = self._get_symbol_address_by_index(idx) + if symbol_index is None: + return None, None + + if symbol_index > symbol_start: symbol_end = self._get_symbol_address_by_index(idx) break @@ -664,6 +707,8 @@ class Kallsyms(interfaces.configuration.VersionableInterface): return None pos, sym_size = self._get_symbol_pos(address) + if pos is None: + return None offset = self._get_symbol_offset(pos) sym_address = self._get_symbol_address_by_index(pos) kassymbolbasic, _compressed_length = self._expand_symbol(offset) @@ -855,7 +900,9 @@ class Kallsyms(interfaces.configuration.VersionableInterface): self, ) -> List[Tuple[interfaces.objects.ObjectInterface, int, int]]: modules_region = [] - for module in lsmod.Lsmod.list_modules(self._context, self._module_name): + for module in linux_utilities_modules.Modules.list_modules( + self._context, self._module_name + ): minimum_address, maximum_address = module.get_module_address_boundaries() module_region = module, minimum_address, maximum_address modules_region.append(module_region) @@ -923,21 +970,35 @@ class Kallsyms(interfaces.configuration.VersionableInterface): return self._search_module_by_address(address) @functools.lru_cache - def _get_type_cache(self, name: str): + def _get_type_cache(self, name: str) -> Optional[interfaces.objects.Template]: vmlinux = self._context.modules[self._module_name] - return vmlinux.get_type(name) + try: + return vmlinux.get_type(name) + except exceptions.SymbolError: + return None def _mod_tree_comp( self, address: int, latch_tree_node: interfaces.objects.ObjectInterface - ) -> int: + ) -> Optional[int]: vmlinux = self._context.modules[self._module_name] - module_memory_mtn_offset = self._get_type_cache( - "module_memory" - ).relative_child_offset("mtn") - mod_tree_node_mod_offset = self._get_type_cache( - "mod_tree_node" - ).relative_child_offset("mod") + module_memory_mtn = self._get_type_cache("module_memory") + if not module_memory_mtn: + vollog.debug( + "`module_memory` symbol not present in the symbol table. Cannot proceed." + ) + return None + + module_memory_mtn_offset = module_memory_mtn.relative_child_offset("mtn") + + mod_tree_node_mod = self._get_type_cache("mod_tree_node") + if not mod_tree_node_mod: + vollog.debug( + "`mod_tree_node` symbol not present in the symbol table. Cannot proceed." + ) + return None + + mod_tree_node_mod_offset = mod_tree_node_mod.relative_child_offset("mod") module_memory_offset = ( latch_tree_node.vol.offset @@ -1087,7 +1148,9 @@ class Kallsyms(interfaces.configuration.VersionableInterface): KASSymbol objects """ layer = self._context.layers[self._layer_name] - for module in lsmod.Lsmod.list_modules(self._context, self._module_name): + for module in linux_utilities_modules.Modules.list_modules( + self._context, self._module_name + ): module_name = utility.array_to_string(module.name) for elf_sym_idx, elf_sym_obj in enumerate(module.get_symbols()): sym_name = elf_sym_obj.get_name() @@ -1254,21 +1317,24 @@ class Kallsyms(interfaces.configuration.VersionableInterface): # this function will still be able to gather the symbols. bpf_kallsyms_list = vmlinux.object_from_symbol("bpf_kallsyms") for elem in bpf_kallsyms_list.to_list(list_type_symname, list_head_member): - # See kernel's bpf_get_kallsym() - if list_type == "bpf_ksym": - # kernels >= 5.8 - bpf_ksym = elem - sym_name = utility.array_to_string(bpf_ksym.name) - sym_addr = bpf_ksym.start - sym_size = bpf_ksym.end - bpf_ksym.start - else: - # list_type == "bpf_prog_aux" 3.18 <= kernels < 5.8 - bpf_prog_aux = elem - bpf_prog = bpf_prog_aux.prog - sym_name = bpf_prog.get_name() - sym_addr = bpf_prog.bpf_func - sym_start, sym_end = bpf_prog.get_address_region() - sym_size = sym_end - sym_start + try: + # See kernel's bpf_get_kallsym() + if list_type == "bpf_ksym": + # kernels >= 5.8 + bpf_ksym = elem + sym_name = utility.array_to_string(bpf_ksym.name) + sym_addr = bpf_ksym.start + sym_size = bpf_ksym.end - bpf_ksym.start + else: + # list_type == "bpf_prog_aux" 3.18 <= kernels < 5.8 + bpf_prog_aux = elem + bpf_prog = bpf_prog_aux.prog + sym_name = bpf_prog.get_name() + sym_addr = bpf_prog.bpf_func + sym_start, sym_end = bpf_prog.get_address_region() + sym_size = sym_end - sym_start + except exceptions.InvalidAddressException: + continue # The following are also hardcoded in the Linux kernel # see kernel's get_ksymbol_bpf(), bpf_get_kallsym() and BPF_SYM_ELF_TYPE @@ -1322,7 +1388,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): sym_size = symbol_end - symbol_start elif vmlinux.has_type("latch_tree_root") and vmlinux.get_type( "bpf_prog_aux" - ).child_template("ksym_tnode"): + ).has_member("ksym_tnode"): # For 4.11 <= kernels < 5.7 # latch_tree_root was added in kernels 4.2 ade3f510f93a5613b672febe88eff8ea7f1c63b7 # BPF kallsyms support was added in kernels 4.11 74451e66d516c55e309e8d89a4a1e7596e46aacd From 1eacddc79c2975fe1e53167f86bec365c68636b9 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 17:45:13 -0500 Subject: [PATCH 0841/1352] Add needed checks to prevent backtraces in ELF parsing --- .../symbols/linux/extensions/__init__.py | 72 ++++++++++++------- 1 file changed, 46 insertions(+), 26 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 2094d63da..524f2a7c6 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -337,39 +337,55 @@ class module(generic.GenericIntelProcess): @property def section_symtab(self): - if self.has_member("kallsyms"): - return self.kallsyms.symtab - elif self.has_member("symtab"): - return self.symtab + try: + if self.has_member("kallsyms"): + return self.kallsyms.symtab + elif self.has_member("symtab"): + return self.symtab + except exceptions.InvalidAddressException: + vollog.debug(f"Page fault encountered when accessing symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + return None raise AttributeError("Unable to get symtab") @property def num_symtab(self): - if self.has_member("kallsyms"): - return int(self.kallsyms.num_symtab) - elif self.has_member("num_symtab"): - return int(self.member("num_symtab")) + try: + if self.has_member("kallsyms"): + return int(self.kallsyms.num_symtab) + elif self.has_member("num_symtab"): + return int(self.member("num_symtab")) + except exceptions.InvalidAddressException: + vollog.debug(f"Page fault encountered when accessing num_symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + return None raise AttributeError("Unable to determine number of symbols") @property def section_strtab(self): - # Newer kernels - if self.has_member("kallsyms"): - return self.kallsyms.strtab - # Older kernels - elif self.has_member("strtab"): - return self.strtab + try: + # Newer kernels + if self.has_member("kallsyms"): + return self.kallsyms.strtab + # Older kernels + elif self.has_member("strtab"): + return self.strtab + except exceptions.InvalidAddressException: + vollog.debug(f"Page fault encountered when accessing strtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + return None raise AttributeError("Unable to get strtab") @property def section_typetab(self): - if self.has_member("kallsyms") and self.kallsyms.has_member("typetab"): - # kernels >= 4.5 8244062ef1e54502ef55f54cced659913f244c3e: kallsyms was added - # kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b: types have its own array - return self.kallsyms.typetab + try: + if self.has_member("kallsyms") and self.kallsyms.has_member("typetab"): + # kernels >= 4.5 8244062ef1e54502ef55f54cced659913f244c3e: kallsyms was added + # kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b: types have its own array + return self.kallsyms.typetab + except exceptions.InvalidAddressException: + vollog.debug(f"Page fault encountered when accessing typetab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + return None raise AttributeError("Unable to get typetab section, it needs a kernel >= 5.2") @@ -385,14 +401,18 @@ class module(generic.GenericIntelProcess): Returns: A single-character string representing the symbol type """ - if self.has_member("kallsyms") and self.kallsyms.has_member("typetab"): - # kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b types have its own array - layer = self._context.layers[self.vol.layer_name] - sym_type = layer.read(self.section_typetab + symbol_index, 1) - sym_type = sym_type.decode("utf-8", errors="ignore") - else: - # kernels < 5.2 the type was stored in the st_info - sym_type = chr(symbol.st_info) + try: + if self.has_member("kallsyms") and self.kallsyms.has_member("typetab"): + # kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b types have its own array + layer = self._context.layers[self.vol.layer_name] + sym_type = layer.read(self.section_typetab + symbol_index, 1) + sym_type = sym_type.decode("utf-8", errors="ignore") + else: + # kernels < 5.2 the type was stored in the st_info + sym_type = chr(symbol.st_info) + except exceptions.InvalidAddressException: + vollog.debug(f"Page fault encountered when accessing symbol type of index {symbol_index} of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + return None return sym_type From e48d2972a6e44bb01fc5c2f4eafa28b91d1e4071 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 17:46:25 -0500 Subject: [PATCH 0842/1352] Add needed checks to prevent backtraces in ELF parsing --- .../symbols/linux/extensions/__init__.py | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 524f2a7c6..959d33c60 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -343,7 +343,9 @@ class module(generic.GenericIntelProcess): elif self.has_member("symtab"): return self.symtab except exceptions.InvalidAddressException: - vollog.debug(f"Page fault encountered when accessing symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + vollog.debug( + f"Page fault encountered when accessing symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}" + ) return None raise AttributeError("Unable to get symtab") @@ -356,7 +358,9 @@ class module(generic.GenericIntelProcess): elif self.has_member("num_symtab"): return int(self.member("num_symtab")) except exceptions.InvalidAddressException: - vollog.debug(f"Page fault encountered when accessing num_symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + vollog.debug( + f"Page fault encountered when accessing num_symtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}" + ) return None raise AttributeError("Unable to determine number of symbols") @@ -371,7 +375,9 @@ class module(generic.GenericIntelProcess): elif self.has_member("strtab"): return self.strtab except exceptions.InvalidAddressException: - vollog.debug(f"Page fault encountered when accessing strtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + vollog.debug( + f"Page fault encountered when accessing strtab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}" + ) return None raise AttributeError("Unable to get strtab") @@ -384,7 +390,9 @@ class module(generic.GenericIntelProcess): # kernels >= 5.2 1c7651f43777cdd59c1aaa82c87324d3e7438c7b: types have its own array return self.kallsyms.typetab except exceptions.InvalidAddressException: - vollog.debug(f"Page fault encountered when accessing typetab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + vollog.debug( + f"Page fault encountered when accessing typetab of ELF at {self.vol.offset:#x} in {self.vol.layer_name}" + ) return None raise AttributeError("Unable to get typetab section, it needs a kernel >= 5.2") @@ -411,7 +419,9 @@ class module(generic.GenericIntelProcess): # kernels < 5.2 the type was stored in the st_info sym_type = chr(symbol.st_info) except exceptions.InvalidAddressException: - vollog.debug(f"Page fault encountered when accessing symbol type of index {symbol_index} of ELF at {self.vol.offset:#x} in {self.vol.layer_name}") + vollog.debug( + f"Page fault encountered when accessing symbol type of index {symbol_index} of ELF at {self.vol.offset:#x} in {self.vol.layer_name}" + ) return None return sym_type From 07b74fd8e30753612610b712514ca1f5e5a0b93a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 18:28:13 -0500 Subject: [PATCH 0843/1352] Add typing to functions in modules class --- .../symbols/linux/extensions/__init__.py | 33 ++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 959d33c60..6767650dc 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -99,13 +99,13 @@ class module(generic.GenericIntelProcess): return self.mem[module_mem_index] - def _get_mem_size(self, mod_mem_type_name): + def _get_mem_size(self, mod_mem_type_name) -> int: return self._get_mem_type(mod_mem_type_name).size - def _get_mem_base(self, mod_mem_type_name): + def _get_mem_base(self, mod_mem_type_name) -> int: return self._get_mem_type(mod_mem_type_name).base - def get_module_base(self): + def get_module_base(self) -> int: if self.has_member("mem"): # kernels 6.4+ return self._get_mem_base("MOD_TEXT") elif self.has_member("core_layout"): @@ -115,7 +115,7 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to get module base") - def get_init_size(self): + def get_init_size(self) -> int: if self.has_member("mem"): # kernels 6.4+ return ( self._get_mem_size("MOD_INIT_TEXT") @@ -129,7 +129,7 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to determine .init section size of module") - def get_core_size(self): + def get_core_size(self) -> int: if self.has_member("mem"): # kernels 6.4+ return ( self._get_mem_size("MOD_TEXT") @@ -144,7 +144,7 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to determine core size of module") - def get_core_text_size(self): + def get_core_text_size(self) -> int: if self.has_member("mem"): # kernels 6.4+ return self._get_mem_size("MOD_TEXT") elif self.has_member("core_layout"): @@ -154,7 +154,7 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to determine core text size of module") - def get_module_core(self): + def get_module_core(self) -> objects.Pointer: if self.has_member("mem"): # kernels 6.4+ return self._get_mem_base("MOD_TEXT") elif self.has_member("core_layout"): @@ -163,7 +163,7 @@ class module(generic.GenericIntelProcess): return self.module_core raise AttributeError("Unable to get module core") - def get_module_init(self): + def get_module_init(self) -> objects.Pointer: if self.has_member("mem"): # kernels 6.4+ return self._get_mem_base("MOD_INIT_TEXT") elif self.has_member("init_layout"): @@ -172,9 +172,12 @@ class module(generic.GenericIntelProcess): return self.module_init raise AttributeError("Unable to get module init") - def get_name(self): + def get_name(self) -> Optional[str]: """Get the name of the module as a string""" - return utility.array_to_string(self.name) + try: + return utility.array_to_string(self.name) + except exceptions.InvalidAddressException: + return None def _get_sect_count(self, grp: interfaces.objects.ObjectInterface) -> int: """Try to determine the number of valid sections""" @@ -336,7 +339,7 @@ class module(generic.GenericIntelProcess): return None @property - def section_symtab(self): + def section_symtab(self) -> Optional[interfaces.objects.ObjectInterface]: try: if self.has_member("kallsyms"): return self.kallsyms.symtab @@ -351,7 +354,7 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to get symtab") @property - def num_symtab(self): + def num_symtab(self) -> Optional[int]: try: if self.has_member("kallsyms"): return int(self.kallsyms.num_symtab) @@ -366,7 +369,7 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to determine number of symbols") @property - def section_strtab(self): + def section_strtab(self) -> Optional[interfaces.objects.ObjectInterface]: try: # Newer kernels if self.has_member("kallsyms"): @@ -383,7 +386,7 @@ class module(generic.GenericIntelProcess): raise AttributeError("Unable to get strtab") @property - def section_typetab(self): + def section_typetab(self) -> Optional[interfaces.objects.ObjectInterface]: try: if self.has_member("kallsyms") and self.kallsyms.has_member("typetab"): # kernels >= 4.5 8244062ef1e54502ef55f54cced659913f244c3e: kallsyms was added @@ -399,7 +402,7 @@ class module(generic.GenericIntelProcess): def get_symbol_type( self, symbol: interfaces.objects.ObjectInterface, symbol_index: int - ) -> str: + ) -> Optional[str]: """Determines the type of a given ELF symbol. Args: From 7146b45fa7571da210be13c2c341f2a3a5c52133 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 17:41:35 +0000 Subject: [PATCH 0844/1352] Create versioned parent class for all plugins that enumerate Linux kernel modules. Convert plugins to new method. --- .../framework/plugins/linux/check_modules.py | 36 ++++---- .../framework/plugins/linux/hidden_modules.py | 66 +++++++------- volatility3/framework/plugins/linux/lsmod.py | 45 +++------- .../symbols/linux/utilities/modules.py | 85 ++++++++++++++++++- 4 files changed, 145 insertions(+), 87 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 44cb568e6..246f2450d 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -3,25 +3,26 @@ # import logging -from typing import List, Dict +from typing import List, Dict, Generator import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, renderers, deprecation +from volatility3.framework import interfaces, deprecation from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility -from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.linux import extensions vollog = logging.getLogger(__name__) -class Check_modules(plugins.PluginInterface): +class Check_modules(linux_utilities_modules.ModuleDisplayPlugin): """Compares module list to sysfs info, if available""" - _version = (2, 0, 0) + _version = (3, 0, 0) _required_framework_version = (2, 0, 0) + def __init__(self, *args, **kwargs): + super().__init__(self.compare_kset_and_lsmod, *args, **kwargs) + @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ @@ -31,9 +32,9 @@ class Check_modules(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 0), + name="linux_utilities_modules_module_display_plugin", + component=linux_utilities_modules.ModuleDisplayPlugin, + version=(1, 0, 0), ), ] @@ -48,23 +49,20 @@ class Check_modules(plugins.PluginInterface): ) -> Dict[str, extensions.module]: return linux_utilities_modules.Modules.get_kset_modules(context, vmlinux_name) - def _generator(self): + @classmethod + def compare_kset_and_lsmod( + cls, context: str, vmlinux_name: str + ) -> Generator[extensions.module, None, None]: kset_modules = linux_utilities_modules.Modules.get_kset_modules( - self.context, self.config["kernel"] + context=context, vmlinux_name=vmlinux_name ) lsmod_modules = set( str(utility.array_to_string(modules.name)) for modules in linux_utilities_modules.Modules.list_modules( - self.context, self.config["kernel"] + context=context, vmlinux_module_name=vmlinux_name ) ) for mod_name in set(kset_modules.keys()).difference(lsmod_modules): - yield (0, (format_hints.Hex(kset_modules[mod_name]), str(mod_name))) - - def run(self): - return renderers.TreeGrid( - [("Module Address", format_hints.Hex), ("Module Name", str)], - self._generator(), - ) + yield kset_modules[mod_name] diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 985d4cfcb..dd473a8f7 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -6,19 +6,22 @@ from typing import List, Set, Tuple, Iterable from volatility3.framework.symbols.linux.utilities import ( modules as linux_utilities_modules, ) -from volatility3.framework import renderers, interfaces, exceptions, deprecation +from volatility3.framework import interfaces, exceptions, deprecation from volatility3.framework.constants import architectures -from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.linux import extensions vollog = logging.getLogger(__name__) -class Hidden_modules(interfaces.plugins.PluginInterface): +class Hidden_modules(linux_utilities_modules.ModuleDisplayPlugin): """Carves memory to find hidden kernel modules""" _required_framework_version = (2, 10, 0) - _version = (2, 0, 0) + _version = (3, 0, 0) + + def __init__(self, *args, **kwargs): + super().__init__(self.find_hidden_modules, *args, **kwargs) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -29,9 +32,9 @@ class Hidden_modules(interfaces.plugins.PluginInterface): architectures=architectures.LINUX_ARCHS, ), requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 0), + name="linux_utilities_modules_module_display_plugin", + component=linux_utilities_modules.ModuleDisplayPlugin, + version=(1, 0, 0), ), ] @@ -165,38 +168,29 @@ class Hidden_modules(interfaces.plugins.PluginInterface): } return known_module_addresses - def _generator(self): - vmlinux_module_name = self.config["kernel"] - known_module_addresses = self.get_lsmod_module_addresses( - self.context, vmlinux_module_name - ) - modules_memory_boundaries = ( - linux_utilities_modules.Modules.get_modules_memory_boundaries( - self.context, vmlinux_module_name - ) - ) - - for module in linux_utilities_modules.Modules.get_hidden_modules( - self.context, - vmlinux_module_name, - known_module_addresses, - modules_memory_boundaries, - ): - module_addr = module.vol.offset - module_name = module.get_name() or renderers.NotAvailableValue() - fields = (format_hints.Hex(module_addr), module_name) - yield (0, fields) - - def run(self): - if self.context.symbol_space.verify_table_versions( + @classmethod + def find_hidden_modules( + cls, context, vmlinux_module_name: str + ) -> extensions.module: + if context.symbol_space.verify_table_versions( "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0) ): raise exceptions.SymbolSpaceError( "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later" ) - headers = [ - ("Address", format_hints.Hex), - ("Name", str), - ] - return renderers.TreeGrid(headers, self._generator()) + known_module_addresses = cls.get_lsmod_module_addresses( + context, vmlinux_module_name + ) + modules_memory_boundaries = ( + linux_utilities_modules.Modules.get_modules_memory_boundaries( + context, vmlinux_module_name + ) + ) + + yield from linux_utilities_modules.Modules.get_hidden_modules( + context, + vmlinux_module_name, + known_module_addresses, + modules_memory_boundaries, + ) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 466bfa0b4..30d494d55 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -7,20 +7,20 @@ import logging from typing import List, Iterable import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import exceptions, renderers, interfaces, deprecation +from volatility3.framework import interfaces, deprecation from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins -from volatility3.framework.objects import utility -from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) -class Lsmod(plugins.PluginInterface): +class Lsmod(linux_utilities_modules.ModuleDisplayPlugin): """Lists loaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _version = (3, 0, 0) + + def __init__(self, *args, **kwargs): + super().__init__(linux_utilities_modules.ModuleGathererLsmod, *args, **kwargs) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -31,9 +31,14 @@ class Lsmod(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 0), + name="linux_utilities_modules_gatherers_lsmod", + component=linux_utilities_modules.ModuleGathererLsmod, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_modules_module_display_plugin", + component=linux_utilities_modules.ModuleDisplayPlugin, + version=(1, 0, 0), ), ] @@ -49,25 +54,3 @@ class Lsmod(plugins.PluginInterface): return linux_utilities_modules.Modules.list_modules( context, vmlinux_module_name ) - - def _generator(self): - try: - for module in linux_utilities_modules.Modules.list_modules( - self.context, self.config["kernel"] - ): - mod_size = module.get_init_size() + module.get_core_size() - - mod_name = utility.array_to_string(module.name) - - yield 0, (format_hints.Hex(module.vol.offset), mod_name, mod_size) - - except exceptions.SymbolError: - vollog.warning( - "The required symbol 'module' is not present in symbol table. Please check that kernel modules are enabled for the system under analysis." - ) - - def run(self): - return renderers.TreeGrid( - [("Offset", format_hints.Hex), ("Name", str), ("Size", int)], - self._generator(), - ) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 8f1b5b67d..a2f6a942b 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -21,11 +21,15 @@ from volatility3.framework import ( deprecation, exceptions, objects, + renderers, ) - +from volatility3.framework.constants import architectures +from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions +from volatility3.framework.interfaces import plugins +from volatility3.framework.symbols.linux.utilities import tainting vollog = logging.getLogger(__name__) @@ -684,3 +688,82 @@ class ModuleGatherers( ) return reqs + + +class ModuleDisplayPlugin(plugins.PluginInterface): + """ + Plugins that enumerate kernel modules (lsmod, check_modules, etc.) + must inherit from this class to have unified output columns across plugins. + The constructor of the plugin must call super() with the `implementation` set + """ + + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + framework.require_interface_version(*_required_framework_version) + + def __init__(self, implementation, *args, **kwargs): + super().__init__(*args, **kwargs) + self.implementation = implementation + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=Modules, + version=(3, 0, 0), + ), + requirements.VersionRequirement( + name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) + ), + ] + + def _generator(self): + """ + Uses the implementation set in the constructor call to produce consistent output fields + across module gathering plugins + """ + for module in self.implementation(self.context, self.config["kernel"]): + try: + name = utility.array_to_string(module.name) + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to recover name for module {module.vol.offset:#x} from implementation {self.implementation}" + ) + continue + + code_size = format_hints.Hex( + module.get_init_size() + module.get_core_size() + ) + + taints = ",".join( + tainting.Tainting.get_taints_parsed( + self.context, self.config["kernel"], module.taints, True + ) + ) + + yield 0, ( + format_hints.Hex(module.vol.offset), + name, + format_hints.Hex(code_size), + taints, + renderers.NotAvailableValue(), # will become the load arguments after this inital conversion is merged + ) + + def run(self): + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Module Name", str), + ("Code Size", format_hints.Hex), + ("Taints", str), + ("Load Arguments", str), + ], + self._generator(), + ) From 971f06996b54deda6cab6e0d48b01146c83ad519 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 18:02:03 +0000 Subject: [PATCH 0845/1352] bump version on kallsyms --- volatility3/framework/symbols/linux/kallsyms.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index 368169757..945342ea9 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -305,6 +305,7 @@ class Kallsyms(interfaces.configuration.VersionableInterface): def _assert_versions(cls) -> None: """Verify versions of shared dependencies""" linux_utilities_modules_version_required = (3, 0, 0) + if not requirements.VersionRequirement.matches_required( linux_utilities_modules_version_required, linux_utilities_modules.Modules.version, From f906bde338d8298c69d3e8db6faa6664f935a25b Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 18:22:19 +0000 Subject: [PATCH 0846/1352] change lmsod call --- volatility3/framework/plugins/linux/lsmod.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 30d494d55..d01a25afa 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -20,7 +20,7 @@ class Lsmod(linux_utilities_modules.ModuleDisplayPlugin): _version = (3, 0, 0) def __init__(self, *args, **kwargs): - super().__init__(linux_utilities_modules.ModuleGathererLsmod, *args, **kwargs) + super().__init__(linux_utilities_modules.Modules.list_modules, *args, **kwargs) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -31,9 +31,9 @@ class Lsmod(linux_utilities_modules.ModuleDisplayPlugin): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="linux_utilities_modules_gatherers_lsmod", - component=linux_utilities_modules.ModuleGathererLsmod, - version=(1, 0, 0), + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 0), ), requirements.VersionRequirement( name="linux_utilities_modules_module_display_plugin", From 00c4a13567d2fb2bc14aa291bb9ab7c7aab02a75 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 18:58:55 -0500 Subject: [PATCH 0847/1352] remove errant space --- volatility3/framework/symbols/linux/kallsyms.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index 945342ea9..368169757 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -305,7 +305,6 @@ class Kallsyms(interfaces.configuration.VersionableInterface): def _assert_versions(cls) -> None: """Verify versions of shared dependencies""" linux_utilities_modules_version_required = (3, 0, 0) - if not requirements.VersionRequirement.matches_required( linux_utilities_modules_version_required, linux_utilities_modules.Modules.version, From 93be148534308a47e06ceefbecf64ccdeaba50ee Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 19:04:02 -0500 Subject: [PATCH 0848/1352] Change how the inheritance is performed --- volatility3/framework/plugins/linux/check_modules.py | 5 ++++- volatility3/framework/plugins/linux/hidden_modules.py | 5 ++++- volatility3/framework/plugins/linux/lsmod.py | 3 ++- volatility3/framework/symbols/linux/utilities/modules.py | 2 +- 4 files changed, 11 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 246f2450d..55865deb8 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -10,11 +10,14 @@ from volatility3.framework import interfaces, deprecation from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) -class Check_modules(linux_utilities_modules.ModuleDisplayPlugin): +class Check_modules( + linux_utilities_modules.ModuleDisplayPlugin, plugins.PluginInterface +): """Compares module list to sysfs info, if available""" _version = (3, 0, 0) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index dd473a8f7..56b36e2cb 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -10,11 +10,14 @@ from volatility3.framework import interfaces, exceptions, deprecation from volatility3.framework.constants import architectures from volatility3.framework.configuration import requirements from volatility3.framework.symbols.linux import extensions +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) -class Hidden_modules(linux_utilities_modules.ModuleDisplayPlugin): +class Hidden_modules( + linux_utilities_modules.ModuleDisplayPlugin, plugins.PluginInterface +): """Carves memory to find hidden kernel modules""" _required_framework_version = (2, 10, 0) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index d01a25afa..71f36ecc9 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -9,11 +9,12 @@ from typing import List, Iterable import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.framework import interfaces, deprecation from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) -class Lsmod(linux_utilities_modules.ModuleDisplayPlugin): +class Lsmod(linux_utilities_modules.ModuleDisplayPlugin, plugins.PluginInterface): """Lists loaded kernel modules.""" _required_framework_version = (2, 0, 0) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index a2f6a942b..b5b5b28a2 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -690,7 +690,7 @@ class ModuleGatherers( return reqs -class ModuleDisplayPlugin(plugins.PluginInterface): +class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): """ Plugins that enumerate kernel modules (lsmod, check_modules, etc.) must inherit from this class to have unified output columns across plugins. From 0667a408364394dc56f7bcf080f5c26c92171c39 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 19:06:02 -0500 Subject: [PATCH 0849/1352] Removed unused import --- volatility3/framework/symbols/linux/utilities/modules.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index b5b5b28a2..b8466d097 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -28,7 +28,6 @@ from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions -from volatility3.framework.interfaces import plugins from volatility3.framework.symbols.linux.utilities import tainting vollog = logging.getLogger(__name__) From 06a4c5639533657d32eda56b927aa0a826406829 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 17 Mar 2025 20:15:18 -0500 Subject: [PATCH 0850/1352] Update for new accessing method --- .../framework/plugins/linux/check_modules.py | 45 ++++++----- .../framework/plugins/linux/hidden_modules.py | 77 +++++++++---------- volatility3/framework/plugins/linux/lsmod.py | 7 +- .../symbols/linux/utilities/modules.py | 6 +- 4 files changed, 65 insertions(+), 70 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 55865deb8..5a43bf899 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -15,16 +15,33 @@ from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) -class Check_modules( - linux_utilities_modules.ModuleDisplayPlugin, plugins.PluginInterface -): +class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" _version = (3, 0, 0) _required_framework_version = (2, 0, 0) - def __init__(self, *args, **kwargs): - super().__init__(self.compare_kset_and_lsmod, *args, **kwargs) + @classmethod + def compare_kset_and_lsmod( + cls, context: str, vmlinux_name: str + ) -> Generator[extensions.module, None, None]: + kset_modules = linux_utilities_modules.Modules.get_kset_modules( + context=context, vmlinux_name=vmlinux_name + ) + + lsmod_modules = set( + str(utility.array_to_string(modules.name)) + for modules in linux_utilities_modules.Modules.list_modules( + context=context, vmlinux_module_name=vmlinux_name + ) + ) + + for mod_name in set(kset_modules.keys()).difference(lsmod_modules): + yield kset_modules[mod_name] + + run = linux_utilities_modules.ModuleDisplayPlugin.run + _generator = linux_utilities_modules.ModuleDisplayPlugin.generator + implementation = compare_kset_and_lsmod @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -51,21 +68,3 @@ class Check_modules( cls, context: interfaces.context.ContextInterface, vmlinux_name: str ) -> Dict[str, extensions.module]: return linux_utilities_modules.Modules.get_kset_modules(context, vmlinux_name) - - @classmethod - def compare_kset_and_lsmod( - cls, context: str, vmlinux_name: str - ) -> Generator[extensions.module, None, None]: - kset_modules = linux_utilities_modules.Modules.get_kset_modules( - context=context, vmlinux_name=vmlinux_name - ) - - lsmod_modules = set( - str(utility.array_to_string(modules.name)) - for modules in linux_utilities_modules.Modules.list_modules( - context=context, vmlinux_module_name=vmlinux_name - ) - ) - - for mod_name in set(kset_modules.keys()).difference(lsmod_modules): - yield kset_modules[mod_name] diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 56b36e2cb..c6f5d749e 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -15,16 +15,49 @@ from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) -class Hidden_modules( - linux_utilities_modules.ModuleDisplayPlugin, plugins.PluginInterface -): +class Hidden_modules(plugins.PluginInterface): """Carves memory to find hidden kernel modules""" _required_framework_version = (2, 10, 0) _version = (3, 0, 0) - def __init__(self, *args, **kwargs): - super().__init__(self.find_hidden_modules, *args, **kwargs) + @classmethod + def get_hidden_modules( + cls, + context: interfaces.context.ContextInterface, + vmlinux_module_name: str, + known_module_addresses: Set[int], + modules_memory_boundaries: Tuple, + ) -> Iterable[interfaces.objects.ObjectInterface]: + """Enumerate hidden modules by taking advantage of memory address alignment patterns + + This technique is much faster and uses less memory than the traditional scan method + in Volatility2, but it doesn't work with older kernels. + + From kernels 4.2 struct module allocation are aligned to the L1 cache line size. + In i386/amd64/arm64 this is typically 64 bytes. However, this can be changed in + the Linux kernel configuration via CONFIG_X86_L1_CACHE_SHIFT. The alignment can + also be obtained from the DWARF info i.e. DW_AT_alignment<64>, but dwarf2json + doesn't support this feature yet. + In kernels < 4.2, alignment attributes are absent in the struct module, meaning + alignment cannot be guaranteed. Therefore, for older kernels, it's better to use + the traditional scan technique. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + vmlinux_module_name: The name of the kernel module on which to operate + known_module_addresses: Set with known module addresses + modules_memory_boundaries: Minimum and maximum address boundaries for module allocation. + Yields: + module objects + """ + return linux_utilities_modules.get_hidden_modules( + vmlinux_module_name, known_module_addresses, modules_memory_boundaries + ) + + run = linux_utilities_modules.ModuleDisplayPlugin.run + _generator = linux_utilities_modules.ModuleDisplayPlugin.generator + implementation = linux_utilities_modules.Modules.list_modules @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -88,40 +121,6 @@ class Hidden_modules( removal_date="2025-09-25", replacement_version=(3, 0, 0), ) - @classmethod - def get_hidden_modules( - cls, - context: interfaces.context.ContextInterface, - vmlinux_module_name: str, - known_module_addresses: Set[int], - modules_memory_boundaries: Tuple, - ) -> Iterable[interfaces.objects.ObjectInterface]: - """Enumerate hidden modules by taking advantage of memory address alignment patterns - - This technique is much faster and uses less memory than the traditional scan method - in Volatility2, but it doesn't work with older kernels. - - From kernels 4.2 struct module allocation are aligned to the L1 cache line size. - In i386/amd64/arm64 this is typically 64 bytes. However, this can be changed in - the Linux kernel configuration via CONFIG_X86_L1_CACHE_SHIFT. The alignment can - also be obtained from the DWARF info i.e. DW_AT_alignment<64>, but dwarf2json - doesn't support this feature yet. - In kernels < 4.2, alignment attributes are absent in the struct module, meaning - alignment cannot be guaranteed. Therefore, for older kernels, it's better to use - the traditional scan technique. - - Args: - context: The context to retrieve required elements (layers, symbol tables) from - vmlinux_module_name: The name of the kernel module on which to operate - known_module_addresses: Set with known module addresses - modules_memory_boundaries: Minimum and maximum address boundaries for module allocation. - Yields: - module objects - """ - return linux_utilities_modules.get_hidden_modules( - vmlinux_module_name, known_module_addresses, modules_memory_boundaries - ) - @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.validate_alignment_patterns, diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 71f36ecc9..3029d2541 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -14,14 +14,15 @@ from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) -class Lsmod(linux_utilities_modules.ModuleDisplayPlugin, plugins.PluginInterface): +class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" _required_framework_version = (2, 0, 0) _version = (3, 0, 0) - def __init__(self, *args, **kwargs): - super().__init__(linux_utilities_modules.Modules.list_modules, *args, **kwargs) + run = linux_utilities_modules.ModuleDisplayPlugin.run + _generator = linux_utilities_modules.ModuleDisplayPlugin.generator + implementation = linux_utilities_modules.Modules.list_modules @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index b8466d097..0b4dea997 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -701,10 +701,6 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): framework.require_interface_version(*_required_framework_version) - def __init__(self, implementation, *args, **kwargs): - super().__init__(*args, **kwargs) - self.implementation = implementation - @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ @@ -723,7 +719,7 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): ), ] - def _generator(self): + def generator(self): """ Uses the implementation set in the constructor call to produce consistent output fields across module gathering plugins From 2795c7cdd2ad2899508faf423656581958eadec0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 19 Mar 2025 15:36:18 -0500 Subject: [PATCH 0851/1352] Windows: Fix raw Dpc offset calculation The original code was still returning this as a pointer that ended up dereferenced in later steps. However, this pointer value actually needs to be cast to an `unsigned long long` and decoded first. --- .../symbols/windows/extensions/__init__.py | 21 +++++++------------ 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 933178c91..091d6ceb5 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -22,9 +22,8 @@ from volatility3.framework.interfaces.objects import ObjectInterface from volatility3.framework.layers import intel from volatility3.framework.objects import utility from volatility3.framework.renderers import conversion -from volatility3.framework.symbols import generic +from volatility3.framework.symbols import generic, windows from volatility3.framework.symbols.windows.extensions import pool -from volatility3.framework.symbols import windows vollog = logging.getLogger(__name__) @@ -1222,17 +1221,13 @@ class KTIMER(objects.StructType): return "-" def get_raw_dpc(self): - """Returns the encoded DPC since it may not look like a pointer after encoding""" - symbol_table_name = self.get_symbol_table_name() - pointer_type = self._context.symbol_space.get_type( - symbol_table_name + constants.BANG + "pointer" - ) - - return self._context.object( - object_type=pointer_type, - layer_name=self.vol.layer_name, - offset=self.Dpc.vol.offset, - ) + """Returns the encoded DPC as an unsigned long long since the pointer is actually encoded""" + if symbols.symbol_table_is_64bit( + context=self._context, symbol_table_name=self.get_symbol_table_name() + ): + return self.Dpc.cast("unsigned long long") + else: + return self.Dpc.cast("unsigned long") def valid_type(self): return self.Header.Type in self.VALID_TYPES From bfe50889b0c51088615db29dd86ca50f1b0ca852 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 19 Mar 2025 17:32:09 -0500 Subject: [PATCH 0852/1352] Add the recovery and reporting of LKM load parameters --- .../symbols/linux/utilities/modules.py | 237 +++++++++++++++++- 1 file changed, 234 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 0b4dea997..f987c352e 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -70,7 +70,7 @@ class ModuleGathererInterface( class Modules(interfaces.configuration.VersionableInterface): """Kernel modules related utilities.""" - _version = (3, 0, 0) + _version = (3, 0, 1) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) @@ -558,6 +558,231 @@ class Modules(interfaces.configuration.VersionableInterface): """ return all(addr % address_alignment == 0 for addr in addresses) + @classmethod + def _get_param_handlers( + cls, context: interfaces.context.ContextInterface, vmlinux_name: str + ) -> Tuple[Dict[int, str], Dict[str, Optional[int]]]: + """ + This function builds the dictionaries needed to map kernel parameters to their types + We need these values and information to properly decode each parameter to its input representation + """ + kernel = context.modules[vmlinux_name] + + # All the integer type parameters + pairs = { + "param_get_invbool": "int", + "param_get_bool": "int", + "param_get_int": "int", + "param_get_ulong": "long unsigned int", + "param_get_ullong": "long long unsigned int", + "param_get_long": "long int", + "param_get_uint": "unsigned int", + "param_get_ushort": "short unsigned int", + "param_get_short": "short int", + "param_get_byte": "char", + } + + int_handlers: Dict[int, str] = {} + + for sym_name, val_type in pairs.items(): + try: + sym_address = kernel.get_absolute_symbol_address(sym_name) + except exceptions.SymbolError: + continue + + int_handlers[sym_address] = val_type + + # Strings, arrays, booleans + getters = { + "param_get_string": None, + "param_array_get": None, + "param_get_charp": None, + "param_get_bool": None, + "param_get_invbool": None, + } + + for sym_name in getters: + try: + sym_address = kernel.get_absolute_symbol_address(sym_name) + except exceptions.SymbolError: + continue + + getters[sym_name] = sym_address + + return int_handlers, getters + + @classmethod + def _get_param_val( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + int_handlers, + getters, + module, + param, + ) -> Optional[Union[str, int]]: + """ + Properly determines the type of a parameter and decodes based on the type. + The type is determined by examining its `get` function, which will be a pointer to + predefined operations handler for particular parameter types. + """ + + # Attempt to retrieve the `get` pointer. Bail if smeared + try: + if hasattr(param, "get"): + param_func = param.get + else: + param_func = param.ops.get + + except exceptions.InvalidAddressException: + return None + + if not param_func: + return None + + kernel = context.modules[vmlinux_name] + + # For arrays, recusively get the value of each member as the type can be different + if param_func == getters["param_array_get"]: + array = param.arr + + if array.num: + max_index = array.num.dereference() + else: + max_index = array.member("max") + + if max_index > 32: + vollog.debug( + f"Skipping array parameter with invalid index for module {module.vol.offset:#x}" + ) + return None + + element_vals = [] + for i in range(max_index): + kp = kernel.object( + object_type="kernel_param", + offset=array.elem + (array.elemsize * i), + absolute=True, + ) + + element_vals.append( + cls._get_param_val( + context, vmlinux_name, int_handlers, getters, module, kp + ) + ) + + # nothing was gathered + if not element_vals: + return None + + return ",".join([str(ele) for ele in element_vals]) + + # strings types + elif param_func in [getters["param_get_string"], getters["param_get_charp"]]: + try: + if param_func == getters["param_get_string"]: + count = param.member("str").maxlen + else: + count = 256 + + return utility.pointer_to_string(param.member("str"), count=count) + except exceptions.InvalidAddressException: + vollog.debug( + f"Skipping string parameter with invalid address for module {module.vol.offset:#x}" + ) + return None + + # The integer handles, which also encompass boolean handlers + elif param_func in int_handlers: + try: + int_value = kernel.object( + object_type=int_handlers[param_func], offset=param.arg + ) + except exceptions.InvalidAddressException: + vollog.debug( + f"Skipping {int_handlers[param_func]} parameter with invalid address for module {module.vol.offset:#x}" + ) + return None + + if param_func == getters["param_get_bool"]: + if int_value == 0: + return "N" + else: + return "Y" + elif param_func == getters["param_get_invbool"]: + if int_value == 0: + return "Y" + else: + return "N" + else: + return int_value + + else: + handler_symbol = kernel.get_symbols_by_absolute_location(param_func) + + msg = f"Unknown kernel parameter handling function ({handler_symbol}) at address {param_func:#x} for module at {module.vol.offset:#x}" + + # If a new kernel has a handler symbol we don't support then we want to always see that information + # If the handler doesn't map to a kernel symbol then its smeared/invalid + if handler_symbol: + vollog.warning(msg) + else: + vollog.debug(msg) + + return None + + @classmethod + def get_load_parameters( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + module: extensions.module, + ) -> Generator[Tuple[str, Optional[Union[str, int]]], None, None]: + """ + Recovers the load parameters of the given kernel module + Returns a tuple (key,value) for each parameter + """ + if not hasattr(module, "kp"): + vollog.debug( + "kp member missing for struct module. Cannot recover parameters." + ) + return None + + if module.num_kp > 128: + vollog.debug( + f"Smeared number of parameters ({module.num_kp}) found for module at offset {module.vol.offset:#x}" + ) + return None + + kernel = context.modules[vmlinux_name] + + int_handlers, getters = cls._get_param_handlers(context, vmlinux_name) + + # Build the array of parameters + param_array = kernel.object( + object_type="array", + offset=module.kp.dereference().vol.offset, + subtype=kernel.get_type("kernel_param"), + count=module.num_kp, + absolute=True, + ) + + for i in range(len(param_array)): + try: + param = param_array[i] + name = utility.pointer_to_string(param.name, count=32) + except exceptions.InvalidAddressException: + vollog.debug( + f"Smeared load parameter module at offset {module.vol.offset:#x}" + ) + continue + + value = cls._get_param_val( + context, vmlinux_name, int_handlers, getters, module, param + ) + + yield name, value + class ModuleGathererLsmod(ModuleGathererInterface): """ @@ -712,7 +937,7 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): requirements.VersionRequirement( name="linux_utilities_modules", component=Modules, - version=(3, 0, 0), + version=(3, 0, 1), ), requirements.VersionRequirement( name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) @@ -743,12 +968,18 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): ) ) + parameters_iter = Modules.get_load_parameters( + self.context, self.config["kernel"], module + ) + + parameters = ", ".join([f"{key}={value}" for key, value in parameters_iter]) + yield 0, ( format_hints.Hex(module.vol.offset), name, format_hints.Hex(code_size), taints, - renderers.NotAvailableValue(), # will become the load arguments after this inital conversion is merged + parameters, ) def run(self): From 741a4ea8097a2c1211425a99660eb08ab6f055a4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 19 Mar 2025 23:49:45 +0000 Subject: [PATCH 0853/1352] Hopefully final round of kallsym fixes --- .../framework/plugins/linux/kallsyms.py | 8 +++-- .../symbols/linux/extensions/__init__.py | 24 +++++++++++-- .../framework/symbols/linux/kallsyms.py | 36 ++++++++++++++----- 3 files changed, 55 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py index 47861d91a..54f1adc70 100644 --- a/volatility3/framework/plugins/linux/kallsyms.py +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -73,6 +73,9 @@ class Kallsyms(plugins.PluginInterface): # resulting in incorrect values. Unfortunately, there isn't much that can be done # in such cases. # See comments on .init.scratch in arch/x86/kernel/vmlinux.lds.S for details + if not kassymbol or not kassymbol.size: + return renderers.NotAvailableValue() + return kassymbol.size if kassymbol.size >= 0 else renderers.NotAvailableValue() def _generator(self): @@ -95,6 +98,7 @@ class Kallsyms(plugins.PluginInterface): include_core = include_modules = include_ftrace = include_bpf = True symbol_generators = [] + if include_core: symbol_generators.append(kas.get_core_symbols()) if include_modules: @@ -116,9 +120,9 @@ class Kallsyms(plugins.PluginInterface): symbol_size = self._get_symbol_size(kassymbol) fields = ( format_hints.Hex(kassymbol.address), - kassymbol.type, + kassymbol.type or renderers.NotAvailableValue(), symbol_size, - kassymbol.exported, + kassymbol.exported or renderers.NotAvailableValue(), kassymbol.subsystem, kassymbol.module_name, kassymbol.name, diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index ae958411a..e998b55dd 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3053,7 +3053,7 @@ class kernel_symbol(objects.StructType): long_mask = (1 << layer.bits_per_register) - 1 return (self.vol.offset + off) & long_mask - def get_name(self) -> str: + def _do_get_name(self) -> str: if self.has_member("name_offset"): # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y # See 7290d58095712a89f845e1bca05334796dd49ed2 @@ -3073,7 +3073,13 @@ class kernel_symbol(objects.StructType): return name_bytes.decode("utf-8", errors="ignore") - def get_value(self) -> int: + def get_name(self) -> Optional[str]: + try: + return self._do_get_name() + except exceptions.InvalidAddressException: + return None + + def _do_get_value(self) -> int: if self.has_member("value_offset"): # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y # See 7290d58095712a89f845e1bca05334796dd49ed2 @@ -3084,7 +3090,13 @@ class kernel_symbol(objects.StructType): raise AttributeError("Unsupported kernel_symbol type implementation") - def get_namespace(self) -> str: + def _do_get_value(self) -> Optional[int]: + try: + return self._do_get_value() + except exceptions.InvalidAddressException: + return None + + def _do_get_namespace(self) -> str: if self.has_member("namespace_offset"): # kernel >= 4.19 and CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y # See 7290d58095712a89f845e1bca05334796dd49ed2 @@ -3103,3 +3115,9 @@ class kernel_symbol(objects.StructType): namespace_bytes = namespace_bytes[:idx] return namespace_bytes.decode("utf-8", errors="ignore") + + def get_namespace(self) -> Optional[str]: + try: + return self._do_get_namespace() + except exceptions.InvalidAddressException: + return None diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index 368169757..35aba3ca5 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -186,7 +186,10 @@ class KASSymbol(KASSymbolBasic): # If lowercase, the symbol is usually local; if uppercase, the symbol is # global (external). There are however a few lowercase symbols that are shown # for special global symbols ("u", "v" and "w"). - self.exported = bool(self.type.isupper() or self.type in ("u", "v", "w")) + if self.type: + self.exported = bool(self.type.isupper() or self.type in ("u", "v", "w")) + else: + self.exported = None @functools.cached_property def type_description(self) -> Optional[str]: @@ -200,10 +203,12 @@ class KASSymbol(KASSymbolBasic): if symbol_type_description: return symbol_type_description - # Otherwise, use the lowercase version - symbol_type_description = linux_constants.NM_TYPES_DESC.get( - self.type.lower(), None - ) + if self.type: + # Otherwise, use the lowercase version + symbol_type_description = linux_constants.NM_TYPES_DESC.get( + self.type.lower(), None + ) + return symbol_type_description @@ -767,7 +772,13 @@ class Kallsyms(interfaces.configuration.VersionableInterface): self._kas_config.stop_ksymtab, ) - return kernel_symbol is not None and kernel_symbol.get_value() == address + if kernel_symbol is not None: + if hasattr(kernel_symbol, "get_value"): + return kernel_symbol.get_value() == address + else: + return kernel_symbol.vol.offset == address + + return None def _elfsym_to_kassymbol( self, @@ -1094,7 +1105,9 @@ class Kallsyms(interfaces.configuration.VersionableInterface): name: str, other: str, ) -> int: - if name == other: + if name is None or other is None: + return None + elif name == other: return 0 elif name < other: return -1 @@ -1315,7 +1328,14 @@ class Kallsyms(interfaces.configuration.VersionableInterface): # Even when bpf_jit_kallsyms is disabled (/proc/sys/net/core/bpf_jit_kallsyms = 0), # this function will still be able to gather the symbols. - bpf_kallsyms_list = vmlinux.object_from_symbol("bpf_kallsyms") + try: + bpf_kallsyms_list = vmlinux.object_from_symbol("bpf_kallsyms") + except exceptions.SymbolError: + vollog.debug( + "`bpf_kallsyms` symbol not present in the symbol table. Cannot proceed." + ) + return None + for elem in bpf_kallsyms_list.to_list(list_type_symname, list_head_member): try: # See kernel's bpf_get_kallsym() From 508cbd3a17d4d970abfa7415a785d28ad1df4e9e Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 19 Mar 2025 23:51:29 +0000 Subject: [PATCH 0854/1352] Fix function name --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index e998b55dd..b9ce84ed1 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3090,7 +3090,7 @@ class kernel_symbol(objects.StructType): raise AttributeError("Unsupported kernel_symbol type implementation") - def _do_get_value(self) -> Optional[int]: + def get_value(self) -> Optional[int]: try: return self._do_get_value() except exceptions.InvalidAddressException: From 548657c309591b5592e0ea28e38bd29ee1eb991c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 20 Mar 2025 15:02:22 +0000 Subject: [PATCH 0855/1352] Change None check to remove False booleans --- volatility3/framework/plugins/linux/kallsyms.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/kallsyms.py b/volatility3/framework/plugins/linux/kallsyms.py index 54f1adc70..c8bca03f7 100644 --- a/volatility3/framework/plugins/linux/kallsyms.py +++ b/volatility3/framework/plugins/linux/kallsyms.py @@ -118,11 +118,17 @@ class Kallsyms(plugins.PluginInterface): # the last symbol, resulting in a negative size. # See comments on .init.scratch in arch/x86/kernel/vmlinux.lds.S for details symbol_size = self._get_symbol_size(kassymbol) + + if kassymbol.exported is None: + exported = renderers.NotAvailableValue() + else: + exported = kassymbol.exported + fields = ( format_hints.Hex(kassymbol.address), kassymbol.type or renderers.NotAvailableValue(), symbol_size, - kassymbol.exported or renderers.NotAvailableValue(), + exported, kassymbol.subsystem, kassymbol.module_name, kassymbol.name, From 7b9fb916722a0678b666be0f02dd59b13c769951 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 20 Mar 2025 14:23:24 -0500 Subject: [PATCH 0856/1352] Objects: create `get_raw_value()` method for Pointer This creates a `get_raw_value()` method for the `Pointer` class that allows users to access the raw (unmasked) value of a pointer. This was required in order to decode the encoded `Dpc` pointer that is part of the `_KTIMER` Windows type. Addition of this type was favored over a cast to `unsigned long` or `unsigned long long` due to the potential for future instability of this type due to compiler changes. See https://github.com/volatilityfoundation/volatility3/issues/1041 for further discussion around the conversion of `log unsigned int` to `unsigned long` in `clang`. See https://github.com/volatilityfoundation/volatility3/pull/1177#discussion_r1650049299 for the original discussion around how to access this pointer in the `Timers` plugin. --- volatility3/framework/objects/__init__.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index 39ce6f59f..9dd30db63 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -410,6 +410,19 @@ class Pointer(Integer): value = int.from_bytes(data, byteorder=endian, signed=signed) return value & mask + def get_raw_value(self) -> int: + formats = { + 4: "I", + 8: "Q", + } + length = self.vol.data_format.length + endian = self.vol.data_format.byteorder + raw_data = self._context.layers[self.vol.layer_name].read( + self.vol.offset, length + ) + struct_format = ("<" if endian == "little" else ">") + formats[length] + return struct.unpack(struct_format, raw_data)[0] + def dereference( self, layer_name: Optional[str] = None ) -> interfaces.objects.ObjectInterface: From a8ea3aae011827b174760ecfa05de42a49e33fca Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 20 Mar 2025 14:32:04 -0500 Subject: [PATCH 0857/1352] Extensions: Removes the `get_raw_dpc` method from `KTIMER` This removes the `get_raw_dpc` method from the `KTIMER` extension class. This method was inaccurate in that it actually returns the masked pointer value instead of the full 64-bit value encoded in that member, which is required in order to correctly decode the 'real' pointer. The invocation of `get_raw_dpc()` was replaced with `self.Dpc.get_raw_value()`, which was added in the previous commit. --- .../framework/symbols/windows/extensions/__init__.py | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 091d6ceb5..75608cfc6 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -1220,15 +1220,6 @@ class KTIMER(objects.StructType): return "Yes" return "-" - def get_raw_dpc(self): - """Returns the encoded DPC as an unsigned long long since the pointer is actually encoded""" - if symbols.symbol_table_is_64bit( - context=self._context, symbol_table_name=self.get_symbol_table_name() - ): - return self.Dpc.cast("unsigned long long") - else: - return self.Dpc.cast("unsigned long") - def valid_type(self): return self.Header.Type in self.VALID_TYPES @@ -1263,7 +1254,7 @@ class KTIMER(objects.StructType): ) low_byte = (wait_never) & 0xFF - entry = utility.rol(self.get_raw_dpc() ^ wait_never, low_byte) + entry = utility.rol(self.Dpc.get_raw_value() ^ wait_never, low_byte) swap_xor = self._context.layers[self.vol.native_layer_name].canonicalize( self.vol.offset ) From 144fd3139ae18a4aa785c5e4df3c323b24a67692 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 20 Mar 2025 14:38:19 -0500 Subject: [PATCH 0858/1352] Framework: Minor version bump Made an additive change to `Pointer` by adding the `get_raw_value()` method, so bumping the minor version here. The `get_raw_dpc()` method was removed from the `KTIMER` extension class, which is currently unversioned. --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 1ea59c068..f5da4c75b 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 24 # Number of changes that only add to the interface +VERSION_MINOR = 25 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" From 1e175b5d3bf25dbc674bc2bda800c82b737cca70 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 20 Mar 2025 15:11:37 -0500 Subject: [PATCH 0859/1352] Objects: rework new `get_raw_value()` method Per code review recommendations, splits the `_unmarshall` classmethod into two components, one of which retrieves the raw value, and the other that returns the masked pointer. The `get_raw_value` method now calls the `_get_raw_value` classmethod using its instance information. --- volatility3/framework/objects/__init__.py | 35 ++++++++++++++--------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index 9dd30db63..b863e103b 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -402,26 +402,35 @@ class Pointer(Integer): pointer should be recast. The "pointer" must always live within the space (even if the data provided is invalid). """ + mask = context.layers[object_info.native_layer_name].address_mask + new = ( + cls._get_raw_value( + context, data_format, object_info.layer_name, object_info.offset + ) + & mask + ) + return new + + @classmethod + def _get_raw_value( + cls, + context: interfaces.context.ContextInterface, + data_format: DataFormatInfo, + layer_name: str, + offset: int, + ) -> int: length, endian, signed = data_format if signed: raise ValueError("Pointers cannot have signed values") - mask = context.layers[object_info.native_layer_name].address_mask - data = context.layers.read(object_info.layer_name, object_info.offset, length) + data = context.layers.read(layer_name, offset, length) value = int.from_bytes(data, byteorder=endian, signed=signed) - return value & mask + return value def get_raw_value(self) -> int: - formats = { - 4: "I", - 8: "Q", - } - length = self.vol.data_format.length - endian = self.vol.data_format.byteorder - raw_data = self._context.layers[self.vol.layer_name].read( - self.vol.offset, length + raw = self._get_raw_value( + self._context, self.vol.data_format, self.vol.layer_name, self.vol.offset ) - struct_format = ("<" if endian == "little" else ">") + formats[length] - return struct.unpack(struct_format, raw_data)[0] + return raw def dereference( self, layer_name: Optional[str] = None From c4589a51d51d441838812f32ef1a97b9c328d8dc Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 20 Mar 2025 15:13:26 -0500 Subject: [PATCH 0860/1352] Timers: Adds debug log statement to catch-all exception --- volatility3/framework/plugins/windows/timers.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index 1f100bf1c..07313c004 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -131,6 +131,7 @@ class Timers(interfaces.plugins.PluginInterface): ): if not timer.valid_type(): continue + try: dpc = timer.get_dpc() if dpc == 0: @@ -138,7 +139,10 @@ class Timers(interfaces.plugins.PluginInterface): if dpc.DeferredRoutine == 0: continue deferred_routine = dpc.DeferredRoutine - except Exception: + except Exception as exc: + vollog.debug( + f"Failed to get _KTIMER.Dpc: {exc.__class__.__name__} {str(exc)}" + ) continue module_symbols = list( From d097d6abeb278de346601c6ee7570aa5383bbb73 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 20 Mar 2025 15:18:08 -0500 Subject: [PATCH 0861/1352] Timers: convert general Exception to InvalidAddressException --- volatility3/framework/plugins/windows/timers.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index 07313c004..f530a4c7b 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -11,6 +11,7 @@ from volatility3.framework import ( interfaces, constants, symbols, + exceptions, ) from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints @@ -139,9 +140,9 @@ class Timers(interfaces.plugins.PluginInterface): if dpc.DeferredRoutine == 0: continue deferred_routine = dpc.DeferredRoutine - except Exception as exc: + except exceptions.InvalidAddressException as exc: vollog.debug( - f"Failed to get _KTIMER.Dpc: {exc.__class__.__name__} {str(exc)}" + f"Failed to get _KTIMER.Dpc due to {exc.__class__.__name__}" ) continue From 6763031df87d7f830117c593d9132b60b781cb4a Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 21 Mar 2025 20:28:23 +0000 Subject: [PATCH 0862/1352] Add performance event plugin to detect eBPF malware --- .../plugins/linux/tracing/perf_events.py | 138 ++++++++++++++++++ 1 file changed, 138 insertions(+) create mode 100644 volatility3/framework/plugins/linux/tracing/perf_events.py diff --git a/volatility3/framework/plugins/linux/tracing/perf_events.py b/volatility3/framework/plugins/linux/tracing/perf_events.py new file mode 100644 index 000000000..5d629bd21 --- /dev/null +++ b/volatility3/framework/plugins/linux/tracing/perf_events.py @@ -0,0 +1,138 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List, Tuple, Generator, Optional + +from volatility3.framework import renderers, interfaces, constants, exceptions +from volatility3.framework.renderers import format_hints +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.plugins.linux import pslist + +vollog = logging.getLogger(__name__) + + +class PerfEvents(plugins.PluginInterface): + """Lists performance events for each process.""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.PluginRequirement( + name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + ), + ] + + @classmethod + def list_perf_events(cls, context, vmlinux_module_name: str) -> Generator[ + Tuple[ + interfaces.objects.ObjectInterface, + interfaces.objects.ObjectInterface, + Optional[str], + Optional[str], + Optional[str], + Optional[int], + ], + None, + None, + ]: + """ + Walks the `perf_event_list` of each `task_struct` and reports valid event structures found + This plugin is one of several to detect eBPF based malware + + Args: + context: + vmlinux_module_name: + + Returns: + A tuple of the task struct, performance event object, event name, program name, full name, and program address + """ + vmlinux = context.modules[vmlinux_module_name] + + if not vmlinux.has_type("perf_event") or not vmlinux.get_type( + "perf_event" + ).has_member("owner_entry"): + vollog.warning( + "This kernel does not have performance events enabled (CONFIG_PERF_EVENTS). Cannot proceed." + ) + return + + for task in pslist.PsList.list_tasks( + context, vmlinux_module_name, include_threads=True + ): + + # walk the list of perf_event entries for this process + for event in task.perf_event_list.to_list( + vmlinux.symbol_table_name + constants.BANG + "perf_event", "owner_entry" + ): + # if the names are smeared then bail + try: + event_name = utility.pointer_to_string(event.pmu.name, count=64) + try: + full_name = utility.array_to_string( + event.prog.aux.ksym.name, count=512 + ) + except AttributeError: + full_name = renderers.NotApplicableValue() + + program_name = utility.array_to_string(event.prog.aux.name) + except exceptions.InvalidAddressException: + continue + + # if the kernel has the prog member then ensure it is not 0 + if hasattr(event, "prog"): + program_address = event.prog + if program_address == 0: + continue + + program_address = format_hints.Hex(program_address) + + else: + program_address = renderers.NotAvailableValue() + + yield task, event_name, program_name, full_name, program_address + + def _generator(self): + for ( + task, + event_name, + program_name, + full_name, + program_address, + ) in self.list_perf_events(self.context, self.config["kernel"]): + task_name = utility.array_to_string(task.comm) + + yield ( + 0, + ( + task.pid, + task_name, + event_name, + program_name, + full_name, + program_address, + ), + ) + + def run(self) -> renderers.TreeGrid: + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Event", str), + ("Short Program Name", str), + ("Full Name", str), + ("Address", format_hints.Hex), + ], + self._generator(), + ) From 55151f546d0e1ccc65c034075eaaaba324cf4734 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 22 Nov 2024 11:46:04 +0000 Subject: [PATCH 0863/1352] Initial work on adding a LayerData renderer type --- volatility3/framework/interfaces/renderers.py | 32 ++++++++++++++++--- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index e26164ee7..477d743d1 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -9,8 +9,10 @@ renderer interface which can interact with a TreeGrid to produce suitable output. """ +from dataclasses import dataclass import datetime -from abc import abstractmethod, ABCMeta +from volatility3.framework import interfaces +from abc import ABCMeta, abstractmethod from collections import abc from typing import ( Any, @@ -20,9 +22,9 @@ from typing import ( List, NamedTuple, Optional, - TypeVar, - Type, Tuple, + Type, + TypeVar, Union, ) @@ -124,6 +126,13 @@ class Disassembly: self.offset = offset +@dataclass +class LayerData(object): + layer_name: str + offset: int + length: int + + # We don't class these off a shared base, because the BaseTypes must only # contain the types that the validator will accept (which would not include the base) @@ -136,6 +145,7 @@ BaseTypes = Union[ Type[datetime.datetime], Type[BaseAbsentValue], Type[Disassembly], + Type[LayerData], ] ColumnsType = List[Tuple[str, BaseTypes]] VisitorSignature = Callable[[TreeNode, _Type], _Type] @@ -163,7 +173,12 @@ class TreeGrid(metaclass=ABCMeta): Disassembly, ) - def __init__(self, columns: ColumnsType, generator: Generator) -> None: + def __init__( + self, + columns: ColumnsType, + generator: Generator, + context: Optional[interfaces.context.ContextInterface] = None, + ) -> None: """Constructs a TreeGrid object using a specific set of columns. The TreeGrid itself is a root element, that can have children but no values. @@ -174,6 +189,15 @@ class TreeGrid(metaclass=ABCMeta): columns: A list of column tuples made up of (name, type). generator: An iterable containing row for a tree grid, each row contains a indent level followed by the values for each column in order. """ + self._context = context + + @property + def context(self) -> Optional[interfaces.context.ContextInterface]: + """Returns the context value for the tree grid (to retrieve data items) + + This is a property to ensure the renderers don't try changing the context for any reason + """ + return self._context @staticmethod @abstractmethod From 453f52ba3e192643b8729a45e0d0bb6b4dd5d7d0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 31 Dec 2024 23:04:58 +0000 Subject: [PATCH 0864/1352] CLI: Add in concept of CellRenderer --- volatility3/cli/text_renderer.py | 74 +++++++++++-------- volatility3/framework/interfaces/renderers.py | 58 ++++++++++++--- 2 files changed, 92 insertions(+), 40 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index b1944ae5a..6cfd10ced 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -9,10 +9,11 @@ import random import string import sys from functools import wraps -from typing import Any, Callable, Dict, List, Tuple +from typing import Any, Callable, Dict, List, Tuple, TypeVar from volatility3.cli import text_filter from volatility3.framework import exceptions, interfaces, renderers +from volatility3.framework.interfaces.renderers import BaseAbsentValue from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -79,8 +80,9 @@ def multitypedata_as_text(value: format_hints.MultiTypeData) -> str: return string_representation.split("\x00")[0] return hex_bytes_as_text(value) +T = TypeVar("T") -def optional(func: Callable) -> Callable: +def optional(func: Callable[[BaseAbsentValue| T], str]) -> Callable[[T], str]: @wraps(func) def wrapped(x: Any) -> str: if isinstance(x, interfaces.renderers.BaseAbsentValue): @@ -137,9 +139,41 @@ def display_disassembly(disasm: interfaces.renderers.Disassembly) -> str: return QuickTextRenderer._type_renderers[bytes](disasm.data) +class CLITypeRenderer(interfaces.renderers.TypeRendererInterface): + def __init__(self, func): + super().__init__(func = optional(func)) + + +class LayerDataRenderer(CLITypeRenderer): + """Renders a LayerData object into data/bytes""" + def __init__(self): + def render(data: interfaces.renderers.LayerData| BaseAbsentValue): + if isinstance(data, BaseAbsentValue): + # FIXME: Do something cleverer here + return "" + data = data.context.layers[data.layer_name].read(data.offset, data.length) + return " ".join(f"{b:02x}" for b in data) + + render_func = render + return super().__init__(render_func) + + class CLIRenderer(interfaces.renderers.Renderer): """Class to add specific requirements for CLI renderers.""" + _type_renderers = { + format_hints.Bin: CLITypeRenderer(lambda x: f"0b{x:b}"), + format_hints.Hex: CLITypeRenderer(lambda x: f"0x{x:x}"), + format_hints.HexBytes: CLITypeRenderer(hex_bytes_as_text), + format_hints.MultiTypeData: CLITypeRenderer(multitypedata_as_text), + interfaces.renderers.Disassembly: CLITypeRenderer(display_disassembly), + bytes: CLITypeRenderer(lambda x: " ".join(f"{b:02x}" for b in x)), + interfaces.renderers.LayerData: LayerDataRenderer(), + datetime.datetime: CLITypeRenderer(lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z")), + "default": CLITypeRenderer(lambda x: f"{x}"), + } + + name = "unnamed" structured_output = False filter: text_filter.CLIFilter = None @@ -170,21 +204,11 @@ class CLIRenderer(interfaces.renderers.Renderer): class QuickTextRenderer(CLIRenderer): - _type_renderers = { - format_hints.Bin: optional(lambda x: f"0b{x:b}"), - format_hints.Hex: optional(lambda x: f"0x{x:x}"), - format_hints.HexBytes: optional(hex_bytes_as_text), - format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), - interfaces.renderers.Disassembly: optional(display_disassembly), - bytes: optional(lambda x: " ".join(f"{b:02x}" for b in x)), - datetime.datetime: optional(lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z")), - "default": optional(lambda x: f"{x}"), - } name = "quick" def get_render_options(self): - pass + return [] def render(self, grid: interfaces.renderers.TreeGrid) -> None: """Renders each column immediately to stdout. @@ -242,7 +266,7 @@ class NoneRenderer(CLIRenderer): name = "none" def get_render_options(self): - pass + return [] def render(self, grid: interfaces.renderers.TreeGrid) -> None: if not grid.populated: @@ -250,22 +274,12 @@ class NoneRenderer(CLIRenderer): class CSVRenderer(CLIRenderer): - _type_renderers = { - format_hints.Bin: optional(lambda x: f"0b{x:b}"), - format_hints.Hex: optional(lambda x: f"0x{x:x}"), - format_hints.HexBytes: optional(hex_bytes_as_text), - format_hints.MultiTypeData: optional(multitypedata_as_text), - interfaces.renderers.Disassembly: optional(display_disassembly), - bytes: optional(lambda x: " ".join(f"{b:02x}" for b in x)), - datetime.datetime: optional(lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z")), - "default": optional(lambda x: f"{x}"), - } name = "csv" structured_output = True def get_render_options(self): - pass + return [] def render(self, grid: interfaces.renderers.TreeGrid) -> None: """Renders each row immediately to stdout. @@ -316,12 +330,10 @@ class CSVRenderer(CLIRenderer): class PrettyTextRenderer(CLIRenderer): - _type_renderers = QuickTextRenderer._type_renderers - name = "pretty" def get_render_options(self): - pass + return [] def render(self, grid: interfaces.renderers.TreeGrid) -> None: """Renders each column immediately to stdout. @@ -380,7 +392,7 @@ class PrettyTextRenderer(CLIRenderer): accumulator.append((node.path_depth, line)) return accumulator - final_output: List[Tuple[int, Dict[interfaces.renderers.Column, bytes]]] = [] + final_output: List[Tuple[int, Dict[interfaces.renderers.Column, str]]] = [] if not grid.populated: grid.populate(visitor, final_output) else: @@ -418,7 +430,7 @@ class PrettyTextRenderer(CLIRenderer): del line[column] else: line[column] = line[column] + ( - [""] * (nums_line - len(line[column])) + "" * (nums_line - len(line[column])) ) for index in range(nums_line): if index == 0: @@ -463,7 +475,7 @@ class JsonRenderer(CLIRenderer): structured_output = True def get_render_options(self) -> List[interfaces.renderers.RenderOption]: - pass + return [] def output_result(self, outfd, result): """Outputs the JSON data to a file in a particular format""" diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index 477d743d1..6aa0ad7aa 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -9,9 +9,8 @@ renderer interface which can interact with a TreeGrid to produce suitable output. """ -from dataclasses import dataclass +import dataclasses import datetime -from volatility3.framework import interfaces from abc import ABCMeta, abstractmethod from collections import abc from typing import ( @@ -27,6 +26,14 @@ from typing import ( TypeVar, Union, ) +from typing import Dict +import functools + +from volatility3.framework import interfaces + + +class BaseAbsentValue: + """Class that represents values which are not present for some reason.""" class Column(NamedTuple): @@ -36,11 +43,34 @@ class Column(NamedTuple): RenderOption = Any +T = TypeVar("T") + +class TypeRendererInterface: + type = T + + def __init__(self, func: Optional[Callable] = None, options: Optional[Dict[str, Any]] = None): + self._options = options or {} + setattr(self, "render", func) + + @property + def options(self): + return self._options + + def render(self, data: T|BaseAbsentValue) -> Any: + """Renders a specific datatype""" + return "" + + def __call__(self, data: T|BaseAbsentValue) -> Any: + """Shortcut for render""" + return self.render(data) + class Renderer(metaclass=ABCMeta): """Class that defines the interface that all output renderers must support.""" + _type_renderers: Dict[Union[Type, str], Callable] + def __init__(self, options: Optional[List[RenderOption]] = None) -> None: """Accepts an options object to configure the renderers.""" # FIXME: Once the config option objects are in place, put the _type_check in place @@ -104,10 +134,6 @@ class TreeNode(abc.Sequence, metaclass=ABCMeta): """ -class BaseAbsentValue: - """Class that represents values which are not present for some reason.""" - - class Disassembly: """A class to indicate that the bytes provided should be disassembled (based on the architecture)""" @@ -126,12 +152,24 @@ class Disassembly: self.offset = offset -@dataclass +@dataclasses.dataclass class LayerData(object): + """Layer data + + This requires the contex to be passed in, in case plugins want to use multiple contexts + and to ensure the TreeGrid interface doesn't change, since this would break all existing plugins""" + context: 'interfaces.context.ContextInterface' layer_name: str offset: int length: int + @staticmethod + def from_object(object: 'interfaces.objects.ObjectInterface', size: Optional[int] = None): + return LayerData(context = object._context, + layer_name = object.vol.layer_name, + offset = object.vol.offset, + length = size or object.vol.size) + # We don't class these off a shared base, because the BaseTypes must only # contain the types that the validator will accept (which would not include the base) @@ -164,6 +202,7 @@ class TreeGrid(metaclass=ABCMeta): and to create cycles. """ + # TODO: Figure out why this isn't just BaseTypes (which includes AbsentValues' base_types: ClassVar[Tuple] = ( int, str, @@ -171,13 +210,14 @@ class TreeGrid(metaclass=ABCMeta): bytes, datetime.datetime, Disassembly, + LayerData ) def __init__( self, columns: ColumnsType, generator: Generator, - context: Optional[interfaces.context.ContextInterface] = None, + context: Optional['interfaces.context.ContextInterface'] = None, ) -> None: """Constructs a TreeGrid object using a specific set of columns. @@ -192,7 +232,7 @@ class TreeGrid(metaclass=ABCMeta): self._context = context @property - def context(self) -> Optional[interfaces.context.ContextInterface]: + def context(self) -> Optional['interfaces.context.ContextInterface']: """Returns the context value for the tree grid (to retrieve data items) This is a property to ensure the renderers don't try changing the context for any reason From 1ecd75f6653981eae52de51ee322423a1bc5c9e0 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 9 Feb 2025 22:08:11 +0000 Subject: [PATCH 0865/1352] Core: Apply black to interfaces and the CLI --- volatility3/cli/text_renderer.py | 18 +++++----- volatility3/framework/interfaces/renderers.py | 35 ++++++++++++------- 2 files changed, 32 insertions(+), 21 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 6cfd10ced..07a8e3867 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -80,9 +80,11 @@ def multitypedata_as_text(value: format_hints.MultiTypeData) -> str: return string_representation.split("\x00")[0] return hex_bytes_as_text(value) + T = TypeVar("T") -def optional(func: Callable[[BaseAbsentValue| T], str]) -> Callable[[T], str]: + +def optional(func: Callable[[BaseAbsentValue | T], str]) -> Callable[[T], str]: @wraps(func) def wrapped(x: Any) -> str: if isinstance(x, interfaces.renderers.BaseAbsentValue): @@ -141,13 +143,14 @@ def display_disassembly(disasm: interfaces.renderers.Disassembly) -> str: class CLITypeRenderer(interfaces.renderers.TypeRendererInterface): def __init__(self, func): - super().__init__(func = optional(func)) + super().__init__(func=optional(func)) class LayerDataRenderer(CLITypeRenderer): """Renders a LayerData object into data/bytes""" + def __init__(self): - def render(data: interfaces.renderers.LayerData| BaseAbsentValue): + def render(data: interfaces.renderers.LayerData | BaseAbsentValue): if isinstance(data, BaseAbsentValue): # FIXME: Do something cleverer here return "" @@ -169,11 +172,12 @@ class CLIRenderer(interfaces.renderers.Renderer): interfaces.renderers.Disassembly: CLITypeRenderer(display_disassembly), bytes: CLITypeRenderer(lambda x: " ".join(f"{b:02x}" for b in x)), interfaces.renderers.LayerData: LayerDataRenderer(), - datetime.datetime: CLITypeRenderer(lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z")), + datetime.datetime: CLITypeRenderer( + lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z") + ), "default": CLITypeRenderer(lambda x: f"{x}"), } - name = "unnamed" structured_output = False filter: text_filter.CLIFilter = None @@ -429,9 +433,7 @@ class PrettyTextRenderer(CLIRenderer): if column in ignore_columns: del line[column] else: - line[column] = line[column] + ( - "" * (nums_line - len(line[column])) - ) + line[column] = line[column] + ("" * (nums_line - len(line[column]))) for index in range(nums_line): if index == 0: outfd.write( diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index 6aa0ad7aa..ec552cf62 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -45,10 +45,13 @@ RenderOption = Any T = TypeVar("T") + class TypeRendererInterface: type = T - def __init__(self, func: Optional[Callable] = None, options: Optional[Dict[str, Any]] = None): + def __init__( + self, func: Optional[Callable] = None, options: Optional[Dict[str, Any]] = None + ): self._options = options or {} setattr(self, "render", func) @@ -56,11 +59,11 @@ class TypeRendererInterface: def options(self): return self._options - def render(self, data: T|BaseAbsentValue) -> Any: + def render(self, data: T | BaseAbsentValue) -> Any: """Renders a specific datatype""" return "" - def __call__(self, data: T|BaseAbsentValue) -> Any: + def __call__(self, data: T | BaseAbsentValue) -> Any: """Shortcut for render""" return self.render(data) @@ -157,18 +160,24 @@ class LayerData(object): """Layer data This requires the contex to be passed in, in case plugins want to use multiple contexts - and to ensure the TreeGrid interface doesn't change, since this would break all existing plugins""" - context: 'interfaces.context.ContextInterface' + and to ensure the TreeGrid interface doesn't change, since this would break all existing plugins + """ + + context: "interfaces.context.ContextInterface" layer_name: str offset: int length: int @staticmethod - def from_object(object: 'interfaces.objects.ObjectInterface', size: Optional[int] = None): - return LayerData(context = object._context, - layer_name = object.vol.layer_name, - offset = object.vol.offset, - length = size or object.vol.size) + def from_object( + object: "interfaces.objects.ObjectInterface", size: Optional[int] = None + ): + return LayerData( + context=object._context, + layer_name=object.vol.layer_name, + offset=object.vol.offset, + length=size or object.vol.size, + ) # We don't class these off a shared base, because the BaseTypes must only @@ -210,14 +219,14 @@ class TreeGrid(metaclass=ABCMeta): bytes, datetime.datetime, Disassembly, - LayerData + LayerData, ) def __init__( self, columns: ColumnsType, generator: Generator, - context: Optional['interfaces.context.ContextInterface'] = None, + context: Optional["interfaces.context.ContextInterface"] = None, ) -> None: """Constructs a TreeGrid object using a specific set of columns. @@ -232,7 +241,7 @@ class TreeGrid(metaclass=ABCMeta): self._context = context @property - def context(self) -> Optional['interfaces.context.ContextInterface']: + def context(self) -> Optional["interfaces.context.ContextInterface"]: """Returns the context value for the tree grid (to retrieve data items) This is a property to ensure the renderers don't try changing the context for any reason From 4fd501d38fe1cadae269edcb1edd503290923103 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 9 Feb 2025 22:12:14 +0000 Subject: [PATCH 0866/1352] Core: Resolve ruff errors --- volatility3/framework/interfaces/renderers.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index ec552cf62..1fe61f88f 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -27,7 +27,6 @@ from typing import ( Union, ) from typing import Dict -import functools from volatility3.framework import interfaces @@ -156,7 +155,7 @@ class Disassembly: @dataclasses.dataclass -class LayerData(object): +class LayerData: """Layer data This requires the contex to be passed in, in case plugins want to use multiple contexts From 16d1b2697c7e2bc220028337d3e8b3350773f5b9 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 9 Feb 2025 22:16:40 +0000 Subject: [PATCH 0867/1352] Core: Fix typing for python < 3.10 --- volatility3/framework/interfaces/renderers.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index 1fe61f88f..f6cac1859 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -58,11 +58,11 @@ class TypeRendererInterface: def options(self): return self._options - def render(self, data: T | BaseAbsentValue) -> Any: + def render(self, data: Union[T,BaseAbsentValue] -> Any: """Renders a specific datatype""" return "" - def __call__(self, data: T | BaseAbsentValue) -> Any: + def __call__(self, data: Union[T, BaseAbsentValue]) -> Any: """Shortcut for render""" return self.render(data) From 45ee399623814b7737962bebc7ea89f1546fa1dd Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 9 Feb 2025 22:18:25 +0000 Subject: [PATCH 0868/1352] Core: Fix up yet another typo --- volatility3/framework/interfaces/renderers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index f6cac1859..e3fc02573 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -58,7 +58,7 @@ class TypeRendererInterface: def options(self): return self._options - def render(self, data: Union[T,BaseAbsentValue] -> Any: + def render(self, data: Union[T,BaseAbsentValue]) -> Any: """Renders a specific datatype""" return "" From d3a5883130f78fa7467ac24cfde49fbfc27acff4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 9 Feb 2025 22:24:33 +0000 Subject: [PATCH 0869/1352] Core: Fix up more bad typing operators --- volatility3/cli/text_renderer.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 07a8e3867..a13c64d0d 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -9,7 +9,7 @@ import random import string import sys from functools import wraps -from typing import Any, Callable, Dict, List, Tuple, TypeVar +from typing import Any, Callable, Dict, List, Tuple, TypeVar, Union from volatility3.cli import text_filter from volatility3.framework import exceptions, interfaces, renderers @@ -84,7 +84,7 @@ def multitypedata_as_text(value: format_hints.MultiTypeData) -> str: T = TypeVar("T") -def optional(func: Callable[[BaseAbsentValue | T], str]) -> Callable[[T], str]: +def optional(func: Callable[[Union[BaseAbsentValue, T]], str]) -> Callable[[T], str]: @wraps(func) def wrapped(x: Any) -> str: if isinstance(x, interfaces.renderers.BaseAbsentValue): @@ -150,7 +150,7 @@ class LayerDataRenderer(CLITypeRenderer): """Renders a LayerData object into data/bytes""" def __init__(self): - def render(data: interfaces.renderers.LayerData | BaseAbsentValue): + def render(data: Union[interfaces.renderers.LayerData, BaseAbsentValue]): if isinstance(data, BaseAbsentValue): # FIXME: Do something cleverer here return "" From ba82067dac96ebf3845e37addf3d0d71f0a84462 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 20:29:59 +0000 Subject: [PATCH 0870/1352] CLI: Add in initial LayerData renderer --- volatility3/cli/text_renderer.py | 61 ++++++++++++++++++++++++++++++-- 1 file changed, 59 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index a13c64d0d..a0b45e353 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -1,3 +1,5 @@ +from volatility3.framework.interfaces.layers import TranslationLayerInterface + # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # @@ -150,12 +152,67 @@ class LayerDataRenderer(CLITypeRenderer): """Renders a LayerData object into data/bytes""" def __init__(self): + self.context_byte_len = 0 + self.width = 16 + self.display_offset = False + self.display_hex = True + self.display_ascii = True + def render(data: Union[interfaces.renderers.LayerData, BaseAbsentValue]): if isinstance(data, BaseAbsentValue): # FIXME: Do something cleverer here return "" - data = data.context.layers[data.layer_name].read(data.offset, data.length) - return " ".join(f"{b:02x}" for b in data) + + layer = data.context.layers[data.layer_name] + # Map of the holes + error_bytes = set() + start_offset = data.offset - self.context_byte_len + end_offset = data.offset + data.length + self.context_byte_len + if isinstance(layer, interfaces.layers.TranslationLayerInterface): + error_bytes = set() + mapping = iter(layer.mapping(start_offset, end_offset, True)) + current_map = next(mapping) + for i in range(start_offset, end_offset): + # Run through the bytes, check if they're present + offset, sublength, _, _, _ = current_map + if i < offset: + error_bytes.add(i - start_offset) + if i > offset + sublength: + try: + current_map = next(mapping) + except StopIteration: + pass + offset, sublength, _, _, _ = current_map + if i > offset + sublength: + error_bytes.add(i - start_offset) + + # Padded data + specific_data = data.context.layers[data.layer_name].read( + start_offset, + end_offset - start_offset, + True, + ) + + printables = "" + output = "\n" + for count, byte in enumerate(specific_data): + output += f"{byte:02x} " + char = chr(byte) + printables += char if 0x20 <= byte <= 0x7E else "." + if count % self.width == self.width - 1: + output += printables + if count < len(specific_data) - 1: + output += "\n" + printables = "" + + # Handle leftovers when the length is not mutiple of width + if printables: + padding = self.width - len(printables) + output += " " * padding + output += printables + output += " " * padding + + return output render_func = render return super().__init__(render_func) From 1d5d981be180d2bdb19c643180d697e95a7a8385 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 21:19:59 +0000 Subject: [PATCH 0871/1352] Windows: Convert malfind to LayerData renderer --- .../framework/plugins/windows/malfind.py | 43 ++++++++++++++++--- 1 file changed, 36 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 33a20ee51..34ef9fb34 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import Iterable, Tuple +from typing import Iterable, Generator, Tuple from volatility3.framework import interfaces, symbols, exceptions from volatility3.framework import renderers @@ -88,6 +88,25 @@ class Malfind(interfaces.plugins.PluginInterface): symbol_table: str, proc: interfaces.objects.ObjectInterface, ) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]: + for vad, data_object in cls.list_injection_sites( + context, kernel_layer_name, symbol_table, proc + ): + yield vad, data_object.context.layers[data_object.layer_name].read( + data_object.offset, data_object.length + ) + + @classmethod + def list_injection_sites( + cls, + context: interfaces.context.ContextInterface, + kernel_layer_name: str, + symbol_table: str, + proc: interfaces.objects.ObjectInterface, + ) -> Generator[ + Tuple[interfaces.objects.ObjectInterface, interfaces.renderers.LayerData], + None, + None, + ]: """Generate memory regions for a process that may contain injected code. @@ -156,8 +175,15 @@ class Malfind(interfaces.plugins.PluginInterface): vollog.warning( f"[proc_id {proc_id}] Found suspicious DIRTY + {protection_string} page at {hex(dirty_page)}", ) - data = proc_layer.read(vad.get_start(), 64, pad=True) - yield vad, data + start = vad.get_start() + length = 64 + data = interfaces.renderers.LayerData( + context=context, + layer_name=proc_layer_name, + offset=start, + length=length, + ) + yield (vad, data) def _generator(self, procs): # determine if we're on a 32 or 64 bit kernel @@ -166,7 +192,7 @@ class Malfind(interfaces.plugins.PluginInterface): # set refined criteria to know when to add to "Notes" column refined_criteria = { b"MZ": "MZ header", - b"\x55\x8B": "PE header", + b"\x55\x8b": "PE header", b"\x55\x48": "Function prologue", b"\x55\x89": "Function prologue", } @@ -179,11 +205,14 @@ class Malfind(interfaces.plugins.PluginInterface): # by default, "Notes" column will be set to N/A process_name = utility.array_to_string(proc.ImageFileName) - for vad, data in self.list_injections( + for vad, data_object in self.list_injection_sites( self.context, kernel.layer_name, kernel.symbol_table_name, proc ): notes = renderers.NotApplicableValue() # Check for unique headers and update "Notes" column if criteria is met + data = data_object.context.layers[data_object.layer_name].read( + data_object.offset, data_object.length, True + ) if data[0:2] in refined_criteria: notes = refined_criteria[data[0:2]] @@ -231,7 +260,7 @@ class Malfind(interfaces.plugins.PluginInterface): vad.get_private_memory(), file_output, notes, - format_hints.HexBytes(data), + data_object, disasm, ), ) @@ -251,7 +280,7 @@ class Malfind(interfaces.plugins.PluginInterface): ("PrivateMemory", int), ("File output", str), ("Notes", str), - ("Hexdump", format_hints.HexBytes), + ("Hexdump", interfaces.renderers.LayerData), ("Disasm", interfaces.renderers.Disassembly), ], self._generator( From 2304ea4cbe340fa9829e9eb6c034b0e1c359cf59 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 21:44:55 +0000 Subject: [PATCH 0872/1352] Windows: Convert mftscan plugins to LayerData output --- volatility3/framework/plugins/windows/mftscan.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 2c5827a25..c6e6b8703 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -223,7 +223,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): content = attr.get_resident_filecontent() if content: - content = format_hints.HexBytes(content) + content = interfaces.renderers.LayerData.from_object(content) else: content = renderers.NotAvailableValue() @@ -387,7 +387,7 @@ class ADS(interfaces.plugins.PluginInterface): ("MFT Type", str), ("Filename", str), ("ADS Filename", str), - ("Hexdump", format_hints.HexBytes), + ("Hexdump", interfaces.renderers.LayerData), ], self._generator(), ) @@ -453,7 +453,7 @@ class ResidentData(interfaces.plugins.PluginInterface): ("Record Number", int), ("MFT Type", str), ("Filename", str), - ("Hexdump", format_hints.HexBytes), + ("Hexdump", interfaces.renderers.LayerData), ], self._generator(), ) From 2e8d18e7cb7621821e724515ed23bf3c8320234d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 21:51:14 +0000 Subject: [PATCH 0873/1352] Windows: Convert mbrscan over to LayerData output --- volatility3/framework/plugins/windows/mbrscan.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index 4d5198181..b279307d7 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -149,7 +149,12 @@ class MBRScan(interfaces.plugins.PluginInterface): interfaces.renderers.Disassembly( bootcode, 0, architecture ), - format_hints.HexBytes(bootcode), + interfaces.renderers.LayerData( + context=self.context, + layer_name=layer.name, + offset=mbr_start_offset, + length=bootcode_length, + ), ), ) @@ -257,7 +262,7 @@ class MBRScan(interfaces.plugins.PluginInterface): ("EndingSector", int), ("SectorInSize", format_hints.Hex), ("Disasm", interfaces.renderers.Disassembly), - ("Bootcode", format_hints.HexBytes), + ("Bootcode", interfaces.renderers.LayerData), ], self._generator(), ) From e936b33784138e4f0916b61ea1edc555d2fd5f39 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 21:52:15 +0000 Subject: [PATCH 0874/1352] CLI: Fix ruff check error --- volatility3/cli/text_renderer.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index a0b45e353..99bb9fe73 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -1,5 +1,3 @@ -from volatility3.framework.interfaces.layers import TranslationLayerInterface - # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # From 4145ef2c0d6e5760593a113054d5793c7798b614 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 22:10:09 +0000 Subject: [PATCH 0875/1352] Renderers: Add no_surrounding to LayerData and include MINOR version bump --- volatility3/cli/text_renderer.py | 6 ++++-- volatility3/framework/constants/_version.py | 2 +- volatility3/framework/interfaces/renderers.py | 8 ++++++-- volatility3/framework/plugins/windows/malfind.py | 1 + volatility3/framework/plugins/windows/mbrscan.py | 1 + 5 files changed, 13 insertions(+), 5 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 99bb9fe73..7b78f4dda 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -161,11 +161,13 @@ class LayerDataRenderer(CLITypeRenderer): # FIXME: Do something cleverer here return "" + context_byte_len = self.context_byte_len if not data.no_context else 0 + layer = data.context.layers[data.layer_name] # Map of the holes error_bytes = set() - start_offset = data.offset - self.context_byte_len - end_offset = data.offset + data.length + self.context_byte_len + start_offset = data.offset - context_byte_len + end_offset = data.offset + data.length + context_byte_len if isinstance(layer, interfaces.layers.TranslationLayerInterface): error_bytes = set() mapping = iter(layer.mapping(start_offset, end_offset, True)) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index f5da4c75b..64707b782 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,6 +1,6 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 25 # Number of changes that only add to the interface +VERSION_MINOR = 26 # Number of changes that only add to the interface VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index e3fc02573..1034a211b 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -58,7 +58,7 @@ class TypeRendererInterface: def options(self): return self._options - def render(self, data: Union[T,BaseAbsentValue]) -> Any: + def render(self, data: Union[T, BaseAbsentValue]) -> Any: """Renders a specific datatype""" return "" @@ -166,16 +166,20 @@ class LayerData: layer_name: str offset: int length: int + no_surrounding: bool = False @staticmethod def from_object( - object: "interfaces.objects.ObjectInterface", size: Optional[int] = None + object: "interfaces.objects.ObjectInterface", + size: Optional[int] = None, + no_surrounding: bool = True, ): return LayerData( context=object._context, layer_name=object.vol.layer_name, offset=object.vol.offset, length=size or object.vol.size, + no_surrounding=no_surrounding, ) diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 34ef9fb34..57ecbb062 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -182,6 +182,7 @@ class Malfind(interfaces.plugins.PluginInterface): layer_name=proc_layer_name, offset=start, length=length, + no_surrounding=True, ) yield (vad, data) diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index b279307d7..64cbdfc9d 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -154,6 +154,7 @@ class MBRScan(interfaces.plugins.PluginInterface): layer_name=layer.name, offset=mbr_start_offset, length=bootcode_length, + no_surrounding=True, ), ), ) From 85870a9a9427bd0cc6fdce598e6a47530612f235 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 22:14:22 +0000 Subject: [PATCH 0876/1352] Windows: Update the required framework version for plugins outputting LayerData --- volatility3/framework/plugins/windows/malfind.py | 2 +- volatility3/framework/plugins/windows/mbrscan.py | 2 +- volatility3/framework/plugins/windows/mftscan.py | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 57ecbb062..b04c21f52 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 4, 0) + _required_framework_version = (2, 22, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index 64cbdfc9d..c0db350fe 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class MBRScan(interfaces.plugins.PluginInterface): """Scans for and parses potential Master Boot Records (MBRs)""" - _required_framework_version = (2, 0, 1) + _required_framework_version = (2, 22, 0) _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index c6e6b8703..6f07effd6 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -326,7 +326,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): class ADS(interfaces.plugins.PluginInterface): """Scans for Alternate Data Stream""" - _required_framework_version = (2, 7, 0) + _required_framework_version = (2, 22, 0) _version = (1, 0, 1) @@ -396,7 +396,7 @@ class ADS(interfaces.plugins.PluginInterface): class ResidentData(interfaces.plugins.PluginInterface): """Scans for MFT Records with Resident Data""" - _required_framework_version = (2, 7, 0) + _required_framework_version = (2, 22, 0) _version = (1, 0, 1) From 94d6f4f1313a57a539844b7b9f85f3633dfd09e3 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 15 Feb 2025 22:27:10 +0000 Subject: [PATCH 0877/1352] CLI: Indicate missing bytes from padded bytes --- volatility3/cli/text_renderer.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 7b78f4dda..21816f866 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -196,9 +196,13 @@ class LayerDataRenderer(CLITypeRenderer): printables = "" output = "\n" for count, byte in enumerate(specific_data): - output += f"{byte:02x} " - char = chr(byte) - printables += char if 0x20 <= byte <= 0x7E else "." + if count not in error_bytes: + output += f"{byte:02x} " + char = chr(byte) + printables += char if 0x20 <= byte <= 0x7E else "." + else: + output += "__ " + printables += "." if count % self.width == self.width - 1: output += printables if count < len(specific_data) - 1: From 6af8cd09f07f5bf4331885f482ffacde3470a72c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 16:12:14 +0000 Subject: [PATCH 0878/1352] Renderers: Add in fallback method for formatting cellrenderers --- volatility3/framework/interfaces/renderers.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index 1034a211b..618364bdf 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -153,6 +153,10 @@ class Disassembly: raise TypeError("Offset must be an integer type") self.offset = offset + def __str__(self) -> str: + """Fallback method of rendering""" + return str(self.data) + @dataclasses.dataclass class LayerData: @@ -182,6 +186,11 @@ class LayerData: no_surrounding=no_surrounding, ) + def __str__(self) -> str: + """Fallback method of rendering""" + data = self.context.layers[self.layer_name].read(self.offset, self.length, True) + return str(data) + # We don't class these off a shared base, because the BaseTypes must only # contain the types that the validator will accept (which would not include the base) From c18c6cbf3038454f9a67fe243af23702cfa28d49 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 16:39:53 +0000 Subject: [PATCH 0879/1352] Core: Shift renderers from interfaces --- volatility3/cli/text_renderer.py | 12 +-- volatility3/framework/interfaces/renderers.py | 65 +++++----------- .../framework/plugins/linux/malfind.py | 8 +- volatility3/framework/plugins/mac/malfind.py | 6 +- .../framework/plugins/windows/malfind.py | 12 ++- .../framework/plugins/windows/mbrscan.py | 18 ++--- .../framework/plugins/windows/mftscan.py | 6 +- volatility3/framework/renderers/__init__.py | 77 +++++++++++++++++++ 8 files changed, 121 insertions(+), 83 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 21816f866..1d39e3fa6 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -114,7 +114,7 @@ def quoted_optional(func: Callable) -> Callable: return wrapped -def display_disassembly(disasm: interfaces.renderers.Disassembly) -> str: +def display_disassembly(disasm: renderers.Disassembly) -> str: """Renders a disassembly renderer type into string format. Args: @@ -156,12 +156,12 @@ class LayerDataRenderer(CLITypeRenderer): self.display_hex = True self.display_ascii = True - def render(data: Union[interfaces.renderers.LayerData, BaseAbsentValue]): + def render(data: Union[renderers.LayerData, BaseAbsentValue]): if isinstance(data, BaseAbsentValue): # FIXME: Do something cleverer here return "" - context_byte_len = self.context_byte_len if not data.no_context else 0 + context_byte_len = self.context_byte_len if not data.no_surrounding else 0 layer = data.context.layers[data.layer_name] # Map of the holes @@ -230,9 +230,9 @@ class CLIRenderer(interfaces.renderers.Renderer): format_hints.Hex: CLITypeRenderer(lambda x: f"0x{x:x}"), format_hints.HexBytes: CLITypeRenderer(hex_bytes_as_text), format_hints.MultiTypeData: CLITypeRenderer(multitypedata_as_text), - interfaces.renderers.Disassembly: CLITypeRenderer(display_disassembly), + renderers.Disassembly: CLITypeRenderer(display_disassembly), bytes: CLITypeRenderer(lambda x: " ".join(f"{b:02x}" for b in x)), - interfaces.renderers.LayerData: LayerDataRenderer(), + renderers.LayerData: LayerDataRenderer(), datetime.datetime: CLITypeRenderer( lambda x: x.strftime("%Y-%m-%d %H:%M:%S.%f %Z") ), @@ -523,7 +523,7 @@ class PrettyTextRenderer(CLIRenderer): class JsonRenderer(CLIRenderer): _type_renderers = { format_hints.HexBytes: quoted_optional(hex_bytes_as_text), - interfaces.renderers.Disassembly: quoted_optional(display_disassembly), + renderers.Disassembly: quoted_optional(display_disassembly), format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), bytes: optional(lambda x: " ".join(f"{b:02x}" for b in x)), datetime.datetime: lambda x: ( diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index 618364bdf..b4c93cb3e 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -9,8 +9,8 @@ renderer interface which can interact with a TreeGrid to produce suitable output. """ -import dataclasses import datetime +import warnings from abc import ABCMeta, abstractmethod from collections import abc from typing import ( @@ -31,9 +31,19 @@ from typing import Dict from volatility3.framework import interfaces +class BasicType: + def __str__(self) -> str: + """Fallback method for rendering basic types""" + return str(self) + + class BaseAbsentValue: """Class that represents values which are not present for some reason.""" + def __str__(self) -> str: + """Fallback method for rendering basic types""" + return "-" + class Column(NamedTuple): name: str @@ -136,7 +146,7 @@ class TreeNode(abc.Sequence, metaclass=ABCMeta): """ -class Disassembly: +class Disassembly(BasicType): """A class to indicate that the bytes provided should be disassembled (based on the architecture)""" @@ -145,6 +155,10 @@ class Disassembly: def __init__( self, data: bytes, offset: int = 0, architecture: str = "intel64" ) -> None: + warnings.warn( + f"interfaces.renderers.Disassembly is now renderers.Disassembly", + FutureWarning, + ) self.data = data self.architecture = None if architecture in self.possible_architectures: @@ -158,40 +172,6 @@ class Disassembly: return str(self.data) -@dataclasses.dataclass -class LayerData: - """Layer data - - This requires the contex to be passed in, in case plugins want to use multiple contexts - and to ensure the TreeGrid interface doesn't change, since this would break all existing plugins - """ - - context: "interfaces.context.ContextInterface" - layer_name: str - offset: int - length: int - no_surrounding: bool = False - - @staticmethod - def from_object( - object: "interfaces.objects.ObjectInterface", - size: Optional[int] = None, - no_surrounding: bool = True, - ): - return LayerData( - context=object._context, - layer_name=object.vol.layer_name, - offset=object.vol.offset, - length=size or object.vol.size, - no_surrounding=no_surrounding, - ) - - def __str__(self) -> str: - """Fallback method of rendering""" - data = self.context.layers[self.layer_name].read(self.offset, self.length, True) - return str(data) - - # We don't class these off a shared base, because the BaseTypes must only # contain the types that the validator will accept (which would not include the base) @@ -203,8 +183,7 @@ BaseTypes = Union[ Type[bytes], Type[datetime.datetime], Type[BaseAbsentValue], - Type[Disassembly], - Type[LayerData], + Type[BasicType], ] ColumnsType = List[Tuple[str, BaseTypes]] VisitorSignature = Callable[[TreeNode, _Type], _Type] @@ -224,15 +203,7 @@ class TreeGrid(metaclass=ABCMeta): """ # TODO: Figure out why this isn't just BaseTypes (which includes AbsentValues' - base_types: ClassVar[Tuple] = ( - int, - str, - float, - bytes, - datetime.datetime, - Disassembly, - LayerData, - ) + base_types: ClassVar[Tuple] = (int, str, float, bytes, datetime.datetime, BasicType) def __init__( self, diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 8bbf3b89c..663f83bd5 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -18,7 +18,7 @@ class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 2) + _version = (1, 0, 3) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -76,9 +76,7 @@ class Malfind(interfaces.plugins.PluginInterface): else: architecture = "intel64" - disasm = interfaces.renderers.Disassembly( - data, vma.vm_start, architecture - ) + disasm = renderers.Disassembly(data, vma.vm_start, architecture) yield ( 0, @@ -106,7 +104,7 @@ class Malfind(interfaces.plugins.PluginInterface): ("Path", str), ("Protection", str), ("Hexdump", format_hints.HexBytes), - ("Disasm", interfaces.renderers.Disassembly), + ("Disasm", renderers.Disassembly), ], self._generator( pslist.PsList.list_tasks( diff --git a/volatility3/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py index 3094ada85..f1c3cc409 100644 --- a/volatility3/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -68,9 +68,7 @@ class Malfind(interfaces.plugins.PluginInterface): else: architecture = "intel64" - disasm = interfaces.renderers.Disassembly( - data, vma.links.start, architecture - ) + disasm = renderers.Disassembly(data, vma.links.start, architecture) yield ( 0, @@ -99,7 +97,7 @@ class Malfind(interfaces.plugins.PluginInterface): ("End", format_hints.Hex), ("Protection", str), ("Hexdump", format_hints.HexBytes), - ("Disasm", interfaces.renderers.Disassembly), + ("Disasm", renderers.Disassembly), ], self._generator( list_tasks(self.context, self.config["kernel"], filter_func=filter_func) diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index b04c21f52..a91492049 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -103,7 +103,7 @@ class Malfind(interfaces.plugins.PluginInterface): symbol_table: str, proc: interfaces.objects.ObjectInterface, ) -> Generator[ - Tuple[interfaces.objects.ObjectInterface, interfaces.renderers.LayerData], + Tuple[interfaces.objects.ObjectInterface, renderers.LayerData], None, None, ]: @@ -177,7 +177,7 @@ class Malfind(interfaces.plugins.PluginInterface): ) start = vad.get_start() length = 64 - data = interfaces.renderers.LayerData( + data = renderers.LayerData( context=context, layer_name=proc_layer_name, offset=start, @@ -223,9 +223,7 @@ class Malfind(interfaces.plugins.PluginInterface): else: architecture = "intel64" - disasm = interfaces.renderers.Disassembly( - data, vad.get_start(), architecture - ) + disasm = renderers.Disassembly(data, vad.get_start(), architecture) file_output = "Disabled" if self.config["dump"]: @@ -281,8 +279,8 @@ class Malfind(interfaces.plugins.PluginInterface): ("PrivateMemory", int), ("File output", str), ("Notes", str), - ("Hexdump", interfaces.renderers.LayerData), - ("Disasm", interfaces.renderers.Disassembly), + ("Hexdump", renderers.LayerData), + ("Disasm", renderers.Disassembly), ], self._generator( pslist.PsList.list_processes( diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index c0db350fe..aac3001c5 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -74,7 +74,7 @@ class MBRScan(interfaces.plugins.PluginInterface): partition_table_object = symbol_table + constants.BANG + "PARTITION_TABLE" # Define Signature and Data Length - mbr_signature = b"\x55\xAA" + mbr_signature = b"\x55\xaa" mbr_length = 0x200 bootcode_length = 0x1B8 @@ -120,9 +120,7 @@ class MBRScan(interfaces.plugins.PluginInterface): renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), - interfaces.renderers.Disassembly( - bootcode, 0, architecture - ), + renderers.Disassembly(bootcode, 0, architecture), ), ) else: @@ -146,10 +144,8 @@ class MBRScan(interfaces.plugins.PluginInterface): renderers.NotApplicableValue(), renderers.NotApplicableValue(), renderers.NotApplicableValue(), - interfaces.renderers.Disassembly( - bootcode, 0, architecture - ), - interfaces.renderers.LayerData( + renderers.Disassembly(bootcode, 0, architecture), + renderers.LayerData( context=self.context, layer_name=layer.name, offset=mbr_start_offset, @@ -238,7 +234,7 @@ class MBRScan(interfaces.plugins.PluginInterface): ("Bootable", bool), ("PartitionType", str), ("SectorInSize", format_hints.Hex), - ("Disasm", interfaces.renderers.Disassembly), + ("Disasm", renderers.Disassembly), ], self._generator(), ) @@ -262,8 +258,8 @@ class MBRScan(interfaces.plugins.PluginInterface): ("EndingCHS", int), ("EndingSector", int), ("SectorInSize", format_hints.Hex), - ("Disasm", interfaces.renderers.Disassembly), - ("Bootcode", interfaces.renderers.LayerData), + ("Disasm", renderers.Disassembly), + ("Bootcode", renderers.LayerData), ], self._generator(), ) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 6f07effd6..8ba110169 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -223,7 +223,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): content = attr.get_resident_filecontent() if content: - content = interfaces.renderers.LayerData.from_object(content) + content = renderers.LayerData.from_object(content) else: content = renderers.NotAvailableValue() @@ -387,7 +387,7 @@ class ADS(interfaces.plugins.PluginInterface): ("MFT Type", str), ("Filename", str), ("ADS Filename", str), - ("Hexdump", interfaces.renderers.LayerData), + ("Hexdump", renderers.LayerData), ], self._generator(), ) @@ -453,7 +453,7 @@ class ResidentData(interfaces.plugins.PluginInterface): ("Record Number", int), ("MFT Type", str), ("Filename", str), - ("Hexdump", interfaces.renderers.LayerData), + ("Hexdump", renderers.LayerData), ], self._generator(), ) diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index 093edf8cc..4f1de586a 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -8,6 +8,7 @@ or file or graphical output """ import collections import collections.abc +import dataclasses import datetime import logging from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, TypeVar, Union @@ -22,16 +23,28 @@ class UnreadableValue(interfaces.renderers.BaseAbsentValue): """Class that represents values which are empty because the data cannot be read.""" + def __str__(self) -> str: + """Fallback method for rendering basic types""" + return "-" + class UnparsableValue(interfaces.renderers.BaseAbsentValue): """Class that represents values which are empty because the data cannot be interpreted correctly.""" + def __str__(self) -> str: + """Fallback method for rendering basic types""" + return "-" + class NotApplicableValue(interfaces.renderers.BaseAbsentValue): """Class that represents values which are empty because they don't make sense for this node.""" + def __str__(self) -> str: + """Fallback method for rendering basic types""" + return "N/A" + class NotAvailableValue(interfaces.renderers.BaseAbsentValue): """Class that represents values which cannot be provided now (but might in @@ -45,6 +58,70 @@ class NotAvailableValue(interfaces.renderers.BaseAbsentValue): in preference, and only if neither fits should this be used. """ + def __str__(self) -> str: + """Fallback method for rendering basic types""" + return "N/A" + + +########## +### Basic Types + + +class Disassembly(interfaces.renderers.BasicType): + """A class to indicate that the bytes provided should be disassembled + (based on the architecture)""" + + possible_architectures = ["intel", "intel64", "arm", "arm64"] + + def __init__( + self, data: bytes, offset: int = 0, architecture: str = "intel64" + ) -> None: + self.data = data + self.architecture = None + if architecture in self.possible_architectures: + self.architecture = architecture + if not isinstance(offset, int): + raise TypeError("Offset must be an integer type") + self.offset = offset + + def __str__(self) -> str: + """Fallback method of rendering""" + return str(self.data) + + +@dataclasses.dataclass +class LayerData(interfaces.renderers.BasicType): + """Layer data + + This requires the contex to be passed in, in case plugins want to use multiple contexts + and to ensure the TreeGrid interface doesn't change, since this would break all existing plugins + """ + + context: "interfaces.context.ContextInterface" + layer_name: str + offset: int + length: int + no_surrounding: bool = False + + @staticmethod + def from_object( + object: "interfaces.objects.ObjectInterface", + size: Optional[int] = None, + no_surrounding: bool = True, + ): + return LayerData( + context=object._context, + layer_name=object.vol.layer_name, + offset=object.vol.offset, + length=size or object.vol.size, + no_surrounding=no_surrounding, + ) + + def __str__(self) -> str: + """Fallback method of rendering""" + data = self.context.layers[self.layer_name].read(self.offset, self.length, True) + return str(data) + class TreeNode(interfaces.renderers.TreeNode): """Class representing a particular node in a tree grid.""" From af01fcdcffa4c52e195de6df4ed7a6aa48bfea51 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 16 Feb 2025 17:41:28 +0000 Subject: [PATCH 0880/1352] Core: Remove unnecessary f-string --- volatility3/framework/interfaces/renderers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/renderers.py b/volatility3/framework/interfaces/renderers.py index b4c93cb3e..3e9afaf21 100644 --- a/volatility3/framework/interfaces/renderers.py +++ b/volatility3/framework/interfaces/renderers.py @@ -156,7 +156,7 @@ class Disassembly(BasicType): self, data: bytes, offset: int = 0, architecture: str = "intel64" ) -> None: warnings.warn( - f"interfaces.renderers.Disassembly is now renderers.Disassembly", + "interfaces.renderers.Disassembly is now renderers.Disassembly", FutureWarning, ) self.data = data From 6f599fa6456f812c7d6028588e987550c35bf86e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 21 Feb 2025 23:53:59 +0000 Subject: [PATCH 0881/1352] Various: Minor bump malfind functions for all OSes --- volatility3/framework/plugins/mac/malfind.py | 2 +- volatility3/framework/plugins/windows/malfind.py | 1 + volatility3/framework/plugins/windows/mbrscan.py | 2 +- volatility3/framework/plugins/windows/mftscan.py | 4 ++-- 4 files changed, 5 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py index f1c3cc409..2c2c801dc 100644 --- a/volatility3/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -13,7 +13,7 @@ from volatility3.plugins.mac import pslist class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 0, 1) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index a91492049..d9861d9c8 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -18,6 +18,7 @@ class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" _required_framework_version = (2, 22, 0) + _version = (1, 1, 0) @classmethod def get_requirements(cls): diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index aac3001c5..775b1a894 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -21,7 +21,7 @@ class MBRScan(interfaces.plugins.PluginInterface): """Scans for and parses potential Master Boot Records (MBRs)""" _required_framework_version = (2, 22, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 8ba110169..4139aab60 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -328,7 +328,7 @@ class ADS(interfaces.plugins.PluginInterface): _required_framework_version = (2, 22, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls): @@ -398,7 +398,7 @@ class ResidentData(interfaces.plugins.PluginInterface): _required_framework_version = (2, 22, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls): From e86981c8806f64f4db5a7297cdd0b3fd4a5045ea Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 22 Feb 2025 00:02:55 +0000 Subject: [PATCH 0882/1352] Various: Update yarascan plugins to output LayerData instead of just bytes --- volatility3/framework/plugins/linux/vmayarascan.py | 14 ++++++++++---- .../framework/plugins/windows/vadyarascan.py | 14 ++++++++++---- volatility3/framework/plugins/yarascan.py | 14 ++++++++++---- 3 files changed, 30 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index e9e56dd0f..42fd8e375 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -17,8 +17,8 @@ vollog = logging.getLogger(__name__) class VmaYaraScan(interfaces.plugins.PluginInterface): """Scans all virtual memory areas for tasks using yara.""" - _required_framework_version = (2, 4, 0) - _version = (1, 0, 3) + _required_framework_version = (2, 22, 0) + _version = (1, 0, 4) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -97,12 +97,18 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): for offset, rule_name, name, value in scanner( proc_layer.read(start, size, pad=True), start ): + layer_data = renderers.LayerData( + context=self.context, + offset=offset, + layer_name=proc_layer.name, + length=len(value), + ) yield 0, ( format_hints.Hex(offset), task.tgid, rule_name, name, - value, + layer_data, ) @classmethod @@ -130,7 +136,7 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): ("PID", int), ("Rule", str), ("Component", str), - ("Value", bytes), + ("Value", renderers.LayerData), ], self._generator(), ) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index a19206e22..e18f435db 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -17,8 +17,8 @@ vollog = logging.getLogger(__name__) class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" - _required_framework_version = (2, 4, 0) - _version = (1, 1, 2) + _required_framework_version = (2, 22, 0) + _version = (1, 1, 3) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -93,12 +93,18 @@ class VadYaraScan(interfaces.plugins.PluginInterface): for offset, rule_name, name, value in scanner( layer.read(start, size, pad=True), start ): + layer_data = renderers.LayerData( + context=self.context, + offset=offset, + layer_name=layer.name, + length=len(value), + ) yield 0, ( format_hints.Hex(offset), task.UniqueProcessId, rule_name, name, - value, + layer_data, ) @classmethod @@ -126,7 +132,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): ("PID", int), ("Rule", str), ("Component", str), - ("Value", bytes), + ("Value", renderers.LayerData), ], self._generator(), ) diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 38c8b6085..df31b18d7 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -105,8 +105,8 @@ class YaraScanner(interfaces.layers.ScannerInterface): class YaraScan(plugins.PluginInterface): """Scans kernel memory using yara rules (string or file).""" - _required_framework_version = (2, 0, 0) - _version = (2, 0, 0) + _required_framework_version = (2, 22, 0) + _version = (2, 0, 1) _yara_x = USE_YARA_X @classmethod @@ -201,7 +201,13 @@ class YaraScan(plugins.PluginInterface): for offset, rule_name, name, value in layer.scan( context=self.context, scanner=YaraScanner(rules=rules) ): - yield 0, (format_hints.Hex(offset), rule_name, name, value) + layer_data = renderers.LayerData( + context=self.context, + offset=offset, + layer_name=layer.name, + length=len(value), + ) + yield 0, (format_hints.Hex(offset), rule_name, name, layer_data) def run(self): return renderers.TreeGrid( @@ -209,7 +215,7 @@ class YaraScan(plugins.PluginInterface): ("Offset", format_hints.Hex), ("Rule", str), ("Component", str), - ("Value", bytes), + ("Value", renderers.LayerData), ], self._generator(), ) From bb39081e33ba1991233a0093a6748af9d19f6636 Mon Sep 17 00:00:00 2001 From: Odysseas Stavrou Date: Sun, 23 Mar 2025 22:29:16 +0200 Subject: [PATCH 0883/1352] Volshell: Add byteorder argument for display_* functions --- volatility3/cli/volshell/generic.py | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 143e26500..71b2173c6 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -310,23 +310,25 @@ class Volshell(interfaces.plugins.PluginInterface): self._display_data(offset, remaining_data) def display_quadwords( - self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None + self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None, byteorder="@" ): """Displays quad-word values (8 bytes) and corresponding ASCII characters""" remaining_data = self._read_data(offset, count=count, layer_name=layer_name) - self._display_data(offset, remaining_data, format_string="Q") + self._display_data(offset, remaining_data, format_string=f"{byteorder}Q") def display_doublewords( - self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None + self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None, byteorder="@" ): """Displays double-word values (4 bytes) and corresponding ASCII characters""" remaining_data = self._read_data(offset, count=count, layer_name=layer_name) - self._display_data(offset, remaining_data, format_string="I") + self._display_data(offset, remaining_data, format_string=f"{byteorder}I") - def display_words(self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None): + def display_words( + self, offset, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None, byteorder="@" + ): """Displays word values (2 bytes) and corresponding ASCII characters""" remaining_data = self._read_data(offset, count=count, layer_name=layer_name) - self._display_data(offset, remaining_data, format_string="H") + self._display_data(offset, remaining_data, format_string=f"{byteorder}H") def regex_scan(self, pattern, count=DEFAULT_NUM_DISPLAY_BYTES, layer_name=None): """Scans for regex pattern in layer using RegExScanner.""" From f0153817c5bcbb72093c1db70e79023405db1144 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 00:58:28 +0000 Subject: [PATCH 0884/1352] Add in slots to object model --- volatility3/framework/interfaces/objects.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 62c31481b..7317469f1 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -23,6 +23,8 @@ class ReadOnlyMapping(collections.abc.Mapping): modified, making an immutable mapping. """ + __slots__ = ("_dict",) + def __init__(self, dictionary: Mapping[str, Any]) -> None: self._dict = dictionary @@ -63,6 +65,8 @@ class ObjectInformation(ReadOnlyMapping): in a single place. These values are based on the :class:`ReadOnlyMapping` class, to prevent their modification. """ + __slots__ = () + def __init__( self, layer_name: str, @@ -98,6 +102,8 @@ class ObjectInterface(metaclass=abc.ABCMeta): """A base object required to be the ancestor of every object used in volatility.""" + __slots__ = () + def __init__( self, context: "interfaces.context.ContextInterface", @@ -305,6 +311,8 @@ class Template: constructed at resolution time and then cached. """ + __slots__ = "_vol" + def __init__(self, type_name: str, **arguments) -> None: """Stores the keyword arguments for later object creation.""" # Allow the updating of template arguments whilst still in template form From 57c07631b057fac49bedd9fb8f8c3c5c063be868 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Sun, 23 Mar 2025 21:23:42 -0500 Subject: [PATCH 0885/1352] Add win32 start address listing. Add paths for both thread starting address types --- .../plugins/windows/orphan_kernel_threads.py | 2 +- .../framework/plugins/windows/psxview.py | 2 +- .../plugins/windows/suspicious_threads.py | 6 +- .../framework/plugins/windows/thrdscan.py | 85 +++++++++++++++++-- .../framework/plugins/windows/threads.py | 2 +- 5 files changed, 85 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 151fe88c9..0f556dd1e 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -34,7 +34,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) + name="thrdscan", plugin=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.PluginRequirement( name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 7329588cc..7c3444f70 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -55,7 +55,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(1, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="handles", component=handles.Handles, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index c98b06792..eabc637c8 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -35,7 +35,7 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(1, 1, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) @@ -181,11 +181,11 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): if not info: continue - _, _, tid, start_address, _, _ = info + _, _, tid, start_address, _, win32_start_address, _, _, _ = info addresses = [ (start_address, "Start"), - (thread.Win32StartAddress, "Win32Start"), + (win32_start_address, "Win32Start"), ] for address, context in addresses: diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 369db1fd8..38fba1ff4 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -3,12 +3,12 @@ ## import logging import datetime -from typing import Callable, Iterable +from typing import Callable, Iterable, Tuple, Optional, Dict from volatility3.framework import renderers, interfaces, exceptions from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import poolscanner +from volatility3.plugins.windows import poolscanner, pe_symbols from volatility3.plugins import timeliner vollog = logging.getLogger(__name__) @@ -19,7 +19,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (1, 1, 0) + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -67,27 +67,74 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) yield mem_object @classmethod - def gather_thread_info(cls, ethread): + def gather_thread_info( + cls, + ethread: interfaces.objects.ObjectInterface, + vads_cache: Dict[int, pe_symbols.ranges_type] = None, + ) -> Tuple[ + int, + int, + int, + int, + Optional[str], + int, + Optional[str], + Optional[datetime.datetime], + Optional[datetime.datetime], + ]: try: thread_offset = ethread.vol.offset owner_proc_pid = ethread.Cid.UniqueProcess thread_tid = ethread.Cid.UniqueThread thread_start_addr = ethread.StartAddress + thread_win32start_addr = ethread.Win32StartAddress thread_create_time = ( ethread.get_create_time() ) # datetime.datetime object / volatility3.framework.renderers.UnparsableValue object thread_exit_time = ( ethread.get_exit_time() ) # datetime.datetime object / volatility3.framework.renderers.UnparsableValue object + + owner_proc = None + if vads_cache is not None: + owner_proc = ethread.owning_process() except exceptions.InvalidAddressException: vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None + if vads_cache is not None: + vads = pe_symbols.PESymbols.get_vads_for_process_cache( + vads_cache, owner_proc + ) + # no vads = terminated/smeared, pid 4 = kernel = don't check VADs + if ( + owner_proc_pid != 4 + and owner_proc.InheritedFromUniqueProcessId != 4 + and (not vads or len(vads) < 5) + ): + vollog.debug( + f"No vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" + ) + return None + + start_path = pe_symbols.PESymbols.filepath_for_address( + vads, thread_start_addr + ) + win32start_path = pe_symbols.PESymbols.filepath_for_address( + vads, thread_win32start_addr + ) + else: + start_path = None + win32start_path = None + return ( format_hints.Hex(thread_offset), owner_proc_pid, thread_tid, format_hints.Hex(thread_start_addr), + start_path, + format_hints.Hex(thread_win32start_addr), + win32start_path, thread_create_time, thread_exit_time, ) @@ -95,11 +142,34 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) def _generator(self, filter_func: Callable): kernel_name = self.config["kernel"] + vads_cache: Dict[int, pe_symbols.ranges_type] = {} + for ethread in self.implementation(self.context, kernel_name): - info = self.gather_thread_info(ethread) + info = self.gather_thread_info(ethread, vads_cache) if info: - yield (0, info) + ( + offset, + pid, + tid, + start_addr, + start_path, + win32start_addr, + win32start_path, + create_time, + exit_time, + ) = info + yield 0, ( + offset, + pid, + tid, + start_addr, + start_path or renderers.NotAvailableValue(), + win32start_addr, + win32start_path or renderers.NotAvailableValue(), + create_time, + exit_time, + ) def generate_timeline(self): filt_func = self.filter_func(self.config) @@ -145,6 +215,9 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) ("PID", int), ("TID", int), ("StartAddress", format_hints.Hex), + ("StartPath", str), + ("Win32StartAddress", format_hints.Hex), + ("Win32StartPath", str), ("CreateTime", datetime.datetime), ("ExitTime", datetime.datetime), ], diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 77062e8c6..d0bb26e2a 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -32,7 +32,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.PluginRequirement( - name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) + name="thrdscan", plugin=thrdscan.ThrdScan, version=(2, 0, 0) ), ] From e3d35aa425fe08c4ae5566b5843ec92ee05c841c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 02:49:31 +0000 Subject: [PATCH 0886/1352] update from feedback --- .../plugins/linux/tracing/perf_events.py | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/perf_events.py b/volatility3/framework/plugins/linux/tracing/perf_events.py index 5d629bd21..3e0a40579 100644 --- a/volatility3/framework/plugins/linux/tracing/perf_events.py +++ b/volatility3/framework/plugins/linux/tracing/perf_events.py @@ -83,7 +83,7 @@ class PerfEvents(plugins.PluginInterface): event.prog.aux.ksym.name, count=512 ) except AttributeError: - full_name = renderers.NotApplicableValue() + full_name = None program_name = utility.array_to_string(event.prog.aux.name) except exceptions.InvalidAddressException: @@ -95,10 +95,8 @@ class PerfEvents(plugins.PluginInterface): if program_address == 0: continue - program_address = format_hints.Hex(program_address) - else: - program_address = renderers.NotAvailableValue() + program_address = None yield task, event_name, program_name, full_name, program_address @@ -112,14 +110,23 @@ class PerfEvents(plugins.PluginInterface): ) in self.list_perf_events(self.context, self.config["kernel"]): task_name = utility.array_to_string(task.comm) + # We at least need one useful string... + if event_name is None and program_name is None and full_name is None: + continue + + if program_address is not None: + program_address = format_hints.Hex(program_address) + else: + program_address = renderers.NotAvailableValue() + yield ( 0, ( task.pid, task_name, - event_name, - program_name, - full_name, + event_name or renderers.NotAvailableValue(), + program_name or renderers.NotAvailableValue(), + full_name or renderers.NotAvailableValue(), program_address, ), ) From 36b66f00fe27476d75abffe635f1ddece3ad7c5d Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 05:05:08 +0000 Subject: [PATCH 0887/1352] Add delete on close detection to process ghosting. Update plugin to current coding flow --- .../plugins/windows/processghosting.py | 193 ++++++++++++++---- 1 file changed, 154 insertions(+), 39 deletions(-) diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index 5bc6bc5a3..28af57053 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -2,21 +2,23 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import contextlib + +from typing import Optional, Tuple, Generator, Dict from volatility3.framework import interfaces, exceptions from volatility3.framework import renderers from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import pslist +from volatility3.plugins.windows import pslist, vadinfo vollog = logging.getLogger(__name__) class ProcessGhosting(interfaces.plugins.PluginInterface): - """Lists processes whose DeletePending bit is set or whose FILE_OBJECT is set to 0""" + """Lists processes whose DeletePending bit is set or whose FILE_OBJECT is set to 0 or Vads that are DeleteOnClose""" + _version = (1, 0, 0) _required_framework_version = (2, 4, 0) @classmethod @@ -33,52 +35,163 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): ), ] + @classmethod + def _process_checks( + cls, + proc: interfaces.objects.ObjectInterface, + mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]], + ) -> Generator[ + Tuple[int, Optional[int], Optional[int], int, Optional[str]], None, None + ]: + """ + Checks the EPROCESS for signs of ghosting + """ + if not proc.has_member("ImageFilePointer"): + return + + delete_pending = None + + # if it is 0 then its a side effect of process ghosting + if proc.ImageFilePointer.vol.offset != 0: + try: + file_object = proc.ImageFilePointer + delete_pending = file_object.DeletePending + file_object = file_object.dereference().vol.offset + except exceptions.InvalidAddressException: + file_object = 0 + + # ImageFilePointer equal to 0 means process ghosting or similar techniques were used + else: + file_object = 0 + + # delete_pending besides 0 or 1 = smear + if isinstance(delete_pending, int) and delete_pending not in [0, 1]: + vollog.debug( + f"Invalid delete_pending value {delete_pending} found for process {proc.UniqueProcessId}" + ) + delete_pending = None + + if file_object == 0 or delete_pending == 1: + yield file_object, delete_pending, None, proc.SectionBaseAddress + + @classmethod + def _vad_checks( + cls, control_area: interfaces.objects.ObjectInterface, vad_path: str + ) -> Generator[Tuple[int, Optional[int], Optional[int]], None, None]: + """ + Checks the control area for delete on close or delete pending being set + """ + try: + file_object = control_area.FilePointer.dereference().cast("_FILE_OBJECT") + except exceptions.InvalidAddressException: + return + + try: + delete_on_close = control_area.u.Flags.DeleteOnClose + except exceptions.InvalidAddressException: + delete_on_close = None + + if delete_on_close and vad_path.lower().endswith((".exe", ".dll")): + yield file_object.vol.offset, None, delete_on_close + + try: + delete_pending = file_object.DeletePending + except exceptions.InvalidAddressException: + delete_pending = None + + if delete_pending and delete_pending == 1: + yield file_object.vol.offset, delete_pending, None + + @classmethod + def check_for_ghosting( + cls, + proc: interfaces.objects.ObjectInterface, + mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]], + ) -> Generator[ + Tuple[int, Optional[int], Optional[int], int, Optional[str]], None, None + ]: + """ + Returns process or vad info for ghosting files + + Args: + proc: + mapped_files: A dictionary mapping vad base addreses to the path and vad instance for the process + + Return: + A Generator of tuples of the file object address, the delete pending state, delete on close state, base address of the VAD, and the path + """ + # check the direct file object of the process + yield from cls._process_checks(proc, mapped_files) + + # walk each vad, check if it is pending delete or has its delete on close bit set + for vad_base, (path, vad) in mapped_files.items(): + # these checks have no meaning for private memory areas + if vad.get_private_memory() == 1: + continue + + try: + if vad.has_member("ControlArea"): + control_area = vad.ControlArea + elif vad.has_member("Subsection"): + control_area = vad.Subsection.ControlArea + # We got here from a short vad, likely smear + else: + continue + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to get control area for vad at base {vad_base:#x} for process with pid {proc.UniqueProcessId}" + ) + continue + + for file_object_address, delete_pending, delete_on_close in cls._vad_checks( + control_area, path + ): + yield format_hints.Hex( + file_object_address + ), delete_pending, delete_on_close, vad_base + def _generator(self, procs): kernel = self.context.modules[self.config["kernel"]] - if not kernel.get_type("_EPROCESS").has_member("ImageFilePointer"): + has_imagefilepointer = kernel.get_type("_EPROCESS").has_member( + "ImageFilePointer" + ) + if not has_imagefilepointer: vollog.warning( - "This plugin only supports Windows 10 builds when the ImageFilePointer member of _EPROCESS is present" + "ImageFilePointer checks are only supported on Windows 10 builds when the ImageFilePointer member of _EPROCESS is present" ) - return for proc in procs: - delete_pending = renderers.UnreadableValue() process_name = utility.array_to_string(proc.ImageFileName) + pid = proc.UniqueProcessId - # if it is 0 then its a side effect of process ghosting - if proc.ImageFilePointer.vol.offset != 0: - try: - file_object = proc.ImageFilePointer - delete_pending = file_object.DeletePending - except exceptions.InvalidAddressException: - file_object = 0 + # base address -> (file path, VAD instance) + mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]] = {} + for vad in vadinfo.VadInfo.list_vads(proc): + path = vad.get_file_name() + if isinstance(path, str): + mapped_files[vad.get_start()] = (path, vad) - # ImageFilePointer equal to 0 means process ghosting or similar techniques were used - else: - file_object = 0 + for ( + file_object_address, + delete_pending, + delete_on_close, + base_address, + ) in self.check_for_ghosting(proc, mapped_files): + vad_info = mapped_files.get(base_address) + if vad_info: + path = vad_info[0] + else: + path = renderers.NotAvailableValue() - if isinstance(delete_pending, int) and delete_pending not in [0, 1]: - vollog.debug( - f"Invalid delete_pending value {delete_pending} found for {process_name} {proc.UniqueProcessId}" - ) - - # delete_pending besides 0 or 1 = smear - if file_object == 0 or delete_pending == 1: - path = renderers.UnreadableValue() - if file_object: - with contextlib.suppress(exceptions.InvalidAddressException): - path = file_object.FileName.String - - yield ( - 0, - ( - proc.UniqueProcessId, - process_name, - format_hints.Hex(file_object), - delete_pending, - path, - ), + yield 0, ( + pid, + process_name, + format_hints.Hex(file_object_address), + delete_pending or renderers.NotApplicableValue(), + delete_on_close or renderers.NotApplicableValue(), + format_hints.Hex(base_address), + path, ) def run(self): @@ -89,7 +202,9 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): ("PID", int), ("Process", str), ("FILE_OBJECT", format_hints.Hex), - ("DeletePending", str), + ("DeletePending", int), + ("DeleteOnClose", int), + ("Base", format_hints.Hex), ("Path", str), ], self._generator( From 003c139597b93b649b688181781d3eb326bb18bf Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 15:10:37 +0000 Subject: [PATCH 0888/1352] Add a --script-only flag that exits after the given volshell script is completed --- volatility3/cli/volshell/generic.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 143e26500..2f7c7662c 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -60,7 +60,13 @@ class Volshell(interfaces.plugins.PluginInterface): description="File to load and execute at start", default=None, optional=True, - ) + ), + requirements.BooleanRequirement( + name="script-only", + description="Exit volshell after the script specified in --script completes", + default=False, + optional=True, + ), ] return reqs + [ requirements.TranslationLayerRequirement( @@ -135,6 +141,9 @@ class Volshell(interfaces.plugins.PluginInterface): if self.config.get("script", None) is not None: self.run_script(location=self.config["script"]) + if self.config.get("script-only"): + exit() + if has_ipython: self.__console() else: From a6f9a0e95b3d8096a462894c8190479b2e293d52 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 24 Mar 2025 11:30:17 -0500 Subject: [PATCH 0889/1352] Framework: Replace PluginRequirements This replaces all uses of `requirements.PluginRequirements` with `requirements.VersionRequirement`. --- doc/source/simple-plugin.rst | 4 ++-- volatility3/cli/volshell/linux.py | 4 ++-- volatility3/cli/volshell/mac.py | 4 ++-- volatility3/cli/volshell/windows.py | 4 ++-- volatility3/framework/plugins/linux/bash.py | 4 ++-- volatility3/framework/plugins/linux/boottime.py | 4 ++-- .../framework/plugins/linux/capabilities.py | 4 ++-- .../framework/plugins/linux/check_creds.py | 4 ++-- volatility3/framework/plugins/linux/elfs.py | 4 ++-- volatility3/framework/plugins/linux/envars.py | 4 ++-- volatility3/framework/plugins/linux/kthreads.py | 4 ++-- .../framework/plugins/linux/library_list.py | 4 ++-- volatility3/framework/plugins/linux/lsof.py | 4 ++-- volatility3/framework/plugins/linux/malfind.py | 4 ++-- volatility3/framework/plugins/linux/mountinfo.py | 4 ++-- volatility3/framework/plugins/linux/pagecache.py | 16 ++++++++-------- .../framework/plugins/linux/pidhashtable.py | 4 ++-- volatility3/framework/plugins/linux/proc.py | 4 ++-- volatility3/framework/plugins/linux/psaux.py | 4 ++-- .../framework/plugins/linux/pscallstack.py | 4 ++-- volatility3/framework/plugins/linux/pslist.py | 4 ++-- volatility3/framework/plugins/linux/psscan.py | 4 ++-- volatility3/framework/plugins/linux/pstree.py | 4 ++-- volatility3/framework/plugins/linux/ptrace.py | 4 ++-- volatility3/framework/plugins/linux/sockstat.py | 8 ++++---- .../framework/plugins/linux/vmaregexscan.py | 4 ++-- .../framework/plugins/linux/vmayarascan.py | 8 ++++---- volatility3/framework/plugins/mac/bash.py | 4 ++-- .../framework/plugins/mac/check_syscall.py | 4 ++-- .../framework/plugins/mac/check_sysctl.py | 4 ++-- .../framework/plugins/mac/check_trap_table.py | 4 ++-- .../framework/plugins/mac/kauth_listeners.py | 10 ++++++---- .../framework/plugins/mac/kauth_scopes.py | 4 ++-- volatility3/framework/plugins/mac/kevents.py | 4 ++-- volatility3/framework/plugins/mac/list_files.py | 4 ++-- volatility3/framework/plugins/mac/lsof.py | 4 ++-- volatility3/framework/plugins/mac/malfind.py | 4 ++-- volatility3/framework/plugins/mac/netstat.py | 4 ++-- volatility3/framework/plugins/mac/proc_maps.py | 4 ++-- volatility3/framework/plugins/mac/psaux.py | 4 ++-- volatility3/framework/plugins/mac/pstree.py | 4 ++-- .../framework/plugins/mac/socket_filters.py | 4 ++-- volatility3/framework/plugins/mac/trustedbsd.py | 4 ++-- volatility3/framework/plugins/windows/amcache.py | 4 ++-- .../framework/plugins/windows/cachedump.py | 12 ++++++------ .../framework/plugins/windows/callbacks.py | 16 ++++++++-------- volatility3/framework/plugins/windows/cmdline.py | 4 ++-- volatility3/framework/plugins/windows/cmdscan.py | 4 ++-- .../framework/plugins/windows/consoles.py | 4 ++-- .../framework/plugins/windows/deskscan.py | 8 ++++---- .../framework/plugins/windows/desktops.py | 4 ++-- .../framework/plugins/windows/devicetree.py | 4 ++-- .../plugins/windows/direct_system_calls.py | 8 ++++---- .../framework/plugins/windows/driverirp.py | 12 ++++++------ .../framework/plugins/windows/drivermodule.py | 12 ++++++------ .../framework/plugins/windows/driverscan.py | 4 ++-- volatility3/framework/plugins/windows/envars.py | 8 ++++---- .../framework/plugins/windows/filescan.py | 4 ++-- .../framework/plugins/windows/getservicesids.py | 4 ++-- volatility3/framework/plugins/windows/getsids.py | 8 ++++---- volatility3/framework/plugins/windows/handles.py | 4 ++-- .../framework/plugins/windows/hashdump.py | 4 ++-- .../plugins/windows/indirect_system_calls.py | 8 ++++---- volatility3/framework/plugins/windows/memmap.py | 4 ++-- volatility3/framework/plugins/windows/mftscan.py | 8 ++++---- .../framework/plugins/windows/mutantscan.py | 4 ++-- .../plugins/windows/orphan_kernel_threads.py | 12 ++++++------ .../framework/plugins/windows/poolscanner.py | 4 ++-- .../framework/plugins/windows/privileges.py | 4 ++-- volatility3/framework/plugins/windows/psscan.py | 4 ++-- .../plugins/windows/registry/getcellroutine.py | 8 ++++---- .../plugins/windows/registry/hivelist.py | 4 ++-- .../plugins/windows/registry/hivescan.py | 8 ++++---- .../plugins/windows/registry/printkey.py | 4 ++-- .../plugins/windows/registry/userassist.py | 4 ++-- .../framework/plugins/windows/scheduled_tasks.py | 4 ++-- .../framework/plugins/windows/sessions.py | 4 ++-- .../framework/plugins/windows/shimcachemem.py | 4 ++-- volatility3/framework/plugins/windows/ssdt.py | 4 ++-- volatility3/framework/plugins/windows/strings.py | 4 ++-- volatility3/framework/plugins/windows/svclist.py | 4 ++-- volatility3/framework/plugins/windows/svcscan.py | 8 ++++---- .../framework/plugins/windows/thrdscan.py | 4 ++-- volatility3/framework/plugins/windows/threads.py | 4 ++-- .../plugins/windows/unhooked_system_calls.py | 4 ++-- volatility3/framework/plugins/windows/vadinfo.py | 4 ++-- .../framework/plugins/windows/vadregexscan.py | 4 ++-- volatility3/framework/plugins/windows/vadwalk.py | 8 ++++---- .../framework/plugins/windows/vadyarascan.py | 8 ++++---- volatility3/framework/plugins/windows/verinfo.py | 8 ++++---- .../plugins/windows/registry/certificates.py | 8 ++++---- 91 files changed, 244 insertions(+), 242 deletions(-) diff --git a/doc/source/simple-plugin.rst b/doc/source/simple-plugin.rst index a6916a027..d855e319d 100644 --- a/doc/source/simple-plugin.rst +++ b/doc/source/simple-plugin.rst @@ -53,9 +53,9 @@ to be able to run properly. Any that are defined as optional need not necessari description = "Process IDs to include (all other processes are excluded)", optional = True ), - requirements.PluginRequirement( + requirements.VersionRequirement( name = 'pslist', - plugin = pslist.PsList, + component = pslist.PsList, version = (2, 0, 0) ), ] diff --git a/volatility3/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py index b3689c3ae..27c630614 100644 --- a/volatility3/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -30,8 +30,8 @@ class Volshell(generic.Volshell): requirements.ModuleRequirement( name="kernel", description="Linux kernel module" ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.IntRequirement( name="pid", description="Process ID", optional=True diff --git a/volatility3/cli/volshell/mac.py b/volatility3/cli/volshell/mac.py index 0ed35eb27..393eff20b 100644 --- a/volatility3/cli/volshell/mac.py +++ b/volatility3/cli/volshell/mac.py @@ -19,8 +19,8 @@ class Volshell(generic.Volshell): requirements.ModuleRequirement( name="kernel", description="Darwin kernel module" ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.IntRequirement( name="pid", description="Process ID", optional=True diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index c5bab3b74..ce5995648 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -17,8 +17,8 @@ class Volshell(generic.Volshell): def get_requirements(cls): return [ requirements.ModuleRequirement(name="kernel", description="Windows kernel"), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.IntRequirement( name="pid", description="Process ID", optional=True diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 293c47224..fd73b4df2 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -32,8 +32,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/boottime.py b/volatility3/framework/plugins/linux/boottime.py index c57bdd65a..c1a75d478 100644 --- a/volatility3/framework/plugins/linux/boottime.py +++ b/volatility3/framework/plugins/linux/boottime.py @@ -25,8 +25,8 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index 1d0c60c11..dae6aac6a 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -60,8 +60,8 @@ class Capabilities(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pids", diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index 96f77ce4d..e2b84d679 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -22,8 +22,8 @@ class Check_creds(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/elfs.py b/volatility3/framework/plugins/linux/elfs.py index b9dcc3cca..8b2759907 100644 --- a/volatility3/framework/plugins/linux/elfs.py +++ b/volatility3/framework/plugins/linux/elfs.py @@ -35,8 +35,8 @@ class Elfs(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/envars.py b/volatility3/framework/plugins/linux/envars.py index 0687caa9f..f4859cb49 100644 --- a/volatility3/framework/plugins/linux/envars.py +++ b/volatility3/framework/plugins/linux/envars.py @@ -29,8 +29,8 @@ class Envars(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/kthreads.py b/volatility3/framework/plugins/linux/kthreads.py index 06e94b221..4ed0e15b9 100644 --- a/volatility3/framework/plugins/linux/kthreads.py +++ b/volatility3/framework/plugins/linux/kthreads.py @@ -44,8 +44,8 @@ class Kthreads(plugins.PluginInterface): requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/library_list.py b/volatility3/framework/plugins/linux/library_list.py index e251b5689..dedd77ade 100644 --- a/volatility3/framework/plugins/linux/library_list.py +++ b/volatility3/framework/plugins/linux/library_list.py @@ -31,8 +31,8 @@ class LibraryList(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pids", diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 044e9238f..8e0143584 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -120,8 +120,8 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index 8bbf3b89c..dad8b1f15 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -28,8 +28,8 @@ class Malfind(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index c56ced489..668b039db 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -46,8 +46,8 @@ class MountInfo(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 3d2db7fd7..879bc3288 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -126,8 +126,8 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), - requirements.PluginRequirement( - name="mountinfo", plugin=mountinfo.MountInfo, version=(1, 2, 0) + requirements.VersionRequirement( + name="mountinfo", component=mountinfo.MountInfo, version=(1, 2, 0) ), requirements.ListRequirement( name="type", @@ -431,8 +431,8 @@ class InodePages(plugins.PluginInterface): description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), - requirements.PluginRequirement( - name="files", plugin=Files, version=(1, 0, 0) + requirements.VersionRequirement( + name="files", component=Files, version=(1, 0, 0) ), requirements.StringRequirement( name="find", @@ -650,11 +650,11 @@ class RecoverFs(plugins.PluginInterface): description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), - requirements.PluginRequirement( - name="files", plugin=Files, version=(1, 1, 0) + requirements.VersionRequirement( + name="files", component=Files, version=(1, 1, 0) ), - requirements.PluginRequirement( - name="inodepages", plugin=InodePages, version=(3, 0, 0) + requirements.VersionRequirement( + name="inodepages", component=InodePages, version=(3, 0, 0) ), requirements.BooleanRequirement( name="tmpfs_only", diff --git a/volatility3/framework/plugins/linux/pidhashtable.py b/volatility3/framework/plugins/linux/pidhashtable.py index 060b3928e..b4b1643e1 100644 --- a/volatility3/framework/plugins/linux/pidhashtable.py +++ b/volatility3/framework/plugins/linux/pidhashtable.py @@ -29,8 +29,8 @@ class PIDHashTable(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) diff --git a/volatility3/framework/plugins/linux/proc.py b/volatility3/framework/plugins/linux/proc.py index 5acba6594..e9a126374 100644 --- a/volatility3/framework/plugins/linux/proc.py +++ b/volatility3/framework/plugins/linux/proc.py @@ -34,8 +34,8 @@ class Maps(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/psaux.py b/volatility3/framework/plugins/linux/psaux.py index 1a118dba6..e6653251c 100644 --- a/volatility3/framework/plugins/linux/psaux.py +++ b/volatility3/framework/plugins/linux/psaux.py @@ -26,8 +26,8 @@ class PsAux(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/pscallstack.py b/volatility3/framework/plugins/linux/pscallstack.py index 6d7a24942..c22e00161 100644 --- a/volatility3/framework/plugins/linux/pscallstack.py +++ b/volatility3/framework/plugins/linux/pscallstack.py @@ -45,8 +45,8 @@ class PsCallStack(plugins.PluginInterface): requirements.VersionRequirement( name="Kallsyms", component=kallsyms.Kallsyms, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 4c42fc992..8296c82fa 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -44,8 +44,8 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="elfs", plugin=elfs.Elfs, version=(2, 0, 0) + requirements.VersionRequirement( + name="elfs", component=elfs.Elfs, version=(2, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index 6c4c5eb35..0813cebed 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -38,8 +38,8 @@ class PsScan(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/pstree.py b/volatility3/framework/plugins/linux/pstree.py index c5290774b..e7bbdb8d5 100644 --- a/volatility3/framework/plugins/linux/pstree.py +++ b/volatility3/framework/plugins/linux/pstree.py @@ -27,8 +27,8 @@ class PsTree(interfaces.plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/ptrace.py b/volatility3/framework/plugins/linux/ptrace.py index 6493f22b9..356d5e72c 100644 --- a/volatility3/framework/plugins/linux/ptrace.py +++ b/volatility3/framework/plugins/linux/ptrace.py @@ -29,8 +29,8 @@ class Ptrace(plugins.PluginInterface): description="Linux kernel", architectures=architectures.LINUX_ARCHS, ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index adbb5d6ea..da5d8cb8c 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -463,11 +463,11 @@ class Sockstat(plugins.PluginInterface): requirements.VersionRequirement( name="SockHandlers", component=SockHandlers, version=(4, 0, 0) ), - requirements.PluginRequirement( - name="lsof", plugin=lsof.Lsof, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsof", component=lsof.Lsof, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/linux/vmaregexscan.py b/volatility3/framework/plugins/linux/vmaregexscan.py index 8fb96da1e..4c8ef5b8f 100644 --- a/volatility3/framework/plugins/linux/vmaregexscan.py +++ b/volatility3/framework/plugins/linux/vmaregexscan.py @@ -34,8 +34,8 @@ class VmaRegExScan(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index e9e56dd0f..2f15a1e7e 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -30,11 +30,11 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): description="Process IDs to include (all other processes are excluded)", optional=True, ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), - requirements.PluginRequirement( - name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index 5be5e74d6..aca0aea0c 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -30,8 +30,8 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/mac/check_syscall.py b/volatility3/framework/plugins/mac/check_syscall.py index 5c22e6463..ed86b1a41 100644 --- a/volatility3/framework/plugins/mac/check_syscall.py +++ b/volatility3/framework/plugins/mac/check_syscall.py @@ -31,8 +31,8 @@ class Check_syscall(plugins.PluginInterface): requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsmod", component=lsmod.Lsmod, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/mac/check_sysctl.py b/volatility3/framework/plugins/mac/check_sysctl.py index ed3e34aea..d9c9a4dbd 100644 --- a/volatility3/framework/plugins/mac/check_sysctl.py +++ b/volatility3/framework/plugins/mac/check_sysctl.py @@ -33,8 +33,8 @@ class Check_sysctl(plugins.PluginInterface): requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsmod", component=lsmod.Lsmod, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/mac/check_trap_table.py b/volatility3/framework/plugins/mac/check_trap_table.py index 60f237208..6e0f4b8a9 100644 --- a/volatility3/framework/plugins/mac/check_trap_table.py +++ b/volatility3/framework/plugins/mac/check_trap_table.py @@ -29,8 +29,8 @@ class Check_trap_table(plugins.PluginInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsmod", component=lsmod.Lsmod, version=(2, 0, 0) ), requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 0, 0) diff --git a/volatility3/framework/plugins/mac/kauth_listeners.py b/volatility3/framework/plugins/mac/kauth_listeners.py index ed43bfb42..ca236c04a 100644 --- a/volatility3/framework/plugins/mac/kauth_listeners.py +++ b/volatility3/framework/plugins/mac/kauth_listeners.py @@ -26,11 +26,13 @@ class Kauth_listeners(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 1, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsmod", component=lsmod.Lsmod, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="kauth_scopes", plugin=kauth_scopes.Kauth_scopes, version=(2, 0, 0) + requirements.VersionRequirement( + name="kauth_scopes", + component=kauth_scopes.Kauth_scopes, + version=(2, 0, 0), ), ] diff --git a/volatility3/framework/plugins/mac/kauth_scopes.py b/volatility3/framework/plugins/mac/kauth_scopes.py index c2c473eac..6420d9955 100644 --- a/volatility3/framework/plugins/mac/kauth_scopes.py +++ b/volatility3/framework/plugins/mac/kauth_scopes.py @@ -31,8 +31,8 @@ class Kauth_scopes(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 1, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsmod", component=lsmod.Lsmod, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/mac/kevents.py b/volatility3/framework/plugins/mac/kevents.py index 41fde31ca..e36de8c84 100644 --- a/volatility3/framework/plugins/mac/kevents.py +++ b/volatility3/framework/plugins/mac/kevents.py @@ -71,8 +71,8 @@ class Kevents(interfaces.plugins.PluginInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 2, 0) diff --git a/volatility3/framework/plugins/mac/list_files.py b/volatility3/framework/plugins/mac/list_files.py index c18b0b7a2..bf3dcfce6 100644 --- a/volatility3/framework/plugins/mac/list_files.py +++ b/volatility3/framework/plugins/mac/list_files.py @@ -28,8 +28,8 @@ class List_Files(plugins.PluginInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="mount", plugin=mount.Mount, version=(2, 0, 0) + requirements.VersionRequirement( + name="mount", component=mount.Mount, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/mac/lsof.py b/volatility3/framework/plugins/mac/lsof.py index 6832b837f..3191aeff6 100644 --- a/volatility3/framework/plugins/mac/lsof.py +++ b/volatility3/framework/plugins/mac/lsof.py @@ -29,8 +29,8 @@ class Lsof(plugins.PluginInterface): requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/mac/malfind.py b/volatility3/framework/plugins/mac/malfind.py index 3094ada85..7d28c2d2a 100644 --- a/volatility3/framework/plugins/mac/malfind.py +++ b/volatility3/framework/plugins/mac/malfind.py @@ -23,8 +23,8 @@ class Malfind(interfaces.plugins.PluginInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/mac/netstat.py b/volatility3/framework/plugins/mac/netstat.py index 76bba25f6..2eb7132f2 100644 --- a/volatility3/framework/plugins/mac/netstat.py +++ b/volatility3/framework/plugins/mac/netstat.py @@ -29,8 +29,8 @@ class Netstat(plugins.PluginInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 0, 0) diff --git a/volatility3/framework/plugins/mac/proc_maps.py b/volatility3/framework/plugins/mac/proc_maps.py index bd905615d..87f3559ea 100644 --- a/volatility3/framework/plugins/mac/proc_maps.py +++ b/volatility3/framework/plugins/mac/proc_maps.py @@ -28,8 +28,8 @@ class Maps(interfaces.plugins.PluginInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py index 28c238263..ba9b7b5f6 100644 --- a/volatility3/framework/plugins/mac/psaux.py +++ b/volatility3/framework/plugins/mac/psaux.py @@ -24,8 +24,8 @@ class Psaux(plugins.PluginInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/mac/pstree.py b/volatility3/framework/plugins/mac/pstree.py index ad5bb309b..260029b11 100644 --- a/volatility3/framework/plugins/mac/pstree.py +++ b/volatility3/framework/plugins/mac/pstree.py @@ -28,8 +28,8 @@ class PsTree(plugins.PluginInterface): description="Kernel module for the OS", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/mac/socket_filters.py b/volatility3/framework/plugins/mac/socket_filters.py index 49e77163e..2675ccdd0 100644 --- a/volatility3/framework/plugins/mac/socket_filters.py +++ b/volatility3/framework/plugins/mac/socket_filters.py @@ -32,8 +32,8 @@ class Socket_filters(plugins.PluginInterface): requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsmod", component=lsmod.Lsmod, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/mac/trustedbsd.py b/volatility3/framework/plugins/mac/trustedbsd.py index a03e2a903..3d76a018b 100644 --- a/volatility3/framework/plugins/mac/trustedbsd.py +++ b/volatility3/framework/plugins/mac/trustedbsd.py @@ -33,8 +33,8 @@ class Trustedbsd(plugins.PluginInterface): requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 3, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsmod", component=lsmod.Lsmod, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 5920cd266..bea9cd8a1 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -231,8 +231,8 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 7bc35945a..520dc8054 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -32,14 +32,14 @@ class Cachedump(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="lsadump", plugin=lsadump.Lsadump, version=(1, 0, 0) + requirements.VersionRequirement( + name="lsadump", component=lsadump.Lsadump, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="hashdump", plugin=hashdump.Hashdump, version=(1, 1, 0) + requirements.VersionRequirement( + name="hashdump", component=hashdump.Hashdump, version=(1, 1, 0) ), ] diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index bb326fd41..bcdd37869 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -38,17 +38,17 @@ class Callbacks(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) + requirements.VersionRequirement( + name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="driverirp", plugin=driverirp.DriverIrp, version=(1, 0, 0) + requirements.VersionRequirement( + name="driverirp", component=driverirp.DriverIrp, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="handles", plugin=handles.Handles, version=(3, 0, 0) + requirements.VersionRequirement( + name="handles", component=handles.Handles, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/cmdline.py b/volatility3/framework/plugins/windows/cmdline.py index c095cff9e..733b06605 100644 --- a/volatility3/framework/plugins/windows/cmdline.py +++ b/volatility3/framework/plugins/windows/cmdline.py @@ -27,8 +27,8 @@ class CmdLine(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index b7eab79fb..8c477b57d 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -38,8 +38,8 @@ class CmdScan(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="consoles", plugin=consoles.Consoles, version=(3, 0, 0) + requirements.VersionRequirement( + name="consoles", component=consoles.Consoles, version=(3, 0, 0) ), requirements.BooleanRequirement( name="no_registry", diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index a63b044d9..5a36cc796 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -48,8 +48,8 @@ class Consoles(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), requirements.BooleanRequirement( name="no_registry", diff --git a/volatility3/framework/plugins/windows/deskscan.py b/volatility3/framework/plugins/windows/deskscan.py index 6a8ff9e65..35430be5d 100644 --- a/volatility3/framework/plugins/windows/deskscan.py +++ b/volatility3/framework/plugins/windows/deskscan.py @@ -31,12 +31,12 @@ class DeskScan(desktops.Desktops): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="desktops", plugin=desktops.Desktops, version=(1, 0, 0) + requirements.VersionRequirement( + name="desktops", component=desktops.Desktops, version=(1, 0, 0) ), - requirements.PluginRequirement( + requirements.VersionRequirement( name="windowstations", - plugin=windowstations.WindowStations, + component=windowstations.WindowStations, version=(1, 0, 0), ), ] diff --git a/volatility3/framework/plugins/windows/desktops.py b/volatility3/framework/plugins/windows/desktops.py index 1085ff36d..c6557085e 100644 --- a/volatility3/framework/plugins/windows/desktops.py +++ b/volatility3/framework/plugins/windows/desktops.py @@ -31,9 +31,9 @@ class Desktops(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( + requirements.VersionRequirement( name="windowstations", - plugin=windowstations.WindowStations, + component=windowstations.WindowStations, version=(1, 0, 0), ), ] diff --git a/volatility3/framework/plugins/windows/devicetree.py b/volatility3/framework/plugins/windows/devicetree.py index 012a8750d..17ec1c451 100644 --- a/volatility3/framework/plugins/windows/devicetree.py +++ b/volatility3/framework/plugins/windows/devicetree.py @@ -89,8 +89,8 @@ class DeviceTree(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="driverscan", component=driverscan.DriverScan, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 9d5b81507..60dbf728c 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -91,14 +91,14 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) ), - requirements.PluginRequirement( - name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/driverirp.py b/volatility3/framework/plugins/windows/driverirp.py index 20d8ac170..d5452fa9c 100644 --- a/volatility3/framework/plugins/windows/driverirp.py +++ b/volatility3/framework/plugins/windows/driverirp.py @@ -58,14 +58,14 @@ class DriverIrp(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) + requirements.VersionRequirement( + name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="driverscan", component=driverscan.DriverScan, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(3, 0, 0) + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index 97e9e5b3c..c31fe2500 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -25,14 +25,14 @@ class DriverModule(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) + requirements.VersionRequirement( + name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="driverscan", plugin=driverscan.DriverScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="driverscan", component=driverscan.DriverScan, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(3, 0, 0) + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index 57edfe0b6..e19ff555b 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -24,8 +24,8 @@ class DriverScan(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/envars.py b/volatility3/framework/plugins/windows/envars.py index 6360ca10b..6c07e797f 100644 --- a/volatility3/framework/plugins/windows/envars.py +++ b/volatility3/framework/plugins/windows/envars.py @@ -39,11 +39,11 @@ class Envars(interfaces.plugins.PluginInterface): description="Suppress common and non-persistent variables", optional=True, ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/filescan.py b/volatility3/framework/plugins/windows/filescan.py index e0c823756..f417e3e5e 100644 --- a/volatility3/framework/plugins/windows/filescan.py +++ b/volatility3/framework/plugins/windows/filescan.py @@ -24,8 +24,8 @@ class FileScan(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/getservicesids.py b/volatility3/framework/plugins/windows/getservicesids.py index 19a73fba8..c04472eab 100644 --- a/volatility3/framework/plugins/windows/getservicesids.py +++ b/volatility3/framework/plugins/windows/getservicesids.py @@ -68,8 +68,8 @@ class GetServiceSIDs(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/getsids.py b/volatility3/framework/plugins/windows/getsids.py index 786dc3394..27894646e 100644 --- a/volatility3/framework/plugins/windows/getsids.py +++ b/volatility3/framework/plugins/windows/getsids.py @@ -83,11 +83,11 @@ class GetSIDs(interfaces.plugins.PluginInterface): element_type=int, optional=True, ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 9627b5caa..2f257772f 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -35,8 +35,8 @@ class Handles(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 68d5f834a..630aa1cfd 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -33,8 +33,8 @@ class Hashdump(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index 9f3fc4359..26216d2c3 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -46,12 +46,12 @@ class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) ), - requirements.PluginRequirement( - name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) ), - requirements.PluginRequirement( + requirements.VersionRequirement( name="direct_system_calls", - plugin=direct_system_calls.DirectSystemCalls, + component=direct_system_calls.DirectSystemCalls, version=(2, 0, 0), ), ] diff --git a/volatility3/framework/plugins/windows/memmap.py b/volatility3/framework/plugins/windows/memmap.py index 5a7bd1b9a..af4564259 100644 --- a/volatility3/framework/plugins/windows/memmap.py +++ b/volatility3/framework/plugins/windows/memmap.py @@ -27,8 +27,8 @@ class Memmap(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.IntRequirement( name="pid", diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 2c5827a25..06d397010 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -333,8 +333,8 @@ class ADS(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls): return [ - requirements.PluginRequirement( - name="MFTScan", plugin=MFTScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="MFTScan", component=MFTScan, version=(2, 0, 0) ), requirements.TranslationLayerRequirement( name="primary", @@ -403,8 +403,8 @@ class ResidentData(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls): return [ - requirements.PluginRequirement( - name="MFTScan", plugin=MFTScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="MFTScan", component=MFTScan, version=(2, 0, 0) ), requirements.TranslationLayerRequirement( name="primary", diff --git a/volatility3/framework/plugins/windows/mutantscan.py b/volatility3/framework/plugins/windows/mutantscan.py index 38685677a..ba2824bfc 100644 --- a/volatility3/framework/plugins/windows/mutantscan.py +++ b/volatility3/framework/plugins/windows/mutantscan.py @@ -24,8 +24,8 @@ class MutantScan(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 151fe88c9..5f26ae757 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -33,14 +33,14 @@ class Threads(thrdscan.ThrdScan): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) + requirements.VersionRequirement( + name="thrdscan", component=thrdscan.ThrdScan, version=(1, 1, 0) ), - requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) + requirements.VersionRequirement( + name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(3, 0, 0) + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 1f29a3aed..975ed2326 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -139,8 +139,8 @@ class PoolScanner(plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="handles", plugin=handles.Handles, version=(3, 0, 0) + requirements.VersionRequirement( + name="handles", component=handles.Handles, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/privileges.py b/volatility3/framework/plugins/windows/privileges.py index e41915442..6bc59bab6 100644 --- a/volatility3/framework/plugins/windows/privileges.py +++ b/volatility3/framework/plugins/windows/privileges.py @@ -60,8 +60,8 @@ class Privs(interfaces.plugins.PluginInterface): element_type=int, optional=True, ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 99fa9640b..07f026c7c 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -33,8 +33,8 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="info", component=info.Info, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/registry/getcellroutine.py b/volatility3/framework/plugins/windows/registry/getcellroutine.py index 5be4254ba..5f3b1dcaa 100644 --- a/volatility3/framework/plugins/windows/registry/getcellroutine.py +++ b/volatility3/framework/plugins/windows/registry/getcellroutine.py @@ -27,11 +27,11 @@ class GetCellRoutine(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) + requirements.VersionRequirement( + name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/registry/hivelist.py b/volatility3/framework/plugins/windows/registry/hivelist.py index fefd24b67..ec2fbc4c7 100644 --- a/volatility3/framework/plugins/windows/registry/hivelist.py +++ b/volatility3/framework/plugins/windows/registry/hivelist.py @@ -60,8 +60,8 @@ class HiveList(interfaces.plugins.PluginInterface): optional=True, default=None, ), - requirements.PluginRequirement( - name="hivescan", plugin=hivescan.HiveScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivescan", component=hivescan.HiveScan, version=(2, 0, 0) ), requirements.BooleanRequirement( name="dump", diff --git a/volatility3/framework/plugins/windows/registry/hivescan.py b/volatility3/framework/plugins/windows/registry/hivescan.py index 10843f8ab..2ebc52f53 100644 --- a/volatility3/framework/plugins/windows/registry/hivescan.py +++ b/volatility3/framework/plugins/windows/registry/hivescan.py @@ -25,11 +25,11 @@ class HiveScan(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="bigpools", plugin=bigpools.BigPools, version=(2, 0, 0) + requirements.VersionRequirement( + name="bigpools", component=bigpools.BigPools, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index c8b8f9cfb..6ca56b1bb 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -35,8 +35,8 @@ class PrintKey(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), requirements.IntRequirement( name="offset", description="Hive Offset", default=None, optional=True diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index ef51b91bf..7beeb7375 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -56,8 +56,8 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac requirements.IntRequirement( name="offset", description="Hive Offset", default=None, optional=True ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index ba54e19ec..951ac6e80 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -1123,8 +1123,8 @@ information about triggers, actions, run times, and creation times.""" description="Windows kernel", architectures=["Intel33", "Intel64"], ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/sessions.py b/volatility3/framework/plugins/windows/sessions.py index 73a537cd4..a21fa578d 100644 --- a/volatility3/framework/plugins/windows/sessions.py +++ b/volatility3/framework/plugins/windows/sessions.py @@ -27,8 +27,8 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index f26bf3d6b..eb2eb686b 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -64,8 +64,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/ssdt.py b/volatility3/framework/plugins/windows/ssdt.py index ed7d1310d..b4fa39950 100644 --- a/volatility3/framework/plugins/windows/ssdt.py +++ b/volatility3/framework/plugins/windows/ssdt.py @@ -31,8 +31,8 @@ class SSDT(plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(3, 0, 0) + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/strings.py b/volatility3/framework/plugins/windows/strings.py index 46784e48a..9ea4ffed0 100644 --- a/volatility3/framework/plugins/windows/strings.py +++ b/volatility3/framework/plugins/windows/strings.py @@ -33,8 +33,8 @@ class Strings(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index 00d4aa647..4a310c669 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -31,8 +31,8 @@ class SvcList(svcscan.SvcScan): def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: # Since we're calling the plugin, make sure we have the plugin's requirements return [ - requirements.PluginRequirement( - name="svcscan", plugin=svcscan.SvcScan, version=(4, 0, 0) + requirements.VersionRequirement( + name="svcscan", component=svcscan.SvcScan, version=(4, 0, 0) ), requirements.ModuleRequirement( name="kernel", diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 80400ec5a..94ce02897 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -50,11 +50,11 @@ class SvcScan(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 369db1fd8..5ba12736b 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -33,8 +33,8 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="poolscanner", plugin=poolscanner.PoolScanner, version=(3, 0, 0) + requirements.VersionRequirement( + name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 77062e8c6..789300306 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -31,8 +31,8 @@ class Threads(thrdscan.ThrdScan): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="thrdscan", plugin=thrdscan.ThrdScan, version=(1, 1, 0) + requirements.VersionRequirement( + name="thrdscan", component=thrdscan.ThrdScan, version=(1, 1, 0) ), ] diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index 132cf4e4f..3ff0aa158 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -97,8 +97,8 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="pe_symbols", plugin=pe_symbols.PESymbols, version=(3, 0, 0) + requirements.VersionRequirement( + name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/vadinfo.py b/volatility3/framework/plugins/windows/vadinfo.py index 2b1d3f4bc..22d42505f 100644 --- a/volatility3/framework/plugins/windows/vadinfo.py +++ b/volatility3/framework/plugins/windows/vadinfo.py @@ -63,8 +63,8 @@ class VadInfo(interfaces.plugins.PluginInterface): element_type=int, optional=True, ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.BooleanRequirement( name="dump", diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 5d2356f54..9b666cbcb 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -32,8 +32,8 @@ class VadRegExScan(plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/windows/vadwalk.py b/volatility3/framework/plugins/windows/vadwalk.py index cc8105e0c..38b5d197e 100644 --- a/volatility3/framework/plugins/windows/vadwalk.py +++ b/volatility3/framework/plugins/windows/vadwalk.py @@ -28,11 +28,11 @@ class VadWalk(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="vadinfo", plugin=vadinfo.VadInfo, version=(2, 0, 0) + requirements.VersionRequirement( + name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index a19206e22..b86869969 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -29,14 +29,14 @@ class VadYaraScan(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="yarascan", plugin=yarascan.YaraScan, version=(2, 0, 0) + requirements.VersionRequirement( + name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) ), requirements.ListRequirement( name="pid", diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index 49bf0b212..b5eba7ec6 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -42,11 +42,11 @@ class VerInfo(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(3, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) ), - requirements.PluginRequirement( - name="modules", plugin=modules.Modules, version=(3, 0, 0) + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) ), requirements.BooleanRequirement( name="extensive", diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index fd33d75a7..caf244f95 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -24,11 +24,11 @@ class Certificates(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="hivelist", plugin=hivelist.HiveList, version=(2, 0, 0) + requirements.VersionRequirement( + name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="printkey", plugin=printkey.PrintKey, version=(1, 0, 0) + requirements.VersionRequirement( + name="printkey", component=printkey.PrintKey, version=(1, 0, 0) ), requirements.BooleanRequirement( name="dump", From 3153cd7e30dd7444eb6e35be9f4ed35bc4febc8f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 19:21:51 +0000 Subject: [PATCH 0890/1352] Remove the chainmap and multiple dictionaries to reduce memory consumption --- volatility3/framework/interfaces/objects.py | 12 ++++++------ volatility3/framework/renderers/__init__.py | 7 +++++-- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 7317469f1..8419f9d4d 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -133,8 +133,10 @@ class ObjectInterface(metaclass=abc.ABCMeta): mask = context.layers[object_info.layer_name].address_mask normalized_offset = object_info.offset & mask + self._vol = kwargs vol_info_dict = {"type_name": type_name, "offset": normalized_offset} - self._vol = collections.ChainMap({}, vol_info_dict, object_info, kwargs) + self._vol.update(object_info) + self._vol.update(vol_info_dict) self._context = context def __getattr__(self, attr: str) -> Any: @@ -317,10 +319,8 @@ class Template: """Stores the keyword arguments for later object creation.""" # Allow the updating of template arguments whilst still in template form super().__init__() - empty_dict: Dict[str, Any] = {} - self._vol = collections.ChainMap( - empty_dict, arguments, {"type_name": type_name} - ) + self._vol = {"type_name": type_name} + self._vol.update(arguments) @property def vol(self) -> ReadOnlyMapping: @@ -364,7 +364,7 @@ class Template: def clone(self) -> "Template": """Returns a copy of the original Template as constructed (without `update_vol` additions having been made)""" - clone = self.__class__(**self._vol.parents.new_child()) + clone = self.__class__(**self._vol) return clone def update_vol(self, **new_arguments) -> None: diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index 093edf8cc..cc3129e87 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -61,7 +61,7 @@ class TreeNode(interfaces.renderers.TreeNode): self._treegrid = treegrid self._parent = parent self._path = path - self._validate_values(values) + validated_values = self._validate_values(values) self._values = treegrid.RowStructure(*values) # type: ignore def __repr__(self) -> str: @@ -73,9 +73,12 @@ class TreeNode(interfaces.renderers.TreeNode): def __len__(self) -> int: return len(self._treegrid.children(self)) - def _validate_values(self, values: List[interfaces.renderers.BaseTypes]) -> None: + def _validate_values( + self, values: List[interfaces.renderers.BaseTypes] + ) -> List[interfaces.renderers.BaseTypes]: """A function for raising exceptions if a given set of values is invalid according to the column properties.""" + new_values = () if not ( isinstance(values, collections.abc.Sequence) and len(values) == len(self._treegrid.columns) From f80b207aabcb56ace8a803594840c0f74fb28b24 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 24 Mar 2025 20:36:25 +0100 Subject: [PATCH 0891/1352] download symbols_win-10_19041-2025_03.zip --- .github/workflows/test.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 336ca48f3..2e894f24a 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -38,8 +38,9 @@ jobs: - name: Download and Extract symbols run: | cd ./volatility3/symbols - curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip + curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip https://downloads.volatilityfoundation.org/volatility3/symbols/symbols_win-10_19041-2025_03.zip unzip linux.zip + unzip symbols_win-10_19041-2025_03.zip cd - - name: Testing... From 166d0e0c14974419ad1d60448819d67492466d96 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 19:37:59 +0000 Subject: [PATCH 0892/1352] Fix issue when pe_symbols limited to searching one process. Remove need to track symbol indexes. Provide much more useful debugging information. Fixes #1732 --- .../framework/plugins/windows/pe_symbols.py | 45 +++++++++++++------ 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index b26e8d113..1ce40e1f8 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -229,7 +229,6 @@ class ExportSymbolFinder(PESymbolFinder): Returns: address: the address of the symbol, if found """ - for export in self._symbol_module: sym_name = self._get_name(export) if sym_name and sym_name == name: @@ -413,8 +412,10 @@ class PESymbols(interfaces.plugins.PluginInterface): ) for mod_name, unresolved_symbols in missing_symbols.items(): - for symbol in unresolved_symbols: - vollog.debug(f"Unable to resolve symbol {symbol} in module {mod_name}") + for symbol_key, symbols in unresolved_symbols.items(): + vollog.debug( + f"Unable to resolve symbols {symbols} of type {symbol_key} in module {mod_name}" + ) return found_symbols @@ -632,7 +633,7 @@ class PESymbols(interfaces.plugins.PluginInterface): def _get_symbol_value( wanted_symbols: filter_module_info, symbol_resolver: PESymbolFinder, - ) -> Generator[Tuple[str, int, str, int], None, None]: + ) -> Generator[Tuple[str, str, int], None, None]: """ Enumerates the symbols specified as wanted by the calling plugin @@ -661,15 +662,25 @@ class PESymbols(interfaces.plugins.PluginInterface): # address or name if symbol_key in wanted_symbols: # walk each wanted address or name - for value_index, wanted_value in enumerate(wanted_symbols[symbol_key]): - symbol_value = symbol_getter(wanted_value) + # build dict in this function for debugging and tracking + all_wanted = [] + for wanted_value in wanted_symbols[symbol_key]: + all_wanted.append(wanted_value) + + for value_index, wanted_value in enumerate(all_wanted): + symbol_value = symbol_getter(wanted_value) if symbol_value: # yield out deleteion key, deletion index, symbol name, symbol address if symbol_key == wanted_names_identifier: - yield symbol_key, value_index, wanted_value, symbol_value # type: ignore + yield symbol_key, wanted_value, symbol_value # type: ignore else: - yield symbol_key, value_index, symbol_value, wanted_value # type: ignore + yield symbol_key, symbol_value, wanted_value # type: ignore + + for value in all_wanted: + vollog.debug( + f"Unable to resolve value {value} using getter {symbol_getter}" + ) @classmethod def _validate_wanted_modules( @@ -742,7 +753,7 @@ class PESymbols(interfaces.plugins.PluginInterface): PESymbols._find_symbols_through_exports, ] - found: found_symbols_module = [] + found_symbols: found_symbols_module = [] # the symbols wanted from this module by the caller wanted = wanted_modules[mod_name] @@ -760,12 +771,17 @@ class PESymbols(interfaces.plugins.PluginInterface): vollog.debug(f"Have resolver for method {method}") for ( symbol_key, - value_index, symbol_name, symbol_address, ) in PESymbols._get_symbol_value(remaining, symbol_resolver): - found.append((symbol_name, symbol_address)) - del remaining[symbol_key][value_index] + found_symbols.append((symbol_name, symbol_address)) + + if symbol_key == wanted_names_identifier: + to_remove = symbol_name + else: + to_remove = symbol_address + + remaining[symbol_key].remove(to_remove) # everything was resolved, stop this resolver # remove this key from the remaining symbols to resolve @@ -781,7 +797,7 @@ class PESymbols(interfaces.plugins.PluginInterface): if done_processing: break - return found, remaining + return found_symbols, remaining @classmethod def find_symbols( @@ -970,7 +986,8 @@ class PESymbols(interfaces.plugins.PluginInterface): Generator[Tuple[interfaces.objects.ObjectInterface, str, ranges_type]]: Yields tuple of process objects, layers, and VADs mapping files """ procs = pslist.PsList.list_processes( - context=context, kernel_module_name=kernel_module_name + context=context, + kernel_module_name=kernel_module_name, ) for proc in procs: From 6a28d1432fba67b854ca2ffc158662d89b12b4f6 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 24 Mar 2025 20:39:44 +0100 Subject: [PATCH 0893/1352] adjust curl cmds --- .github/workflows/test.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 2e894f24a..56d671102 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -38,7 +38,8 @@ jobs: - name: Download and Extract symbols run: | cd ./volatility3/symbols - curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip https://downloads.volatilityfoundation.org/volatility3/symbols/symbols_win-10_19041-2025_03.zip + curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip + curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/symbols_win-10_19041-2025_03.zip unzip linux.zip unzip symbols_win-10_19041-2025_03.zip cd - From 8610c681aba380b7f77ddcce9ed22e716e10b7f5 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 22:33:25 +0000 Subject: [PATCH 0894/1352] Restore the chainmap, since we need it for cloning --- volatility3/framework/interfaces/objects.py | 50 ++++++++++++++++----- volatility3/framework/renderers/__init__.py | 7 +-- 2 files changed, 41 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 8419f9d4d..995a5f29b 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -54,7 +54,7 @@ class ReadOnlyMapping(collections.abc.Mapping): return dict(self) == dict(other) -class ObjectInformation(ReadOnlyMapping): +class ObjectInformation(collections.abc.Mapping): """Contains common information useful/pertinent only to an individual object (like an instance) @@ -65,7 +65,14 @@ class ObjectInformation(ReadOnlyMapping): in a single place. These values are based on the :class:`ReadOnlyMapping` class, to prevent their modification. """ - __slots__ = () + __slots__ = ( + "layer_name", + "offset", + "member_name", + "parent", + "native_layer_name", + "size", + ) def __init__( self, @@ -86,17 +93,36 @@ class ObjectInformation(ReadOnlyMapping): native_layer_name: If this object references other objects (such as a pointer), what layer those objects live in size: The size that the whole structure consumes in bytes """ - super().__init__( - { - "layer_name": layer_name, - "offset": offset, - "member_name": member_name, - "parent": parent, - "native_layer_name": native_layer_name or layer_name, - "size": size, - } + self.layer_name = layer_name + self.offset = offset + self.member_name = member_name + self.parent = parent + self.native_layer_name = native_layer_name or layer_name + self.size = size + + def __getattr__(self, attr: str) -> Any: + """Returns the item as an attribute.""" + if attr in self.__slots__: + return getattr(self, attr) + raise AttributeError( + f"Object has no attribute: {self.__class__.__name__}.{attr}" ) + def __getitem__(self, name: str) -> Any: + """Returns the item requested.""" + return getattr(self, name) + + def __iter__(self): + """Returns an iterator of the dictionary items.""" + return self.__slots__.__iter__() + + def __len__(self) -> int: + """Returns the length of the internal dictionary.""" + return len(self.__slots__) + + def __eq__(self, other): + return dict(self) == dict(other) + class ObjectInterface(metaclass=abc.ABCMeta): """A base object required to be the ancestor of every object used in @@ -137,6 +163,7 @@ class ObjectInterface(metaclass=abc.ABCMeta): vol_info_dict = {"type_name": type_name, "offset": normalized_offset} self._vol.update(object_info) self._vol.update(vol_info_dict) + self._vol = collections.ChainMap({}, self._vol) self._context = context def __getattr__(self, attr: str) -> Any: @@ -321,6 +348,7 @@ class Template: super().__init__() self._vol = {"type_name": type_name} self._vol.update(arguments) + self._vol = collections.ChainMap({}, self._vol) @property def vol(self) -> ReadOnlyMapping: diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index cc3129e87..093edf8cc 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -61,7 +61,7 @@ class TreeNode(interfaces.renderers.TreeNode): self._treegrid = treegrid self._parent = parent self._path = path - validated_values = self._validate_values(values) + self._validate_values(values) self._values = treegrid.RowStructure(*values) # type: ignore def __repr__(self) -> str: @@ -73,12 +73,9 @@ class TreeNode(interfaces.renderers.TreeNode): def __len__(self) -> int: return len(self._treegrid.children(self)) - def _validate_values( - self, values: List[interfaces.renderers.BaseTypes] - ) -> List[interfaces.renderers.BaseTypes]: + def _validate_values(self, values: List[interfaces.renderers.BaseTypes]) -> None: """A function for raising exceptions if a given set of values is invalid according to the column properties.""" - new_values = () if not ( isinstance(values, collections.abc.Sequence) and len(values) == len(self._treegrid.columns) From 0ea5d795fdfbe3f562d6d04fde5a6192de29003b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 22:36:12 +0000 Subject: [PATCH 0895/1352] Fix ruff issue --- volatility3/framework/interfaces/objects.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 995a5f29b..93c0ac16f 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -8,7 +8,7 @@ import collections import collections.abc import contextlib import logging -from typing import Any, Dict, List, Mapping, Optional +from typing import Any, List, Mapping, Optional from volatility3.framework import constants, interfaces From 62d1d818b3f751534baae6b2fbc0a063e43d183c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 22:40:14 +0000 Subject: [PATCH 0896/1352] Restore use of ChainMap as well --- volatility3/framework/interfaces/objects.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 93c0ac16f..e1d36abb4 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -346,9 +346,8 @@ class Template: """Stores the keyword arguments for later object creation.""" # Allow the updating of template arguments whilst still in template form super().__init__() - self._vol = {"type_name": type_name} - self._vol.update(arguments) - self._vol = collections.ChainMap({}, self._vol) + vol = {"type_name": type_name}.update(arguments) + self._vol = collections.ChainMap({}, vol) @property def vol(self) -> ReadOnlyMapping: @@ -392,7 +391,7 @@ class Template: def clone(self) -> "Template": """Returns a copy of the original Template as constructed (without `update_vol` additions having been made)""" - clone = self.__class__(**self._vol) + clone = self.__class__(**self._vol.parents.new_child()) return clone def update_vol(self, **new_arguments) -> None: From 292ed6aeb46ff9bbbfbd0a8f73460bebf21f32b7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 22:41:52 +0000 Subject: [PATCH 0897/1352] Try to avoid variables changing types --- volatility3/framework/interfaces/objects.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index e1d36abb4..d6ad47bec 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -159,11 +159,11 @@ class ObjectInterface(metaclass=abc.ABCMeta): mask = context.layers[object_info.layer_name].address_mask normalized_offset = object_info.offset & mask - self._vol = kwargs + vol = kwargs vol_info_dict = {"type_name": type_name, "offset": normalized_offset} - self._vol.update(object_info) - self._vol.update(vol_info_dict) - self._vol = collections.ChainMap({}, self._vol) + vol.update(object_info) + vol.update(vol_info_dict) + self._vol = collections.ChainMap({}, vol) self._context = context def __getattr__(self, attr: str) -> Any: From 200746cbe6264e8e84b9b4ade0f9116b0848c45d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 22:46:36 +0000 Subject: [PATCH 0898/1352] Fix silly usage of update --- volatility3/framework/interfaces/objects.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index d6ad47bec..7f4667b4e 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -346,7 +346,8 @@ class Template: """Stores the keyword arguments for later object creation.""" # Allow the updating of template arguments whilst still in template form super().__init__() - vol = {"type_name": type_name}.update(arguments) + vol = {"type_name": type_name} + vol.update(arguments) self._vol = collections.ChainMap({}, vol) @property From acfedd6d9cbbdca0a8058cec5cefc303455f591e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 23:23:22 +0000 Subject: [PATCH 0899/1352] Sets slots to none has no effect on memory as long as __dict__ isn't instanciated --- volatility3/framework/interfaces/objects.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 7f4667b4e..e77a5893c 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -128,8 +128,6 @@ class ObjectInterface(metaclass=abc.ABCMeta): """A base object required to be the ancestor of every object used in volatility.""" - __slots__ = () - def __init__( self, context: "interfaces.context.ContextInterface", From a013170a2d2c22d48ae0f90354640b19117b5cd2 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 24 Mar 2025 23:58:45 +0000 Subject: [PATCH 0900/1352] Slotting has little effect, so don't change so much --- volatility3/framework/interfaces/objects.py | 54 +++++---------------- 1 file changed, 11 insertions(+), 43 deletions(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index e77a5893c..b7ea616c7 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -8,7 +8,7 @@ import collections import collections.abc import contextlib import logging -from typing import Any, List, Mapping, Optional +from typing import Any, Dict, List, Mapping, Optional from volatility3.framework import constants, interfaces @@ -23,8 +23,6 @@ class ReadOnlyMapping(collections.abc.Mapping): modified, making an immutable mapping. """ - __slots__ = ("_dict",) - def __init__(self, dictionary: Mapping[str, Any]) -> None: self._dict = dictionary @@ -54,7 +52,7 @@ class ReadOnlyMapping(collections.abc.Mapping): return dict(self) == dict(other) -class ObjectInformation(collections.abc.Mapping): +class ObjectInformation(ReadOnlyMapping): """Contains common information useful/pertinent only to an individual object (like an instance) @@ -65,15 +63,6 @@ class ObjectInformation(collections.abc.Mapping): in a single place. These values are based on the :class:`ReadOnlyMapping` class, to prevent their modification. """ - __slots__ = ( - "layer_name", - "offset", - "member_name", - "parent", - "native_layer_name", - "size", - ) - def __init__( self, layer_name: str, @@ -93,36 +82,17 @@ class ObjectInformation(collections.abc.Mapping): native_layer_name: If this object references other objects (such as a pointer), what layer those objects live in size: The size that the whole structure consumes in bytes """ - self.layer_name = layer_name - self.offset = offset - self.member_name = member_name - self.parent = parent - self.native_layer_name = native_layer_name or layer_name - self.size = size - - def __getattr__(self, attr: str) -> Any: - """Returns the item as an attribute.""" - if attr in self.__slots__: - return getattr(self, attr) - raise AttributeError( - f"Object has no attribute: {self.__class__.__name__}.{attr}" + super().__init__( + { + "layer_name": layer_name, + "offset": offset, + "member_name": member_name, + "parent": parent, + "native_layer_name": native_layer_name or layer_name, + "size": size, + } ) - def __getitem__(self, name: str) -> Any: - """Returns the item requested.""" - return getattr(self, name) - - def __iter__(self): - """Returns an iterator of the dictionary items.""" - return self.__slots__.__iter__() - - def __len__(self) -> int: - """Returns the length of the internal dictionary.""" - return len(self.__slots__) - - def __eq__(self, other): - return dict(self) == dict(other) - class ObjectInterface(metaclass=abc.ABCMeta): """A base object required to be the ancestor of every object used in @@ -338,8 +308,6 @@ class Template: constructed at resolution time and then cached. """ - __slots__ = "_vol" - def __init__(self, type_name: str, **arguments) -> None: """Stores the keyword arguments for later object creation.""" # Allow the updating of template arguments whilst still in template form From de11e87f28661f8b30d7d2c38ea8480461a0536c Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 25 Mar 2025 00:08:07 +0000 Subject: [PATCH 0901/1352] Fix ruff error (again) --- volatility3/framework/interfaces/objects.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index b7ea616c7..1bca7a045 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -8,7 +8,7 @@ import collections import collections.abc import contextlib import logging -from typing import Any, Dict, List, Mapping, Optional +from typing import Any, List, Mapping, Optional from volatility3.framework import constants, interfaces From 0f098fc160b18e0ac840c5da5159bb2e14d392cc Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 20:13:10 -0500 Subject: [PATCH 0902/1352] Address feedback --- volatility3/framework/plugins/windows/pe_symbols.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 1ce40e1f8..3a08a1002 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -642,7 +642,7 @@ class PESymbols(interfaces.plugins.PluginInterface): symbol_resolver: method in a layer to resolve the symbols Returns: - Tuple[str, int, str, int]: the index and value of the found symbol in the wanted list, and the name and address of resolved symbol + Tuple[str, str, int]: the symbol identifier (key) of the found symbol in the wanted list, and the name and address of resolved symbol """ if ( wanted_names_identifier not in wanted_symbols @@ -673,9 +673,9 @@ class PESymbols(interfaces.plugins.PluginInterface): if symbol_value: # yield out deleteion key, deletion index, symbol name, symbol address if symbol_key == wanted_names_identifier: - yield symbol_key, wanted_value, symbol_value # type: ignore + yield symbol_key, wanted_value, symbol_value else: - yield symbol_key, symbol_value, wanted_value # type: ignore + yield symbol_key, symbol_value, wanted_value for value in all_wanted: vollog.debug( From 1a2427b54b312e3a3283b877915ae32664a00e68 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 20:18:54 -0500 Subject: [PATCH 0903/1352] Change column order --- volatility3/framework/plugins/windows/processghosting.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index 28af57053..023ee877a 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -187,10 +187,10 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): yield 0, ( pid, process_name, + format_hints.Hex(base_address), format_hints.Hex(file_object_address), delete_pending or renderers.NotApplicableValue(), delete_on_close or renderers.NotApplicableValue(), - format_hints.Hex(base_address), path, ) @@ -201,10 +201,10 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): [ ("PID", int), ("Process", str), + ("Base", format_hints.Hex), ("FILE_OBJECT", format_hints.Hex), ("DeletePending", int), ("DeleteOnClose", int), - ("Base", format_hints.Hex), ("Path", str), ], self._generator( From 3a4e622854708ebd0b8bb4bc48c57ceb2db61828 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 24 Mar 2025 20:19:59 -0500 Subject: [PATCH 0904/1352] Change pending checking and OS version --- volatility3/framework/plugins/windows/processghosting.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index 023ee877a..6e91a72cd 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -99,7 +99,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: delete_pending = None - if delete_pending and delete_pending == 1: + if delete_pending == 1: yield file_object.vol.offset, delete_pending, None @classmethod @@ -158,7 +158,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): ) if not has_imagefilepointer: vollog.warning( - "ImageFilePointer checks are only supported on Windows 10 builds when the ImageFilePointer member of _EPROCESS is present" + "ImageFilePointer checks are only supported on Windows 10+ builds when the ImageFilePointer member of _EPROCESS is present" ) for proc in procs: From d70d8820a95e6ad3c973e63ffc6b6423c614ed71 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 25 Mar 2025 11:41:28 +0100 Subject: [PATCH 0905/1352] use winxp against scanner plugins (performances) --- test/plugins/windows/windows.py | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index fe2ea2d51..3ad9dc70d 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -60,7 +60,8 @@ class TestWindowsPslist: class TestWindowsPsscan: - def test_windows_generic_psscan(self, volatility, python, image): + def test_windows_specific_psscan(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( "windows.psscan.PsScan", image, volatility, python ) @@ -243,7 +244,8 @@ class TestWindowsSvcScan: class TestWindowsThrdscan: - def test_windows_generic_thrdscan(self, volatility, python, image): + def test_windows_specific_thrdscan(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( "windows.thrdscan.ThrdScan", image, volatility, python ) @@ -327,7 +329,8 @@ class TestWindowsEnvars: class TestWindowsCallbacks: - def test_windows_generic_callbacks(self, volatility, python, image): + def test_windows_specific_callbacks(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( "windows.callbacks.Callbacks", image, volatility, python ) @@ -359,7 +362,8 @@ class TestWindowsVadwalk: class TestWindowsDevicetree: - def test_windows_generic_devicetree(self, volatility, python, image): + def test_windows_specific_devicetree(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( "windows.devicetree.DeviceTree", image, volatility, python ) @@ -577,7 +581,8 @@ class TestWindowsCrashinfo: class TestWindowsDriverIrp: - def test_windows_generic_driverirp(self, volatility, python, image): + def test_windows_specific_driverirp(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( "windows.driverirp.DriverIrp", image, @@ -594,7 +599,8 @@ class TestWindowsDriverIrp: class TestWindowsDriverScan: - def test_windows_generic_driverscan(self, volatility, python, image): + def test_windows_specific_driverscan(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( "windows.driverscan.DriverScan", image, @@ -740,7 +746,8 @@ class TestWindowsKPCRs: class TestWindowsLdrModules: - def test_windows_generic_ldrmodules(self, volatility, python, image): + def test_windows_specific_ldrmodules(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( "windows.ldrmodules.LdrModules", image, From d753e8ecb6c070c9834cdf4e11ecfb6ac807bd29 Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 25 Mar 2025 17:25:55 +0000 Subject: [PATCH 0906/1352] Update CODING_STYLE.md Thanks, my fingers don't work as well as they used to, so I appreciate you picking up typos like this! Co-authored-by: Donghyun Kim --- CODING_STYLE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CODING_STYLE.md b/CODING_STYLE.md index 2f18959c8..8301eebc2 100644 --- a/CODING_STYLE.md +++ b/CODING_STYLE.md @@ -7,7 +7,7 @@ All code submissions will be vetted automatically through tests from both and th Code Linter: Ruff Code Formatter: Black -In additiom, there are some coding practices that we employ to prevent specific failure cases and ensure consistency across the codebase. These are documented below along with the rationale for the decision. +In addition, there are some coding practices that we employ to prevent specific failure cases and ensure consistency across the codebase. These are documented below along with the rationale for the decision. This is heavily based upon https://google.github.io/styleguide/pyguide.html with minor modifications for volatility use. From 5c2d646829b2806a3874ee3b5538c7c33127dd98 Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 25 Mar 2025 17:27:06 +0000 Subject: [PATCH 0907/1352] Update CODING_STYLE.md Co-authored-by: Donghyun Kim --- CODING_STYLE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CODING_STYLE.md b/CODING_STYLE.md index 8301eebc2..bf12288d3 100644 --- a/CODING_STYLE.md +++ b/CODING_STYLE.md @@ -81,7 +81,7 @@ Okay for one-liners. Prefer generator expressions over map() or filter() with a Default Arguments ----------------- -Default arguments are fine, but not with mutable types (because they're consructed once at module load time and can lead to confusion/errors.) +Default arguments are fine, but not with mutable types (because they're constructed once at module load time and can lead to confusion/errors.) True/False Evaluations ---------------------- From f0b6b0405fa98636579e25e27b23880215beea97 Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 25 Mar 2025 17:27:31 +0000 Subject: [PATCH 0908/1352] Update CODING_STYLE.md Hehehe, good catch, thanks! 5:D Co-authored-by: Donghyun Kim --- CODING_STYLE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CODING_STYLE.md b/CODING_STYLE.md index bf12288d3..700167258 100644 --- a/CODING_STYLE.md +++ b/CODING_STYLE.md @@ -66,7 +66,7 @@ Shared functionality -------------------- Within a plugin, there may be functions that are useful to other plugins. These are created as `classmethod`s so that the plugin can be depended upon by other plugins in their requirements section, without needing to instantiate a whole copy of the plugin. It is not a staticmethod, because the caller may wish to determine information about the class the method is defined in, and this is not easily accessible for staticmethods. -A classmethod usually takes a `context` for its first method (and if it requires one, a configuration string for it second). All other parameters should generally be basic types (such as strings, numbers, etc) so that future work requiring paralellization does not have complex types to have to keep in sync. In particular, the idea was to ensure only one context was used per method (and each object brings its own context with it, meaning the function signature should not include objects to avoid discrepancies). +A classmethod usually takes a `context` for its first method (and if it requires one, a configuration string for it second). All other parameters should generally be basic types (such as strings, numbers, etc) so that future work requiring parallelization does not have complex types to have to keep in sync. In particular, the idea was to ensure only one context was used per method (and each object brings its own context with it, meaning the function signature should not include objects to avoid discrepancies). Comprehensions -------------- From d5fc0502246609fb255c4222ae2f5208195e22bd Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 25 Mar 2025 17:25:07 -0500 Subject: [PATCH 0909/1352] Timeliner: add `VersionableInterface` superclass This adds `interfaces.configuration.VersionableInterface` as a superclass to `TimelinerInterface` in order to be consistent with other versioned interfaces such as `PluginInterface`. --- volatility3/framework/plugins/timeliner.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/timeliner.py b/volatility3/framework/plugins/timeliner.py index 6000704eb..f65868705 100644 --- a/volatility3/framework/plugins/timeliner.py +++ b/volatility3/framework/plugins/timeliner.py @@ -25,10 +25,14 @@ class TimeLinerType(enum.IntEnum): CHANGED = 4 -class TimeLinerInterface(metaclass=abc.ABCMeta): +class TimeLinerInterface( + interfaces.configuration.VersionableInterface, metaclass=abc.ABCMeta +): """Interface defining methods that timeliner will use to generate a body file.""" + _version = (1, 0, 0) + @abc.abstractmethod def generate_timeline( self, From 66992a5d9ae8839aff8e35582a0216764315c4a4 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 25 Mar 2025 17:42:35 -0500 Subject: [PATCH 0910/1352] Requirements: Insert missing version requirements This audits the entire codebase for missing `VersionRequirements` and adds them as needed. --- volatility3/framework/plugins/linux/bash.py | 5 +++++ volatility3/framework/plugins/linux/boottime.py | 5 +++++ volatility3/framework/plugins/linux/lsof.py | 5 +++++ volatility3/framework/plugins/linux/pagecache.py | 5 +++++ volatility3/framework/plugins/linux/pslist.py | 5 +++++ volatility3/framework/plugins/mac/bash.py | 5 +++++ volatility3/framework/plugins/windows/amcache.py | 5 +++++ volatility3/framework/plugins/windows/consoles.py | 5 ++++- volatility3/framework/plugins/windows/dlllist.py | 5 +++++ volatility3/framework/plugins/windows/driverscan.py | 3 +++ volatility3/framework/plugins/windows/mftscan.py | 8 ++++++++ volatility3/framework/plugins/windows/netscan.py | 5 +++++ volatility3/framework/plugins/windows/netstat.py | 5 +++++ volatility3/framework/plugins/windows/processghosting.py | 3 +++ volatility3/framework/plugins/windows/pslist.py | 5 +++++ volatility3/framework/plugins/windows/psscan.py | 5 +++++ .../framework/plugins/windows/registry/userassist.py | 5 +++++ volatility3/framework/plugins/windows/scheduled_tasks.py | 5 +++++ volatility3/framework/plugins/windows/sessions.py | 5 +++++ volatility3/framework/plugins/windows/shimcachemem.py | 5 +++++ volatility3/framework/plugins/windows/svclist.py | 3 +++ volatility3/framework/plugins/windows/symlinkscan.py | 5 +++++ volatility3/framework/plugins/windows/thrdscan.py | 8 ++++++++ volatility3/framework/plugins/windows/threads.py | 3 +++ volatility3/framework/plugins/windows/unloadedmodules.py | 8 ++++++++ 25 files changed, 125 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index fd73b4df2..2a63ac329 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -35,6 +35,11 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(4, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.ListRequirement( name="pid", element_type=int, diff --git a/volatility3/framework/plugins/linux/boottime.py b/volatility3/framework/plugins/linux/boottime.py index c1a75d478..0b9abb856 100644 --- a/volatility3/framework/plugins/linux/boottime.py +++ b/volatility3/framework/plugins/linux/boottime.py @@ -25,6 +25,11 @@ class Boottime(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) description="Linux kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(4, 0, 0) ), diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 8e0143584..283eabca0 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -123,6 +123,11 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(4, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) ), diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 879bc3288..0bb3b9263 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -129,6 +129,11 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="mountinfo", component=mountinfo.MountInfo, version=(1, 2, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.ListRequirement( name="type", description="List of space-separated file type filters i.e. --type REG DIR", diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 8296c82fa..2f0cc00b7 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -53,6 +53,11 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): element_type=int, optional=True, ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.BooleanRequirement( name="threads", description="Include user threads", diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index aca0aea0c..4cbade1cf 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -33,6 +33,11 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.ListRequirement( name="pid", description="Filter on specific process IDs", diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index bea9cd8a1..4ac5554e0 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -234,6 +234,11 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), ] def generate_timeline( diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 5a36cc796..8999e1bab 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -46,7 +46,10 @@ class Consoles(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) + name="verinfo", component=verinfo.VerInfo, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="info", component=info.Info, version=(1, 0, 0) ), requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index b1c6f2f05..b851cf7fd 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -36,6 +36,11 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), diff --git a/volatility3/framework/plugins/windows/driverscan.py b/volatility3/framework/plugins/windows/driverscan.py index e19ff555b..57d365d00 100644 --- a/volatility3/framework/plugins/windows/driverscan.py +++ b/volatility3/framework/plugins/windows/driverscan.py @@ -27,6 +27,9 @@ class DriverScan(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 06d397010..74cadc833 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -32,9 +32,17 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): description="Memory layer for the kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) ), + requirements.VersionRequirement( + name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/netscan.py b/volatility3/framework/plugins/windows/netscan.py index 1ab748864..fa422e103 100644 --- a/volatility3/framework/plugins/windows/netscan.py +++ b/volatility3/framework/plugins/windows/netscan.py @@ -39,6 +39,11 @@ class NetScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="info", component=info.Info, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) ), diff --git a/volatility3/framework/plugins/windows/netstat.py b/volatility3/framework/plugins/windows/netstat.py index 655ef710a..cf7f5272a 100644 --- a/volatility3/framework/plugins/windows/netstat.py +++ b/volatility3/framework/plugins/windows/netstat.py @@ -39,6 +39,11 @@ class NetStat(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="modules", component=modules.Modules, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) ), diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index 6e91a72cd..7e7f6d3cc 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -33,6 +33,9 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 1) + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 1cb2c6356..b92fdf66c 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -41,6 +41,11 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): default=cls.PHYSICAL_DEFAULT, optional=True, ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.ListRequirement( name="pid", element_type=int, diff --git a/volatility3/framework/plugins/windows/psscan.py b/volatility3/framework/plugins/windows/psscan.py index 07f026c7c..ae37c20a1 100644 --- a/volatility3/framework/plugins/windows/psscan.py +++ b/volatility3/framework/plugins/windows/psscan.py @@ -36,6 +36,11 @@ class PsScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="info", component=info.Info, version=(2, 0, 0) ), diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 7beeb7375..809d0b2b3 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -59,6 +59,11 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), ] def parse_userassist_data(self, reg_val): diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 951ac6e80..4247bda74 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -1126,6 +1126,11 @@ information about triggers, actions, run times, and creation times.""" requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), ] def generate_timeline( diff --git a/volatility3/framework/plugins/windows/sessions.py b/volatility3/framework/plugins/windows/sessions.py index a21fa578d..29d0b2104 100644 --- a/volatility3/framework/plugins/windows/sessions.py +++ b/volatility3/framework/plugins/windows/sessions.py @@ -30,6 +30,11 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.ListRequirement( name="pid", element_type=int, diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index eb2eb686b..7883dfba3 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -67,6 +67,11 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) ), diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index 4a310c669..24ac2278f 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -34,6 +34,9 @@ class SvcList(svcscan.SvcScan): requirements.VersionRequirement( name="svcscan", component=svcscan.SvcScan, version=(4, 0, 0) ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), requirements.ModuleRequirement( name="kernel", description="Windows kernel", diff --git a/volatility3/framework/plugins/windows/symlinkscan.py b/volatility3/framework/plugins/windows/symlinkscan.py index 358ea130e..cdcb5d3d3 100644 --- a/volatility3/framework/plugins/windows/symlinkscan.py +++ b/volatility3/framework/plugins/windows/symlinkscan.py @@ -27,6 +27,11 @@ class SymlinkScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfa description="Windows kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 5bafe45a7..7020a1fa1 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -36,6 +36,14 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) requirements.VersionRequirement( name="poolscanner", component=poolscanner.PoolScanner, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 64eb38f42..d040fa990 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -34,6 +34,9 @@ class Threads(thrdscan.ThrdScan): requirements.VersionRequirement( name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/unloadedmodules.py b/volatility3/framework/plugins/windows/unloadedmodules.py index cadacf4ff..692f2c4a4 100644 --- a/volatility3/framework/plugins/windows/unloadedmodules.py +++ b/volatility3/framework/plugins/windows/unloadedmodules.py @@ -33,6 +33,14 @@ class UnloadedModules(interfaces.plugins.PluginInterface, timeliner.TimeLinerInt description="Windows kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="timeliner", + component=timeliner.TimeLinerInterface, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) + ), ] @classmethod From e52aea886ee49f73061432eed03b8d566f514e8f Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 00:41:26 +0000 Subject: [PATCH 0911/1352] Fix checks in thrdscan that broke tests --- volatility3/framework/plugins/windows/thrdscan.py | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 7020a1fa1..387125899 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -110,18 +110,19 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None + if owner_proc_pid == 4 or owner_proc.InheritedFromUniqueProcessId == 4: + vollog.debug( + f"Skipping kernel process with pid {owner_proc.InheritedFromUniqueProcessId}" + ) + return None + if vads_cache is not None: vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc ) - # no vads = terminated/smeared, pid 4 = kernel = don't check VADs - if ( - owner_proc_pid != 4 - and owner_proc.InheritedFromUniqueProcessId != 4 - and (not vads or len(vads) < 5) - ): + if not vads or len(vads) < 5: vollog.debug( - f"No vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" + f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" ) return None From 43ab95f4c5ea38f182bfe863bd5b425cbd9a70f4 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 00:50:34 +0000 Subject: [PATCH 0912/1352] Change thrdscan from looking for kernel processes --- test/plugins/windows/windows.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index ce05af0cd..f07c8b20c 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -189,9 +189,9 @@ class TestWindowsThrdscan: "windows.thrdscan.ThrdScan", image, volatility, python ) assert rc == 0 - assert out.find(b"\t4\t8") != -1 - assert out.find(b"\t4\t12") != -1 - assert out.find(b"\t4\t16") != -1 + assert out.find(b"\t1812\t2768\t0x7c810856") != -1 + assert out.find(b"\t840\t2964\t0x7c810856") != -1 + assert out.find(b"\t2536\t2552\t0x7c810856") != -1 class TestWindowsPrivileges: From 444305afc2cbf680a6097b7b9c17fd7be97d1ca3 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 00:55:48 +0000 Subject: [PATCH 0913/1352] Handle kernel processes properly this time --- volatility3/framework/plugins/windows/thrdscan.py | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 387125899..0ac3d0c33 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -110,13 +110,12 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None - if owner_proc_pid == 4 or owner_proc.InheritedFromUniqueProcessId == 4: - vollog.debug( - f"Skipping kernel process with pid {owner_proc.InheritedFromUniqueProcessId}" - ) - return None - - if vads_cache is not None: + # don't look for VADs in kernel threads, just let them get reported with empty paths + if ( + owner_proc_pid != 4 + and owner_proc.InheritedFromUniqueProcessId != 4 + and vads_cache is not None + ): vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc ) From e93df3764929b6be6be2934c7bd5a41184426eb7 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 01:16:53 +0000 Subject: [PATCH 0914/1352] Add module extraction API. Add plugin to directly extract modules. Hook module dumping into existing module listing plugins. --- .../framework/constants/linux/__init__.py | 25 + .../framework/plugins/linux/check_modules.py | 8 +- volatility3/framework/plugins/linux/lsmod.py | 8 +- .../framework/plugins/linux/module_extract.py | 85 ++ .../framework/symbols/linux/__init__.py | 3 + .../symbols/linux/extensions/__init__.py | 44 + .../symbols/linux/utilities/module_extract.py | 891 ++++++++++++++++++ .../symbols/linux/utilities/modules.py | 25 +- 8 files changed, 1086 insertions(+), 3 deletions(-) create mode 100644 volatility3/framework/plugins/linux/module_extract.py create mode 100644 volatility3/framework/symbols/linux/utilities/module_extract.py diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index ba0b92cc7..f45bed926 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -484,3 +484,28 @@ Documentation : - taint_flag kernel struct - taint_flags kernel constant """ + +## ELF related constants + +# Elf Symbol Bindings +STB_LOCAL = 0 +STB_GLOBAL = 1 + +# Elf Symbol Types +STT_NOTYPE = 0 +STT_OBJECT = 1 +STT_FUNC = 2 +STT_SECTION = 3 + +# Elf Section Types +SHT_NULL = 0 +SHT_PROGBITS = 1 +SHT_SYMTAB = 2 +SHT_STRTAB = 3 +SHT_RELA = 4 +SHT_NOTE = 7 + +# Elf Section Attributes +SHF_WRITE = 1 +SHF_ALLOC = 2 +SHF_EXECINSTR = 4 diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 5a43bf899..b902bc872 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class Check_modules(plugins.PluginInterface): """Compares module list to sysfs info, if available""" - _version = (3, 0, 0) + _version = (3, 0, 1) _required_framework_version = (2, 0, 0) @classmethod @@ -56,6 +56,12 @@ class Check_modules(plugins.PluginInterface): component=linux_utilities_modules.ModuleDisplayPlugin, version=(1, 0, 0), ), + requirements.BooleanRequirement( + name="dump", + description="Extract listed modules", + default=False, + optional=True, + ), ] @classmethod diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 3029d2541..d2fe5880d 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -18,7 +18,7 @@ class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) + _version = (3, 0, 1) run = linux_utilities_modules.ModuleDisplayPlugin.run _generator = linux_utilities_modules.ModuleDisplayPlugin.generator @@ -42,6 +42,12 @@ class Lsmod(plugins.PluginInterface): component=linux_utilities_modules.ModuleDisplayPlugin, version=(1, 0, 0), ), + requirements.BooleanRequirement( + name="dump", + description="Extract listed modules", + default=False, + optional=True, + ), ] @classmethod diff --git a/volatility3/framework/plugins/linux/module_extract.py b/volatility3/framework/plugins/linux/module_extract.py new file mode 100644 index 000000000..2d728f0fd --- /dev/null +++ b/volatility3/framework/plugins/linux/module_extract.py @@ -0,0 +1,85 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List + +import volatility3.framework.symbols.linux.utilities.module_extract as linux_utilities_module_extract +from volatility3.framework import interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.objects import utility + +vollog = logging.getLogger(__name__) + + +class ModuleExtract(interfaces.plugins.PluginInterface): + """Recreates an ELF file from a specific address in the kernel""" + + _required_framework_version = (2, 0, 0) + + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.IntRequirement( + name="base", + description="Base address to reconstruct an ELF file", + optional=False, + ), + ] + + def _generator(self): + kernel = self.context.modules[self.config["kernel"]] + + base_address = self.config["base"] + + kernel_layer = self.context.layers[kernel.layer_name] + + if not kernel_layer.is_valid(base_address): + vollog.error( + f"Given base address ({base_address:#x}) is not valid in the kernel address space. Unable to extract file." + ) + return + + module = kernel.object(object_type="module", offset=base_address, absolute=True) + + elf_data = linux_utilities_module_extract.ModuleExtract.extract_module( + self.context, self.config["kernel"], module + ) + if not elf_data: + vollog.error( + f"Unable to reconstruct the ELF for module struct at {base_address:#x}" + ) + return + + module_name = utility.array_to_string(module.name) + file_name = self.open.sanitize_filename( + f"kernel_module.{module_name}.{base_address:#x}.elf" + ) + + with self.open(file_name) as file_handle: + file_handle.write(elf_data) + + yield 0, ( + format_hints.Hex(base_address), + len(elf_data), + file_handle.preferred_filename, + ) + + def run(self): + return renderers.TreeGrid( + [ + ("Base", format_hints.Hex), + ("File Size", int), + ("File output", str), + ], + self._generator(), + ) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 758e142aa..9d3930087 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -52,6 +52,8 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class("idr", extensions.IDR) self.set_type_class("address_space", extensions.address_space) self.set_type_class("page", extensions.page) + self.set_type_class("module_sect_attr", extensions.module_sect_attr) + # Might not exist in the current symbols self.optional_set_type_class("module", extensions.module) self.optional_set_type_class("bpf_prog", extensions.bpf_prog) @@ -79,6 +81,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class("sock", extensions.network.sock) self.set_type_class("inet_sock", extensions.network.inet_sock) self.set_type_class("unix_sock", extensions.network.unix_sock) + # Might not exist in older kernels or the current symbols self.optional_set_type_class("netlink_sock", extensions.network.netlink_sock) self.optional_set_type_class("vsock_sock", extensions.network.vsock_sock) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index b9ce84ed1..b4bde1aba 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3121,3 +3121,47 @@ class kernel_symbol(objects.StructType): return self._do_get_namespace() except exceptions.InvalidAddressException: return None + + +class module_sect_attr(objects.StructType): + def get_name(self) -> Optional[str]: + """ + Performs careful extraction of the section name + The `name` member has changed type and meaning over time + It also was present even in cases with `mattr` present, which + holds the name the kernel uses + """ + if hasattr(self, "battr"): + try: + return utility.pointer_to_string(self.battr.attr.name, count=32) + except exceptions.InvalidAddressException: + # if battr is present then its name attribute needs to be valid + vollog.debug(f"Invalid battr name for section at {self.vol.offset:#x}") + return None + + elif self.name.vol.type_name == "array": + try: + return utility.array_to_string(self.name, count=32) + except exceptions.InvalidAddressException: + # specifically do not return here to give `mattr` a chance + vollog.debug(f"Invalid direct name for section at {self.vol.offset:#x}") + + elif self.name.vol.type_name == "pointer": + try: + return utility.pointer_to_string(self.name, count=32) + except exceptions.InvalidAddressException: + # specifically do not return here to give `mattr` a chance + vollog.debug( + f"Invalid pointer name for section at {self.vol.offset:#x}" + ) + + # if everything else failed... + if hasattr(self, "mattr"): + try: + return utility.pointer_to_string(self.mattr.attr.name, count=32) + except exceptions.InvalidAddressException: + vollog.debug( + f"Unresolvable name for for section at {self.vol.offset:#x}" + ) + + return None diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py new file mode 100644 index 000000000..41b4e29b0 --- /dev/null +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -0,0 +1,891 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +import logging +import struct + +from typing import ( + List, + Optional, + Tuple, + Dict, +) + +from volatility3 import framework +from volatility3.framework import ( + interfaces, + exceptions, + symbols, +) +from volatility3.framework.constants import linux as linux_constants +from volatility3.framework.symbols.linux import extensions + +vollog = logging.getLogger(__name__) + +# This module is responsbile for producing an ELF file of a kernel module (LKM) loaded in memory +# This extraction task is quite complicated as the Linux kernel discards the ELF header at load time +# Due to this, to support static analysis, we must create an ELF header and proper file based on the sections +# There are also several other significant complications that we must deal with when trying to extract an LKM +# that can be analyzed with static analysis tools +# First, the .strtab points somewhere random and is kept off the module structure, not with the other sections +# Second, all of the symbols (.symtab) have mangled members that we must patch for anything to make sense +# Third, the section name string stable (.shstrtab) is not an allocated section, meaning its not in memory +# Not having the .shstrtab makes analysis impossible-to-difficult for static analysis tools. To work around this, +# we create the .shstrtab based on the sections in memory and then glue it in as the final section + +# ModuleExtract.extract_module is the entry point and only visible method for plugins + + +class ModuleExtract(interfaces.configuration.VersionableInterface): + """Extracts Linux kernel module structures into an analyzable ELF file""" + + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + framework.require_interface_version(*_required_framework_version) + + @classmethod + def _get_module_section_count( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + module: extensions.module, + grp: interfaces.objects.ObjectInterface, + ) -> int: + """ + Used to manually determine the section count for kernels that do not track + this count directly within the attribute structures + """ + kernel = context.modules[vmlinux_name] + + count = 0 + + try: + array = kernel.object( + object_type="array", + offset=grp.attrs, + sub_type=kernel.get_type("pointer"), + count=50, + absolute=True, + ) + + # Walk up to 50 sections counting until we reach the end or a page fault + for sect in array: + if sect.vol.offset == 0: + break + + count += 1 + + except exceptions.InvalidAddressException: + # Use whatever count we reached before the error + vollog.debug( + f"Exception hit counting sections for module at {module.vol.offset:#x}" + ) + + return count + + @classmethod + def _find_section( + cls, section_lookups: List[Tuple[str, int, int, int]], sym_address: int + ) -> Optional[Tuple[str, int, int, int]]: + """ + Finds the section containing `sym_address` + """ + for name, index, address, size in section_lookups: + if address <= sym_address < address + size: + return name, index, address, size + + return None + + @classmethod + def _get_st_info_for_sym( + cls, sym: interfaces.objects.ObjectInterface, sym_address: int, sect_name: str + ) -> bytes: + """ + This is a helper function called from `_fix_sym_table` + + Calculates the `st_info` value for the given symbol + + Spec: https://refspecs.linuxbase.org/elf/gabi4+/ch4.symtab.html + """ + if sym.st_name > 0: + # Global symbol + bind = linux_constants.STB_GLOBAL + + if sym_address == 0: + sect_type = linux_constants.STT_NOTYPE + elif sect_name: + # rela = relocations + if sect_name.find(".text") != -1 and sect_name.find(".rela") == -1: + sect_type = linux_constants.STT_FUNC + else: + sect_type = linux_constants.STT_OBJECT + + else: + # outside the module being extracted + sect_type = linux_constants.STT_NOTYPE + + else: + # Local symbol + bind = linux_constants.STB_LOCAL + sect_type = linux_constants.STT_SECTION + + # Build the st_info as ELF32_ST_INFO/ELF64_ST_INFO + bind_bits = (bind << 4) & 0xF0 + type_bits = sect_type & 0xF + + st_info_int = (bind_bits | type_bits) & 0xFF + + return struct.pack("B", st_info_int) + + @classmethod + def _get_fixed_sym_fields( + cls, + st_fmt: str, + sym: interfaces.objects.ObjectInterface, + sections: List[Tuple[str, int, int, int]], + ) -> Tuple[str, int, int, int]: + """ + This is a helper function called from `_fix_sym_table` + + The st_value, st_info, and st_shndx fields of each symbol are changed/mangled while loading + Static analysis tools do not understand these transformed values as they only make sense to the kernel loader + We must de-mangle these to have analysis tools understand symbols (a key aspect) + """ + # Start by trying to map a symbol to its section + sym_address = sym.st_value + sect_info = cls._find_section(sections, sym_address) + + if not sect_info: + # Symbol does not point into the module being extracted + sect_name, sect_index, sect_address = None, None, None + st_value_int = sym_address + else: + # relative address inside the section + sect_name, sect_index, sect_address, _ = sect_info + st_value_int = sym_address - sect_address + + # Get the fixed st_value, st_info, and st_shndx that are broken in the mapped file + + # formatted to be written into the extracted file + st_value = struct.pack(st_fmt, st_value_int) + + # returns formatted to be written into the extracted file + st_info = cls._get_st_info_for_sym(sym, sym_address, sect_name) + + # format to reference its section, if any + if sect_name: + st_shndx = struct.pack(" Optional[bytes]: + """ + This function implements the most painful part of the reconstruction + + The symbols in .symtab are broken/mangled during loading. + We need to normalize these for static analysis tools to understand the references. + Without proper symbols, analysis is pretty pointless and gets nowhere. + + Spec: https://refspecs.linuxbase.org/elf/gabi4+/ch4.symtab.html + """ + kernel = context.modules[vmlinux_name] + + # Gather the section information into a list + section_lookups: List[Tuple[str, int, int, int]] = [] + for index, (address, name) in enumerate(original_sections.items()): + # We are fixing symtab references... + if name == ".symtab": + continue + + size = section_sizes[address] + + # Add 1 to account for leading NULL section + section_lookups.append((name, index + 1, address, size)) + + # Build the array of symbols as they are in memory + sym_type = kernel.get_type(sym_type_name) + + symbols = kernel.object( + object_type="array", + subtype=sym_type, + offset=module.section_symtab, + count=module.num_symtab, + absolute=True, + ) + + # used to hold the new (fixed) symbol table + sym_table_data = b"" + + # build a correct/normalized Elf32_Sym or Elf64_Sym for each symbol + for sym in symbols: + # get the mangled fields' correct values + sect_name, st_value, st_info, st_shndx = cls._get_fixed_sym_fields( + st_fmt, sym, section_lookups + ) + + # these aren't mangled during loading + st_name = struct.pack(" Optional[Dict[int, str]]: + """ + Enumerates the module's sections as maintained by the kernel after load time + 'Early' sections like .init.text and .init.data are discarded after module + initialization, so they are not expected to be in memory during extraction + """ + if hasattr(module.sect_attrs, "nsections"): + num_sections = module.sect_attrs.nsections + else: + num_sections = cls._get_module_section_count( + context, vmlinux_name, module.sect_attrs.grp + ) + + if num_sections > 1024 or num_sections == 0: + vollog.debug( + f"Invalid number of sections ({num_sections}) for module at offset {module.vol.offset:#x}" + ) + return None + + vmlinux = context.modules[vmlinux_name] + + # This is declared as a zero sized array, so we create ourselves + attribute_type = module.sect_attrs.attrs.vol.subtype + + sect_array = vmlinux.object( + object_type="array", + subtype=attribute_type, + offset=module.sect_attrs.attrs.vol.offset, + count=num_sections, + absolute=True, + ) + + sections: Dict[int, str] = {} + + # for each section, gather its name and address + for index, section in enumerate(sect_array): + name = section.get_name() + + sections[section.address] = name + + return sections + + @classmethod + def _parse_sections( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + module: extensions.module, + ) -> Optional[Tuple[List, int, int]]: + """ + This function first parses the sections as maintained by the kernel + It then orders the sections by load address, and then gathers the data of each section + We also track the file_offset to correctly have alignment in the output file + + .symtab requires special handling as its so broken in memory as described in `_fix_sym_table` + The data of .strtab is read directly off the module structure and not its section + as the section from the original module has no meaning after loading as the kernel does not reference it. + """ + original_sections = cls._enumerate_original_sections( + context, vmlinux_name, module + ) + if original_sections is None: + return None + + kernel = context.modules[vmlinux_name] + kernel_layer = context.layers[kernel.layer_name] + + if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name): + sym_type = "Elf64_Sym" + elf_hdr_type = "Elf64_Ehdr" + st_fmt = " Optional[bytes]: + """ + Creates a 32 bit ELF header for the file based on recovered values + Called last as it needs information computed from the sections + + Spec: https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.html + """ + e_ident = b"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" + e_type = b"\x01\x00" # relocateble + e_machine = b"\x03\x00" # EM_X86_86 + e_version = b"\x01\x00\x00\x00" + e_entry = b"\x00" * 4 # The .init sections are freed after module load + e_phoff = b"\x00" * 4 + e_shoff = struct.pack(" Optional[bytes]: + """ + Creates a 64 bit ELF header for the file based on recovered values + Called last as it needs information computed from the sections + + Spec: https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.html + """ + e_ident = b"\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" + e_type = b"\x01\x00" # relocateble + e_machine = b"\x3e\x00" # EM_X86_64 + e_version = b"\x01\x00\x00\x00" + e_entry = b"\x00" * 8 # The .init sections are freed after module load + e_phoff = b"\x00" * 8 + e_shoff = struct.pack(" Optional[int]: + """ + This function makes a best effort to map common section names + to their attributes + """ + known_sections = { + ".note.gnu.build-id": linux_constants.SHT_NOTE, + ".text": linux_constants.SHT_PROGBITS, + ".init.text": linux_constants.SHT_PROGBITS, + ".exit.text": linux_constants.SHT_PROGBITS, + ".static_call.text": linux_constants.SHT_PROGBITS, + ".rodata": linux_constants.SHT_PROGBITS, + ".modinfo": linux_constants.SHT_PROGBITS, + "__param": linux_constants.SHT_PROGBITS, + ".data": linux_constants.SHT_PROGBITS, + ".gnu.linkonce.this_module": linux_constants.SHT_PROGBITS, + ".comment": linux_constants.SHT_PROGBITS, + ".shstrtab": linux_constants.SHT_STRTAB, + ".symtab": linux_constants.SHT_SYMTAB, + ".strtab": linux_constants.SHT_STRTAB, + } + + sect_type_val = linux_constants.SHT_PROGBITS + + if section_name.find(".rela.") != -1: + sect_type_val = linux_constants.SHT_RELA + + elif section_name in known_sections: + sect_type_val = known_sections[section_name] + + return sect_type_val + + # all sections from memory are allocated (SHF_ALLOC) + # special check certain other sections to try and ensure extra flags are added where needed + @classmethod + def _calc_sect_flags(cls, name: str) -> int: + """ + Make a best effort to map common section names to their permissions + If we miss a section here, users of common static analysis tools can mark the + sections are writable or executable manually, but that becomes very cumbersome + and breaks initial analysis by the tool + """ + # All sections in memory are allocated (`A` in readelf -S) + flags = linux_constants.SHF_ALLOC + + if name in [".text", ".init.text", ".exit.text", ".static_call.text"]: + flags = flags | linux_constants.SHF_EXECINSTR + + elif name in [ + ".data", + ".init.data", + ".exit.data", + ".bss", + "__tracepoints", + ".data.once", + "_ftrace_events", + ".gnu.linkonce.this_module", + ]: + flags = flags | linux_constants.SHF_WRITE + + return flags + + @classmethod + def _calc_link( + cls, name: str, strtab_index: int, symtab_index: int, sect_type: int + ) -> int: + """ + Calculates the link value for a section + + The most important ones are symtab indexes for relocations + and to point the symbol table to the string tab + + Spec: https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html + """ + # looking for RELA sections + if name.find(".rela.") != -1: + return symtab_index + + # per spec: "The section header index of the associated string table." + elif sect_type == linux_constants.SHT_SYMTAB: + return strtab_index + + return 0 + + @classmethod + def _calc_entsize(cls, name: str, sect_type: int, bits: int) -> int: + """ + Calculates the entsize for relocation sections and the symbol table section + + Spec: https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html + """ + # looking for RELA sections + if name.find(".rela.") != -1: + return 24 + + # per spec: "The section header index of the associated string table." + elif sect_type == linux_constants.SHT_SYMTAB: + if bits == 32: + return 16 + else: + return 24 + + return 0 + + @classmethod + def _make_section_header_32( + cls, + name_index: int, + name: str, + address: int, + size: int, + file_offset: int, + strtab_index: int, + symtab_index: int, + ) -> Optional[bytes]: + """ + Creates a section header (Elf32_Shdr) for the given section + """ + sect_header_type_int = cls._calc_sect_type(name) + + flags = cls._calc_sect_flags(name) + + link = cls._calc_link(name, strtab_index, symtab_index, sect_header_type_int) + + entsize = cls._calc_entsize(name, sect_header_type_int, 32) + + try: + sh_name = struct.pack(" Optional[bytes]: + """ + Creates a section header (Elf64_Shdr) for the given section + """ + sect_header_type_int = cls._calc_sect_type(name) + + flags = cls._calc_sect_flags(name) + + link = cls._calc_link(name, strtab_index, symtab_index, sect_header_type_int) + + entsize = cls._calc_entsize(name, sect_header_type_int, 64) + + try: + sh_name = struct.pack(" Optional[bytes]: + # Bail early if bad address sent in + try: + hasattr(module.sect_attrs, "nsections") + except exceptions.InvalidAddressException: + vollog.debug(f"module at offset {module.vol.offset:#x} is paged out.") + return + + # Gather sections + updated_sections, strtab_index, symtab_index = cls._parse_sections( + context, vmlinux_name, module + ) + + kernel = context.modules[vmlinux_name] + + # Figure out header sizes + if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name): + make_elf_header = cls._make_elf_header_64 + make_section_header = cls._make_section_header_64 + header_type = "Elf64_Ehdr" + section_type = "Elf64_Shdr" + else: + make_elf_header = cls._make_elf_header_32 + make_section_header = cls._make_section_header_32 + header_type = "Elf32_Ehdr" + section_type = "Elf32_Shdr" + + header_type_size = kernel.get_type(header_type).size + section_type_size = kernel.get_type(section_type).size + + # Per Linux-spec, all LKMs must start with a null section header + # This buffer is used to hold the headers as they are built + sections_headers = b"\x00" * section_type_size + + # Holder of the data of the sections + sections_data = b"" + + # the .shstrtab section is "\x00" + section name for each section + # followed by a terminating null. + # It starts with the null string (\x00) + shstrtab_data = b"\x00" + + # Track where we end the sections and data to glue `.shstrtab` after + last_file_offset = None + last_sect_size = None + + # Start at 1 in the string table + name_index = 1 + + # Create the actual section headers + for index, (name, address, file_offset, section_data) in enumerate( + updated_sections + ): + # Make the section header + header_bytes = make_section_header( + name_index, + name, + address, + len(section_data), + file_offset, + strtab_index, + symtab_index, + ) + if not header_bytes: + vollog.debug(f"make_section_header failed for section {name}") + return None + + # ndex into the string table + name_index += len(name) + 1 + + # concatanate the header and section bytes + sections_headers += header_bytes + sections_data += section_data + + # track where we are so .shstrtab goes into correct offset + last_file_offset = file_offset + last_sect_size = len(section_data) + + # append each section name to what will become .shstrtab + shstrtab_data += bytes(name, encoding="utf8") + b"\x00" + + # stick our own section reference string at end + # name_index points to the end of the last section string after the loop ends + shstrtab_data += b".shstrtab\x00" + + # create our .shstrtab section so sections have names + sections_headers += make_section_header( + name_index, + ".shstrtab", + 0, + len(shstrtab_data), + last_file_offset + last_sect_size, + strtab_index, + symtab_index, + ) + + sections_data += shstrtab_data + + num_sections = len(updated_sections) + 1 + + header = make_elf_header( + header_type_size + len(sections_data), + num_sections, + ) + + if not header: + vollog.error( + f"Hit error creating Elf header for module at {module.vol.offset:#x}" + ) + return None + + # Return our beautiful, hand-crafted, farm raised ELF file + return header + sections_data + sections_headers diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index f987c352e..b934220a8 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -30,6 +30,8 @@ from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions from volatility3.framework.symbols.linux.utilities import tainting +import volatility3.framework.symbols.linux.utilities.module_extract as linux_utilities_module_extract + vollog = logging.getLogger(__name__) @@ -921,7 +923,7 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): The constructor of the plugin must call super() with the `implementation` set """ - _version = (1, 0, 0) + _version = (1, 0, 1) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) @@ -974,12 +976,32 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): parameters = ", ".join([f"{key}={value}" for key, value in parameters_iter]) + file_name = renderers.NotApplicableValue() + + if self.config["dump"]: + elf_data = linux_utilities_module_extract.ModuleExtract.extract_module( + self.context, self.config["kernel"], module + ) + if not elf_data: + vollog.warning( + f"Unable to reconstruct the ELF for module struct at {module.vol.offset:#x}" + ) + file_name = renderers.NotAvailableValue() + else: + file_name = self.open.sanitize_filename( + f"kernel_module.{name}.{module.vol.offset:#x}.elf" + ) + + with self.open(file_name) as file_handle: + file_handle.write(elf_data) + yield 0, ( format_hints.Hex(module.vol.offset), name, format_hints.Hex(code_size), taints, parameters, + file_name, ) def run(self): @@ -990,6 +1012,7 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): ("Code Size", format_hints.Hex), ("Taints", str), ("Load Arguments", str), + ("File Output", str), ], self._generator(), ) From 25eaaff06cbd0f517c71e3074144eec3cf4fbea2 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Wed, 26 Mar 2025 01:30:26 +0000 Subject: [PATCH 0915/1352] Bring hidden module to expose dump option. Fix CodeQL found bug --- volatility3/framework/plugins/linux/hidden_modules.py | 8 +++++++- .../framework/symbols/linux/utilities/module_extract.py | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index c6f5d749e..5d44ccb00 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -19,7 +19,7 @@ class Hidden_modules(plugins.PluginInterface): """Carves memory to find hidden kernel modules""" _required_framework_version = (2, 10, 0) - _version = (3, 0, 0) + _version = (3, 0, 1) @classmethod def get_hidden_modules( @@ -72,6 +72,12 @@ class Hidden_modules(plugins.PluginInterface): component=linux_utilities_modules.ModuleDisplayPlugin, version=(1, 0, 0), ), + requirements.BooleanRequirement( + name="dump", + description="Extract listed modules", + default=False, + optional=True, + ), ] @staticmethod diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 41b4e29b0..fbe9053ec 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -782,7 +782,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): hasattr(module.sect_attrs, "nsections") except exceptions.InvalidAddressException: vollog.debug(f"module at offset {module.vol.offset:#x} is paged out.") - return + return None # Gather sections updated_sections, strtab_index, symtab_index = cls._parse_sections( From 67533b034a6c31368c1bfc176497368255a6ccfb Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Mar 2025 08:21:28 -0500 Subject: [PATCH 0916/1352] #1471 - deprecation class for moving --- volatility3/framework/deprecation.py | 47 +++++++++++++++++++ .../framework/plugins/windows/amcache.py | 16 +++---- 2 files changed, 53 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index e2e91a0eb..5d8087503 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -88,3 +88,50 @@ def deprecated_method( return wrapper return decorator + +def renamed_class(deprecated_class_name: str, message: str, removal_date: str): + """A decorator for marking classes as being renamed and removed in the future. + Callers to this function should explicitly update to use the other plugins instead. + + Args: + deprecated_class_name: The name of the class being deprecated + message: A message added to the standard deprecation warning. Should include the replacement API paths + removal_date: A YYYY-MM-DD formatted date of when the function will be removed from the framework + """ + + def decorator(replacement_func): + @functools.wraps(replacement_func) + def wrapper(*args, **kwargs): + warnings.warn( + f"This plugin ({deprecated_class_name}) has been renamed and will be removed in the first release after {removal_date}. {message}", + FutureWarning, + ) + return replacement_func(*args, **kwargs) + + return wrapper + + return decorator + + +class PluginRenameClass: + """Class to move all classmethod invocations (for when a plugin has been moved)""" + + def __init_subclass__(cls, replacement_class, removal_date, **kwargs): + deprecated_class_name = f"{cls.__module__}.{cls.__qualname__}" + super().__init_subclass__(**kwargs) + for attr, value in replacement_class.__dict__.items(): + if isinstance(value, classmethod): + setattr( + cls, + attr, + classmethod( + renamed_class( + deprecated_class_name=deprecated_class_name, + removal_date=removal_date, + message=f"Please ensure all method calls to this plugin are replaced with calls to {replacement_class.__module__}.{replacement_class.__qualname__}", + )(value.__func__) + ), + ) + else: + setattr(cls, attr, value) + return super(replacement_class).__init_subclass__(**kwargs) \ No newline at end of file diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index 6e45d5b36..bf0f8f8ad 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -3,22 +3,18 @@ # import logging import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import amcache vollog = logging.getLogger(__name__) -class Amcache(amcache.Amcache): +class Amcache( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=amcache.Amcache, + removal_date="2025-09-25"): """Extract information on executed applications from the AmCache (deprecated).""" _required_framework_version = (2, 0, 0) _version = (2, 0, 0) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.amcache.Amcache plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.amcache.Amcache instead." - ) - ) - return super().__getattribute__(*args, **kwargs) From f431f519b682d886edcda9b0371f483ee9735c97 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Mar 2025 08:22:37 -0500 Subject: [PATCH 0917/1352] #1471 - black and ruff fixes --- volatility3/framework/deprecation.py | 3 ++- volatility3/framework/plugins/windows/amcache.py | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index 5d8087503..ba07743a3 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -89,6 +89,7 @@ def deprecated_method( return decorator + def renamed_class(deprecated_class_name: str, message: str, removal_date: str): """A decorator for marking classes as being renamed and removed in the future. Callers to this function should explicitly update to use the other plugins instead. @@ -134,4 +135,4 @@ class PluginRenameClass: ) else: setattr(cls, attr, value) - return super(replacement_class).__init_subclass__(**kwargs) \ No newline at end of file + return super(replacement_class).__init_subclass__(**kwargs) diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index bf0f8f8ad..be144be91 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -2,7 +2,6 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import amcache @@ -13,7 +12,8 @@ class Amcache( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=amcache.Amcache, - removal_date="2025-09-25"): + removal_date="2025-09-25", +): """Extract information on executed applications from the AmCache (deprecated).""" _required_framework_version = (2, 0, 0) From b80a34110edb57353c51a413bcd032b58e1fdd47 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 26 Mar 2025 14:41:05 +0100 Subject: [PATCH 0918/1352] adjust thrdscan --- test/plugins/windows/windows.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 3ad9dc70d..f494c5945 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -250,9 +250,10 @@ class TestWindowsThrdscan: "windows.thrdscan.ThrdScan", image, volatility, python ) assert rc == 0 - assert out.find(b"\t4\t8") != -1 - assert out.find(b"\t4\t12") != -1 - assert out.find(b"\t4\t16") != -1 + assert out.count(b"\n") > 700 + assert out.find(b"\t1812\t2768\t0x7c810856") != -1 + assert out.find(b"\t840\t2964\t0x7c810856") != -1 + assert out.find(b"\t2536\t2552\t0x7c810856") != -1 class TestWindowsPrivileges: From 1c21b3cd04ae5b0bc5cc41d7d5d2c1dec29a1db4 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 26 Mar 2025 09:07:32 -0500 Subject: [PATCH 0919/1352] Consoles: Fix requirement versions When I updated the requirements for `Consoles` in #1738, I bumped the version number on the `VerInfo` requirement instead of on the `Info` requirement. closes #1741 --- volatility3/framework/plugins/windows/consoles.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 8999e1bab..6cfc6d588 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -46,10 +46,10 @@ class Consoles(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="verinfo", component=verinfo.VerInfo, version=(2, 0, 0) + name="verinfo", component=verinfo.VerInfo, version=(1, 0, 0) ), requirements.VersionRequirement( - name="info", component=info.Info, version=(1, 0, 0) + name="info", component=info.Info, version=(2, 0, 0) ), requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) From dca182dc7234ba5b8cbef25b1d61e957b8899162 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 26 Mar 2025 15:59:35 +0100 Subject: [PATCH 0920/1352] trigger tests --- test/plugins/windows/windows.py | 1 + 1 file changed, 1 insertion(+) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index f494c5945..c9cf93391 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -1411,3 +1411,4 @@ class TestWindowsVirtMap: ) for expected_row in expected_rows: assert test_volatility.match_output_row(expected_row, json_out) + From ef29008cc8773ea2d02e63b89a856055cd53ad6e Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Wed, 26 Mar 2025 17:53:19 -0500 Subject: [PATCH 0921/1352] #1471 - fix class deprecation and update other plugins --- volatility3/framework/deprecation.py | 5 +++-- .../framework/plugins/windows/cachedump.py | 18 +++++++----------- .../framework/plugins/windows/hashdump.py | 18 +++++++----------- .../framework/plugins/windows/lsadump.py | 18 +++++++----------- .../plugins/windows/scheduled_tasks.py | 18 +++++++----------- 5 files changed, 31 insertions(+), 46 deletions(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index ba07743a3..b9b84f001 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -121,7 +121,7 @@ class PluginRenameClass: deprecated_class_name = f"{cls.__module__}.{cls.__qualname__}" super().__init_subclass__(**kwargs) for attr, value in replacement_class.__dict__.items(): - if isinstance(value, classmethod): + if isinstance(value, classmethod) and attr != "get_requirements": setattr( cls, attr, @@ -134,5 +134,6 @@ class PluginRenameClass: ), ) else: - setattr(cls, attr, value) + if not attr.startswith("__"): + setattr(cls, attr, value) return super(replacement_class).__init_subclass__(**kwargs) diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 14320312a..35127c6f3 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import cachedump vollog = logging.getLogger(__name__) -class Cachedump(cachedump.Cachedump): +class Cachedump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=cachedump.Cachedump, + removal_date="2025-09-25", +): """Dumps lsa secrets from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 0, 2) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.cachedump.Cachedump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.cachedump.Cachedump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index 98baf7d53..e496e77a9 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import hashdump vollog = logging.getLogger(__name__) -class Hashdump(hashdump.Hashdump): +class Hashdump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=hashdump.Hashdump, + removal_date="2025-09-25", +): """Dumps user hashes from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 1, 1) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.hashdump.Hashdump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.hashdump.Hashdump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 86cbe1949..0b36ddef0 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -2,23 +2,19 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import lsadump vollog = logging.getLogger(__name__) -class Lsadump(lsadump.Lsadump): +class Lsadump( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=lsadump.Lsadump, + removal_date="2025-09-25", +): """Dumps lsa secrets from memory (deprecated)""" _required_framework_version = (2, 0, 0) _version = (1, 0, 1) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.lsadump.Lsadump plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.lsadump.Lsadump instead." - ) - ) - return super().__getattribute__(*args, **kwargs) diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 7241f07d1..62d8e3b88 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -2,24 +2,20 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -import warnings +from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.registry import scheduled_tasks vollog = logging.getLogger(__name__) -class ScheduledTasks(scheduled_tasks.ScheduledTasks): +class ScheduledTasks( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=scheduled_tasks.ScheduledTasks, + removal_date="2025-09-25", +): """Decodes scheduled task information from the Windows registry, including information about triggers, actions, run times, and creation times (deprecated).""" _required_framework_version = (2, 11, 0) _version = (2, 0, 0) - - def __getattribute__(self, *args, **kwargs): - warnings.warn( - FutureWarning( - "The windows.registry.scheduled_tasks.ScheduledTasks plugin is deprecated and will be removed on " - "2025-09-25. Use windows.registry.scheduled_tasks.ScheduledTasks instead." - ) - ) - return super().__getattribute__(*args, **kwargs) From 70e101ff90f4537260a35e389f3424cf0c69c5cf Mon Sep 17 00:00:00 2001 From: ikelos Date: Thu, 27 Mar 2025 14:13:25 +0000 Subject: [PATCH 0922/1352] Potential fix for code scanning alert no. 407: First argument to super() is not enclosing class Think this is more correct Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- volatility3/framework/deprecation.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index b9b84f001..859a32bad 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -136,4 +136,4 @@ class PluginRenameClass: else: if not attr.startswith("__"): setattr(cls, attr, value) - return super(replacement_class).__init_subclass__(**kwargs) + return super(PluginRenameClass).__init_subclass__(**kwargs) From 7f55ec6dd5dc1db4a4090786077e518e6058171b Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 27 Mar 2025 16:46:51 -0500 Subject: [PATCH 0923/1352] Address feedback --- .../framework/plugins/linux/check_modules.py | 13 +- .../framework/plugins/linux/hidden_modules.py | 14 +- volatility3/framework/plugins/linux/lsmod.py | 18 +- .../framework/plugins/linux/module_extract.py | 2 +- .../symbols/linux/utilities/module_extract.py | 208 +++++------------- .../symbols/linux/utilities/modules.py | 6 + 6 files changed, 71 insertions(+), 190 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index b902bc872..ec6f0b73d 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -46,23 +46,12 @@ class Check_modules(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), requirements.VersionRequirement( name="linux_utilities_modules_module_display_plugin", component=linux_utilities_modules.ModuleDisplayPlugin, version=(1, 0, 0), ), - requirements.BooleanRequirement( - name="dump", - description="Extract listed modules", - default=False, - optional=True, - ), - ] + ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() @classmethod @deprecation.deprecated_method( diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 5d44ccb00..38bddc9d8 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -7,7 +7,6 @@ from volatility3.framework.symbols.linux.utilities import ( modules as linux_utilities_modules, ) from volatility3.framework import interfaces, exceptions, deprecation -from volatility3.framework.constants import architectures from volatility3.framework.configuration import requirements from volatility3.framework.symbols.linux import extensions from volatility3.framework.interfaces import plugins @@ -62,23 +61,12 @@ class Hidden_modules(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=architectures.LINUX_ARCHS, - ), requirements.VersionRequirement( name="linux_utilities_modules_module_display_plugin", component=linux_utilities_modules.ModuleDisplayPlugin, version=(1, 0, 0), ), - requirements.BooleanRequirement( - name="dump", - description="Extract listed modules", - default=False, - optional=True, - ), - ] + ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() @staticmethod @deprecation.deprecated_method( diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index d2fe5880d..8ed52e3b7 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -27,28 +27,12 @@ class Lsmod(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 0), - ), requirements.VersionRequirement( name="linux_utilities_modules_module_display_plugin", component=linux_utilities_modules.ModuleDisplayPlugin, version=(1, 0, 0), ), - requirements.BooleanRequirement( - name="dump", - description="Extract listed modules", - default=False, - optional=True, - ), - ] + ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() @classmethod @deprecation.deprecated_method( diff --git a/volatility3/framework/plugins/linux/module_extract.py b/volatility3/framework/plugins/linux/module_extract.py index 2d728f0fd..c9662da08 100644 --- a/volatility3/framework/plugins/linux/module_extract.py +++ b/volatility3/framework/plugins/linux/module_extract.py @@ -31,7 +31,7 @@ class ModuleExtract(interfaces.plugins.PluginInterface): ), requirements.IntRequirement( name="base", - description="Base address to reconstruct an ELF file", + description="Base virtual address to reconstruct an ELF file", optional=False, ), ] diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index fbe9053ec..c543228a8 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -28,7 +28,7 @@ vollog = logging.getLogger(__name__) # that can be analyzed with static analysis tools # First, the .strtab points somewhere random and is kept off the module structure, not with the other sections # Second, all of the symbols (.symtab) have mangled members that we must patch for anything to make sense -# Third, the section name string stable (.shstrtab) is not an allocated section, meaning its not in memory +# Third, the section name string table (.shstrtab) is not an allocated section, meaning its not in memory # Not having the .shstrtab makes analysis impossible-to-difficult for static analysis tools. To work around this, # we create the .shstrtab based on the sections in memory and then glue it in as the final section @@ -185,7 +185,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): cls, context: interfaces.context.ContextInterface, vmlinux_name: str, - original_sections, + original_sections: Dict[int, str], section_sizes: Dict[int, int], sym_type_name: str, st_fmt: str, @@ -347,7 +347,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): # All others can be read with padding # get the addresses in sorted order, can index into `original_sections` for names - sorted_addresses = sorted(original_sections) + sorted_addresses = sorted(original_sections.keys()) # We need to track where .symtab is for symbol name offsets symtab_address = None @@ -438,78 +438,46 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): return updated_sections, strtab_index, symtab_index @classmethod - def _make_elf_header_32( - cls, sect_hdr_offset: int, num_sections: int + def _make_elf_header( + cls, bits: int, sect_hdr_offset: int, num_sections: int ) -> Optional[bytes]: """ - Creates a 32 bit ELF header for the file based on recovered values + Creates a `bits` bit ELF header for the file based on recovered values Called last as it needs information computed from the sections Spec: https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.html """ - e_ident = b"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" - e_type = b"\x01\x00" # relocateble - e_machine = b"\x03\x00" # EM_X86_86 - e_version = b"\x01\x00\x00\x00" - e_entry = b"\x00" * 4 # The .init sections are freed after module load - e_phoff = b"\x00" * 4 - e_shoff = struct.pack(" Optional[bytes]: - """ - Creates a 64 bit ELF header for the file based on recovered values - Called last as it needs information computed from the sections - - Spec: https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.html - """ - e_ident = b"\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" - e_type = b"\x01\x00" # relocateble - e_machine = b"\x3e\x00" # EM_X86_64 - e_version = b"\x01\x00\x00\x00" - e_entry = b"\x00" * 8 # The .init sections are freed after module load - e_phoff = b"\x00" * 8 - e_shoff = struct.pack(" Optional[bytes]: """ - Creates a section header (Elf32_Shdr) for the given section + Creates a section header (Elf32_Shdr or Elf64_Shdr) for the given section """ + if bits == 32: + fmt = " Optional[bytes]: - """ - Creates a section header (Elf64_Shdr) for the given section - """ - sect_header_type_int = cls._calc_sect_type(name) - - flags = cls._calc_sect_flags(name) - - link = cls._calc_link(name, strtab_index, symtab_index, sect_header_type_int) - - entsize = cls._calc_entsize(name, sect_header_type_int, 64) - - try: - sh_name = struct.pack(" Date: Thu, 27 Mar 2025 17:02:23 -0500 Subject: [PATCH 0924/1352] Address feedback update --- .../framework/symbols/linux/utilities/module_extract.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index c543228a8..c70e727da 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -461,9 +461,10 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): e_ident = ( b"\x7f\x45\x4c\x46\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00" ) - e_machine = 0x3E # EM_X86_64 - e_ehsize = 64 - e_shentsize = 52 + e_machine_int = 0x3E # EM_X86_64 + e_ehsize_int = 64 + e_shentsize_int = 52 + header_size = 64 e_type = struct.pack(" Date: Thu, 27 Mar 2025 17:06:14 -0500 Subject: [PATCH 0925/1352] Bug fix --- volatility3/framework/symbols/linux/utilities/module_extract.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index c70e727da..1176f4b04 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -463,7 +463,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): ) e_machine_int = 0x3E # EM_X86_64 e_ehsize_int = 64 - e_shentsize_int = 52 + e_shentsize_int = 64 header_size = 64 e_type = struct.pack(" Date: Thu, 27 Mar 2025 17:17:08 -0500 Subject: [PATCH 0926/1352] ordering fix --- .../framework/symbols/linux/utilities/module_extract.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 1176f4b04..0b57dcdbc 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -240,8 +240,11 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): st_other = struct.pack("B", sym.st_other) st_size = struct.pack(st_fmt, sym.st_size) - # The order as in the ELF specification - sym_data = st_name + st_info + st_other + st_shndx + st_value + st_size + # The order as in the ELF specification. The order is not the same between 32 and 64 bit symbols + if st_fmt == " Date: Thu, 27 Mar 2025 18:39:29 -0500 Subject: [PATCH 0927/1352] Add required interface version to plugin --- volatility3/framework/plugins/linux/module_extract.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/module_extract.py b/volatility3/framework/plugins/linux/module_extract.py index c9662da08..1252e3708 100644 --- a/volatility3/framework/plugins/linux/module_extract.py +++ b/volatility3/framework/plugins/linux/module_extract.py @@ -4,6 +4,7 @@ import logging from typing import List +from volatility3 import framework import volatility3.framework.symbols.linux.utilities.module_extract as linux_utilities_module_extract from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements @@ -16,9 +17,10 @@ vollog = logging.getLogger(__name__) class ModuleExtract(interfaces.plugins.PluginInterface): """Recreates an ELF file from a specific address in the kernel""" + _version = (1, 0, 0) _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + framework.require_interface_version(*_required_framework_version) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 61575ca2b129f5068d6eee56b17cb31eba548840 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 27 Mar 2025 19:30:58 -0500 Subject: [PATCH 0928/1352] Require parity framework version --- volatility3/framework/plugins/linux/module_extract.py | 2 +- volatility3/framework/symbols/linux/utilities/module_extract.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/module_extract.py b/volatility3/framework/plugins/linux/module_extract.py index 1252e3708..d7c875523 100644 --- a/volatility3/framework/plugins/linux/module_extract.py +++ b/volatility3/framework/plugins/linux/module_extract.py @@ -18,7 +18,7 @@ class ModuleExtract(interfaces.plugins.PluginInterface): """Recreates an ELF file from a specific address in the kernel""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 0b57dcdbc..49ad4d9c0 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -39,7 +39,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) From a3069a3192b7c704954ee2be29cc8383e5bf36ba Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Thu, 27 Mar 2025 20:06:09 -0500 Subject: [PATCH 0929/1352] Fix hidden_modules to actually list hidden modules... --- .../framework/plugins/linux/hidden_modules.py | 60 +++++++++---------- 1 file changed, 30 insertions(+), 30 deletions(-) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 38bddc9d8..136aafdd9 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -17,8 +17,35 @@ vollog = logging.getLogger(__name__) class Hidden_modules(plugins.PluginInterface): """Carves memory to find hidden kernel modules""" - _required_framework_version = (2, 10, 0) - _version = (3, 0, 1) + _required_framework_version = (2, 25, 0) + _version = (3, 0, 2) + + @classmethod + def find_hidden_modules( + cls, context, vmlinux_module_name: str + ) -> extensions.module: + if context.symbol_space.verify_table_versions( + "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0) + ): + raise exceptions.SymbolSpaceError( + "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later" + ) + + known_module_addresses = cls.get_lsmod_module_addresses( + context, vmlinux_module_name + ) + modules_memory_boundaries = ( + linux_utilities_modules.Modules.get_modules_memory_boundaries( + context, vmlinux_module_name + ) + ) + + yield from linux_utilities_modules.Modules.get_hidden_modules( + context, + vmlinux_module_name, + known_module_addresses, + modules_memory_boundaries, + ) @classmethod def get_hidden_modules( @@ -56,7 +83,7 @@ class Hidden_modules(plugins.PluginInterface): run = linux_utilities_modules.ModuleDisplayPlugin.run _generator = linux_utilities_modules.ModuleDisplayPlugin.generator - implementation = linux_utilities_modules.Modules.list_modules + implementation = find_hidden_modules @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -163,30 +190,3 @@ class Hidden_modules(plugins.PluginInterface): ) } return known_module_addresses - - @classmethod - def find_hidden_modules( - cls, context, vmlinux_module_name: str - ) -> extensions.module: - if context.symbol_space.verify_table_versions( - "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0) - ): - raise exceptions.SymbolSpaceError( - "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later" - ) - - known_module_addresses = cls.get_lsmod_module_addresses( - context, vmlinux_module_name - ) - modules_memory_boundaries = ( - linux_utilities_modules.Modules.get_modules_memory_boundaries( - context, vmlinux_module_name - ) - ) - - yield from linux_utilities_modules.Modules.get_hidden_modules( - context, - vmlinux_module_name, - known_module_addresses, - modules_memory_boundaries, - ) From ee0ad0b4af9c094976390f65376d623345dab393 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 28 Mar 2025 01:46:14 +0000 Subject: [PATCH 0930/1352] Update the various MINOR version bumps to the current version --- API_CHANGES.md | 96 ++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 94 insertions(+), 2 deletions(-) diff --git a/API_CHANGES.md b/API_CHANGES.md index 61d8781fb..83d59a202 100644 --- a/API_CHANGES.md +++ b/API_CHANGES.md @@ -4,6 +4,100 @@ API Changes When an addition to the existing API is made, the minor version is bumped. When an API feature or function is removed or changed, the major version is bumped. +2.25.0 +====== +Pointer class now supports `get_raw_value()`. +`KTIMER` no longer supports `get_raw_dpc()`. + +2.24.0 +====== +Support `encoding` parameter for `objects.utility.array_to_string` + +2.23.0 +====== +Add support for windows GUI classes and OS distinguishers. +Add a symbol_table_name for `ExecutiveObject.get_object_header()`/ + +2.22.0 +====== +Linux net constants added. +Network objects moved to separate versionable module. + +2.21.0 +====== +`uuid` method added to `linux.extensions`. + +2.20.0 +====== +NM_TYPES_DESC constants added to linux. +`latch_tree_root` and `kernel_symbol` added to linux extensions. +Linux `module` class additions: +* `get_module_address_boundaries` +* `section_typetab` +Linux `task_struct` class additions: +* `get_address_space_layer` +* `state` +Linux `bpf_prog` class additions: +* `bpf_jit_binary_hdr_address` + +2.19.0 +====== +Introduction of `Modules` versionable linux extension module. +Deprecation of some `LinuxUtilities` functions relating to modules. + +2.18.0 +====== +Addition of `scatterlist` linux extension. + +2.17.0 +====== +The addition of a `types` member to `SymbolInterface` + +2.16.0 +====== +Addition of TAINT_FLAG constants, `TaintFlag` dataclass +Addition of linux `tainting` versionable module + +2.15.0 +====== +Addition of `convert_fourcc_code` to `LinuxUtilities` class + +2.14.0 +====== +No significant changes (part of the 2.16.0 PR which took time in development) + +2.13.0 +====== +Linux `task` objectr extension addition of `getppid` + +2.12.0 +====== +Changes to the Intel layer to support `PROT_NONE` pages. + +2.11.0 +====== +Addition of `get_type` method to windows `CM_KEY_NODE` registry structure + +2.10.0 +====== +No significant API changes (CLI changes to the JSONL text renderer) + +2.9.0 +===== +No significant API changes (change to call `linux.LinuxUtilities.get_module_from_volobj_type` to get the kernel) + +2.8.0 +===== +Addition of the `BinOrAbsent`, `HexOrAbsent`, `HexBytesOrAbsent` and `MultiTypeDataOrAbsent` data type renderers + +2.7.0 +===== +Addition of `is_valid`, `get_create_time` and `get_exit_time` to ETHREAD structure + +2.6.0 +===== +No significant changes (again, the version got bump twice in the PR straight to 2.7.0) + 2.5.0 ===== Add in support for specifying a type override for object_from_symbol @@ -50,5 +144,3 @@ an absolute offset. This can be done with `Module.get_absolute_symbol_address` * Added context.modules * Added ModuleRequirement * Added get\_symbols\_by\_absolute\_location - - From 9ffdf08f20434263f7f58347d58683ee5df817bd Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 11:45:34 +0000 Subject: [PATCH 0931/1352] Improve `display_type` in Volshell with better pointer handling - Introduced `_get_type_name_with_pointer` to properly display pointer types. - Enhanced `display_type` to follow and display pointer chains up to `MAX_DEREFERENCE_COUNT` levels. - Added `_display_simple_type` to standardize type information display. - Improved `_display_value` to highlight null and unreadable pointers. --- volatility3/cli/volshell/generic.py | 170 ++++++++++++++++++++++++---- 1 file changed, 147 insertions(+), 23 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 3a5d514fe..116e9c449 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -32,6 +32,8 @@ try: except ImportError: has_ipython = False +MAX_DEREFERENCE_COUNT = 4 # the max number of times display_type should follow pointers + class Volshell(interfaces.plugins.PluginInterface): """Shell environment to directly interact with a memory image.""" @@ -386,6 +388,30 @@ class Volshell(interfaces.plugins.PluginInterface): for i in disasm_types[architecture].disasm(remaining_data, offset): print(f"0x{i.address:x}:\t{i.mnemonic}\t{i.op_str}") + def _get_type_name_with_pointer( + self, + member_type: Union[ + str, interfaces.objects.ObjectInterface, interfaces.objects.Template + ], + depth: int = 0, + ) -> str: + """Takes a member_type from and returns the subtype name with a * if the member_type is + a pointer otherwise it returns just the normal type name.""" + pointer_marker = "*" * depth + try: + if member_type.vol.object_class == objects.Pointer: + sub_member_type = member_type.vol.subtype + # follow at most MAX_DEREFERENCE_COUNT pointers. A guard against, hopefully unlikely, infinite loops + if depth < MAX_DEREFERENCE_COUNT: + return self._get_type_name_with_pointer(sub_member_type, depth + 1) + else: + return member_type_name + except AttributeError: + pass # not all objects get a `object_class`, and those that don't are not pointers. + finally: + member_type_name = pointer_marker + member_type.vol.type_name + return member_type_name + def display_type( self, object: Union[ @@ -418,26 +444,51 @@ class Volshell(interfaces.plugins.PluginInterface): volobject.vol.type_name, layer_name=self.current_layer, offset=offset ) - if hasattr(volobject.vol, "size"): - print(f"{volobject.vol.type_name} ({volobject.vol.size} bytes)") - elif hasattr(volobject.vol, "data_format"): - data_format = volobject.vol.data_format - print( - "{} ({} bytes, {} endian, {})".format( - volobject.vol.type_name, - data_format.length, - data_format.byteorder, - "signed" if data_format.signed else "unsigned", - ) - ) + # add special case for pointer so that information about the struct the + # pointer is pointing to is shown rather than simply the fact this is a + # pointer object. The "dereference_count < MAX_DEREFERENCE_COUNT" is to + # guard against loops + dereference_count = 0 + while ( + isinstance(volobject, objects.Pointer) + and dereference_count < MAX_DEREFERENCE_COUNT + ): + # before defreerencing the pointer, show it's information + print(f'{" " * dereference_count}{self._display_simple_type(volobject)}') + + # check that we can follow the pointer before dereferencing and do not + # attempt to follow null pointers. + if volobject.is_readable() and volobject != 0: + # now deference the pointer and store this as the new volobject + volobject = volobject.dereference() + dereference_count = dereference_count + 1 + else: + # if we aren't able to follow the pointers anymore then there will + # be no more information to display as we've already printed the + # details of this pointer including the fact that we're not able to + # follow it anywhere + return if hasattr(volobject.vol, "members"): + # display the header for this object, if the orginal object was just a type string, display the type information + struct_header = f'{" " * dereference_count}{volobject.vol.type_name} ({volobject.vol.size} bytes)' + if isinstance(object, str) and offset is None: + suffix = ":" + else: + # this is an actual object or an offset was given so the offset should be displayed + suffix = f" @ {hex(volobject.vol.offset)}:" + print(struct_header + suffix) + + # it is a more complex type, so all members also need information displayed longest_member = longest_offset = longest_typename = 0 for member in volobject.vol.members: relative_offset, member_type = volobject.vol.members[member] longest_member = max(len(member), longest_member) longest_offset = max(len(hex(relative_offset)), longest_offset) - longest_typename = max(len(member_type.vol.type_name), longest_typename) + member_type_name = self._get_type_name_with_pointer( + member_type + ) # special case for pointers to show what they point to + longest_typename = max(len(member_type_name), longest_typename) for member in sorted( volobject.vol.members, key=lambda x: (volobject.vol.members[x][0], x) @@ -445,40 +496,113 @@ class Volshell(interfaces.plugins.PluginInterface): relative_offset, member_type = volobject.vol.members[member] len_offset = len(hex(relative_offset)) len_member = len(member) - len_typename = len(member_type.vol.type_name) + member_type_name = self._get_type_name_with_pointer( + member_type + ) # special case for pointers to show what they point to + len_typename = len(member_type_name) if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data print( + " " * dereference_count, " " * (longest_offset - len_offset), hex(relative_offset), ": ", member, " " * (longest_member - len_member), " ", - member_type.vol.type_name, + member_type_name, " " * (longest_typename - len_typename), " ", self._display_value(getattr(volobject, member)), ) else: + # not provided with an actual object, nor an offset so just display the types print( + " " * dereference_count, " " * (longest_offset - len_offset), hex(relative_offset), ": ", member, " " * (longest_member - len_member), " ", - member_type.vol.type_name, + member_type_name, ) - @classmethod - def _display_value(cls, value: Any) -> str: - if isinstance(value, objects.PrimitiveObject): - return repr(value) - elif isinstance(value, objects.Array): - return repr([cls._display_value(val) for val in value]) + else: # simple type with no members, only one line to print + # if the orginal object was just a type string, display the type information + if isinstance(object, str) and offset is None: + print(self._display_simple_type(volobject, include_value=False)) + + # if the original object was an actual volobject or was a type string + # with an offset. Then append the actual data to the display. + else: + print(" " * dereference_count, self._display_simple_type(volobject)) + + def _display_simple_type( + self, + volobject: Union[ + interfaces.objects.ObjectInterface, interfaces.objects.Template + ], + include_value: bool = True, + ) -> str: + # build the display_type_string based on the aviable information + + if hasattr(volobject.vol, "size"): + # the most common type to display, this shows their full size, e.g.: + # (layer_name) >>> dt('task_struct') + # symbol_table_name1!task_struct (1784 bytes) + display_type_string = ( + f"{volobject.vol.type_name} ({volobject.vol.size} bytes)" + ) + elif hasattr(volobject.vol, "data_format"): + # this is useful for very simple types like ints, e.g.: + # (layer_name) >>> dt('int') + # symbol_table_name1!int (4 bytes, little endian, signed) + data_format = volobject.vol.data_format + display_type_string = "{} ({} bytes, {} endian, {})".format( + volobject.vol.type_name, + data_format.length, + data_format.byteorder, + "signed" if data_format.signed else "unsigned", + ) + elif hasattr(volobject.vol, "type_name"): + # types like void have almost no values to display other than their name, e.g.: + # (layer_name) >>> dt('void') + # symbol_table_name1!void + display_type_string = volobject.vol.type_name else: - return hex(value.vol.offset) + # it should not be possible to have a volobject without at least a type_name + raise AttributeError("Unable to find any details for object") + + if include_value: # if include_value is true also add the value to the display + if isinstance(volobject, objects.Pointer): + # for pointers include the location of the pointer and where it points to + return f"{display_type_string} @ {hex(volobject.vol.offset)} -> {self._display_value(volobject)}" + else: + return f"{display_type_string}: {self._display_value(volobject)}" + else: + return display_type_string + + def _display_value(self, value: Any) -> str: + try: + if isinstance(value, objects.Pointer): + # show pointers in hex to match output for struct addrs + # highlight null or unreadable pointers + if value == 0: + suffix = " (null pointer)" + elif not value.is_readable(): + suffix = " (unreadable pointer)" + else: + suffix = "" + return f"{hex(value)}{suffix}" + elif isinstance(value, objects.PrimitiveObject): + return repr(value) + elif isinstance(value, objects.Array): + return repr([self._display_value(val) for val in value]) + else: + return hex(value.vol.offset) + except exceptions.InvalidAddressException: + return "-" def generate_treegrid( self, plugin: Type[interfaces.plugins.PluginInterface], **kwargs From 82e1813310a5fe168c73ae1905084d3f5d2909a1 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 11:52:44 +0000 Subject: [PATCH 0932/1352] Handle InvalidAddressException in volshell value display (thanks @atcuno!) Details: Implements exception handling for InvalidAddressException in volshell. Ensures invalid pointers don't cause large stack traces, displaying "N/A" instead. --- volatility3/cli/volshell/generic.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 116e9c449..ca1c7b73c 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -502,6 +502,10 @@ class Volshell(interfaces.plugins.PluginInterface): len_typename = len(member_type_name) if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data + try: + value = self._display_value(getattr(volobject, member)) + except exceptions.InvalidAddressException: + value = self._display_value(renderers.NotAvailableValue()) print( " " * dereference_count, " " * (longest_offset - len_offset), @@ -513,7 +517,7 @@ class Volshell(interfaces.plugins.PluginInterface): member_type_name, " " * (longest_typename - len_typename), " ", - self._display_value(getattr(volobject, member)), + value, ) else: # not provided with an actual object, nor an offset so just display the types @@ -585,7 +589,9 @@ class Volshell(interfaces.plugins.PluginInterface): def _display_value(self, value: Any) -> str: try: - if isinstance(value, objects.Pointer): + if isinstance(value, interfaces.renderers.BaseAbsentValue): + return "N/A" + elif isinstance(value, objects.Pointer): # show pointers in hex to match output for struct addrs # highlight null or unreadable pointers if value == 0: From 2415e985104c698ba0e9994d292c26f74b120cd5 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 12:35:32 +0000 Subject: [PATCH 0933/1352] Fix `display_type()` issue for `.write` attribute in volshell, or other fuctions Previously, `getattr(volobject, member)` in `display_type()` would incorrectly retrieve method references (e.g., `.write`) instead of the intended object addresses, causing an `AttributeError` when `_display_value()` attempted to access `.vol.offset`. This commit replaces `getattr(volobject, member)` with `volobject.member(member)`, ensuring that the correct object address is retrieved instead of method references. Fixes: #1705 --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index ca1c7b73c..4ebda12a2 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -503,7 +503,7 @@ class Volshell(interfaces.plugins.PluginInterface): if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data try: - value = self._display_value(getattr(volobject, member)) + value = self._display_value(volobject.member(member)) except exceptions.InvalidAddressException: value = self._display_value(renderers.NotAvailableValue()) print( From f060e3b8aea71ee8b32f607e5c8cad41d12dc331 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 12:42:24 +0000 Subject: [PATCH 0934/1352] Fix type check for pointer detection in volshell Replaced `member_type.vol.object_class == objects.Pointer` with `isinstance(member_type, objects.Pointer)` to identify pointer types consistently. Thanks to @ikelos for the suggestion! --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 4ebda12a2..cc8027ddd 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -399,7 +399,7 @@ class Volshell(interfaces.plugins.PluginInterface): a pointer otherwise it returns just the normal type name.""" pointer_marker = "*" * depth try: - if member_type.vol.object_class == objects.Pointer: + if isinstance(member_type, objects.Pointer): sub_member_type = member_type.vol.subtype # follow at most MAX_DEREFERENCE_COUNT pointers. A guard against, hopefully unlikely, infinite loops if depth < MAX_DEREFERENCE_COUNT: From d648bd908dcb220a1c7d22aaaa380c060c077a06 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 13:07:26 +0000 Subject: [PATCH 0935/1352] Revert change in _get_type_name_with_pointer as this stopped the pointer marker being calculated correctly --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index cc8027ddd..4ebda12a2 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -399,7 +399,7 @@ class Volshell(interfaces.plugins.PluginInterface): a pointer otherwise it returns just the normal type name.""" pointer_marker = "*" * depth try: - if isinstance(member_type, objects.Pointer): + if member_type.vol.object_class == objects.Pointer: sub_member_type = member_type.vol.subtype # follow at most MAX_DEREFERENCE_COUNT pointers. A guard against, hopefully unlikely, infinite loops if depth < MAX_DEREFERENCE_COUNT: From 9d1a68256506d797cb3bd4e38986e484611f788f Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 13:36:32 +0000 Subject: [PATCH 0936/1352] remove unneeded else, this case is caught with finally --- volatility3/cli/volshell/generic.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 4ebda12a2..d6d2fdcc8 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -404,8 +404,6 @@ class Volshell(interfaces.plugins.PluginInterface): # follow at most MAX_DEREFERENCE_COUNT pointers. A guard against, hopefully unlikely, infinite loops if depth < MAX_DEREFERENCE_COUNT: return self._get_type_name_with_pointer(sub_member_type, depth + 1) - else: - return member_type_name except AttributeError: pass # not all objects get a `object_class`, and those that don't are not pointers. finally: From f844f80d2a0bc9c39e92def94a312bcc0aa7b81f Mon Sep 17 00:00:00 2001 From: ikelos Date: Fri, 28 Mar 2025 14:29:35 +0000 Subject: [PATCH 0937/1352] Update API_CHANGES.md Fix typo highlighted by @eve-mem --- API_CHANGES.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/API_CHANGES.md b/API_CHANGES.md index 83d59a202..a4d8d9b13 100644 --- a/API_CHANGES.md +++ b/API_CHANGES.md @@ -68,7 +68,7 @@ No significant changes (part of the 2.16.0 PR which took time in development) 2.13.0 ====== -Linux `task` objectr extension addition of `getppid` +Linux `task` object extension addition of `getppid` 2.12.0 ====== From ec9e738334aa4703bfadd940f94b056f09d55558 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 14:37:46 +0000 Subject: [PATCH 0938/1352] fix typo --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index d6d2fdcc8..adb307c62 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -547,7 +547,7 @@ class Volshell(interfaces.plugins.PluginInterface): ], include_value: bool = True, ) -> str: - # build the display_type_string based on the aviable information + # build the display_type_string based on the available information if hasattr(volobject.vol, "size"): # the most common type to display, this shows their full size, e.g.: From fe6d57554bfda140d51a490da63f1764b04cd1db Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 14:51:31 +0000 Subject: [PATCH 0939/1352] update _display_value to handle None case --- volatility3/cli/volshell/generic.py | 49 +++++++++++++++++++---------- 1 file changed, 33 insertions(+), 16 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index adb307c62..688a513e5 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -587,26 +587,43 @@ class Volshell(interfaces.plugins.PluginInterface): def _display_value(self, value: Any) -> str: try: + # if value is a BaseAbsentValue they display N/A if isinstance(value, interfaces.renderers.BaseAbsentValue): return "N/A" - elif isinstance(value, objects.Pointer): - # show pointers in hex to match output for struct addrs - # highlight null or unreadable pointers - if value == 0: - suffix = " (null pointer)" - elif not value.is_readable(): - suffix = " (unreadable pointer)" - else: - suffix = "" - return f"{hex(value)}{suffix}" - elif isinstance(value, objects.PrimitiveObject): - return repr(value) - elif isinstance(value, objects.Array): - return repr([self._display_value(val) for val in value]) else: - return hex(value.vol.offset) + # volobject branch + if isinstance( + value, + Union[ + interfaces.objects.ObjectInterface, interfaces.objects.Template + ], + ): + if isinstance(value, objects.Pointer): + # show pointers in hex to match output for struct addrs + # highlight null or unreadable pointers + if value == 0: + suffix = " (null pointer)" + elif not value.is_readable(): + suffix = " (unreadable pointer)" + else: + suffix = "" + return f"{hex(value)}{suffix}" + elif isinstance(value, objects.PrimitiveObject): + return repr(value) + elif isinstance(value, objects.Array): + return repr([self._display_value(val) for val in value]) + else: + return hex(value.vol.offset) + else: + # non volobject + if value is None: + return "N/A" + else: + return value + except exceptions.InvalidAddressException: - return "-" + # if value causes an InvalidAddressException like BaseAbsentValue then display N/A + return "N/A" def generate_treegrid( self, plugin: Type[interfaces.plugins.PluginInterface], **kwargs From 06815f9c91f33304e08ba8345b5b24d680792844 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 15:03:53 +0000 Subject: [PATCH 0940/1352] volshell: add MAX_TYPENAME_DISPLAY_LENGTH to stop extremely large names breaking the output --- volatility3/cli/volshell/generic.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 688a513e5..9a03bd32a 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -418,6 +418,9 @@ class Volshell(interfaces.plugins.PluginInterface): offset: Optional[int] = None, ): """Display Type describes the members of a particular object in alphabetical order""" + + MAX_TYPENAME_DISPLAY_LENGTH = 256 + if not isinstance( object, (str, interfaces.objects.ObjectInterface, interfaces.objects.Template), @@ -487,6 +490,8 @@ class Volshell(interfaces.plugins.PluginInterface): member_type ) # special case for pointers to show what they point to longest_typename = max(len(member_type_name), longest_typename) + if longest_typename > MAX_TYPENAME_DISPLAY_LENGTH: + longest_typename = MAX_TYPENAME_DISPLAY_LENGTH for member in sorted( volobject.vol.members, key=lambda x: (volobject.vol.members[x][0], x) @@ -497,6 +502,10 @@ class Volshell(interfaces.plugins.PluginInterface): member_type_name = self._get_type_name_with_pointer( member_type ) # special case for pointers to show what they point to + if len(member_type_name) > MAX_TYPENAME_DISPLAY_LENGTH: + member_type_name = ( + f"{member_type_name[:MAX_TYPENAME_DISPLAY_LENGTH - 3]}..." + ) len_typename = len(member_type_name) if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data From c43a1f40d333dcf104a9c1cdb3b95803f9d3d7d2 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Fri, 28 Mar 2025 15:50:36 +0000 Subject: [PATCH 0941/1352] Update volatility3/cli/volshell/generic.py Tidy up case where type_name is very long by @ikelos Co-authored-by: ikelos --- volatility3/cli/volshell/generic.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 9a03bd32a..22d82ff61 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -502,11 +502,10 @@ class Volshell(interfaces.plugins.PluginInterface): member_type_name = self._get_type_name_with_pointer( member_type ) # special case for pointers to show what they point to - if len(member_type_name) > MAX_TYPENAME_DISPLAY_LENGTH: - member_type_name = ( - f"{member_type_name[:MAX_TYPENAME_DISPLAY_LENGTH - 3]}..." - ) len_typename = len(member_type_name) + if len(member_type_name) > MAX_TYPENAME_DISPLAY_LENGTH: + len_typename = MAX_TYPENAME_DISPLAY_LENGTH + member_type_name = f"{member_type_name[:len_typename - 3]}..." if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data try: From 6653b93b05476781003c5f2258c54ce4619b48eb Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 15:54:24 +0000 Subject: [PATCH 0942/1352] volshell: update longest_typename calculations to use min() that than if statement --- volatility3/cli/volshell/generic.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 22d82ff61..806c5ab07 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -489,9 +489,12 @@ class Volshell(interfaces.plugins.PluginInterface): member_type_name = self._get_type_name_with_pointer( member_type ) # special case for pointers to show what they point to + + # find the longest typename longest_typename = max(len(member_type_name), longest_typename) - if longest_typename > MAX_TYPENAME_DISPLAY_LENGTH: - longest_typename = MAX_TYPENAME_DISPLAY_LENGTH + + # if the typename is very long then limit it to MAX_TYPENAME_DISPLAY_LENGTH + longest_typename = min(longest_typename, MAX_TYPENAME_DISPLAY_LENGTH) for member in sorted( volobject.vol.members, key=lambda x: (volobject.vol.members[x][0], x) From fa45b47ed72e7cd37d6becb8d588a4dae58873bb Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 15:58:11 +0000 Subject: [PATCH 0943/1352] volshell: use repr for none vol objects --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 806c5ab07..11814f20a 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -630,7 +630,7 @@ class Volshell(interfaces.plugins.PluginInterface): if value is None: return "N/A" else: - return value + return repr(value) except exceptions.InvalidAddressException: # if value causes an InvalidAddressException like BaseAbsentValue then display N/A From 2ad1536b4e154f601f28247e15640ccc4bc0ad84 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 24 Mar 2025 11:59:38 -0500 Subject: [PATCH 0944/1352] Testing: Verify `VersionRequirement`s This adds a script and GitHub action to the `test` directory that dynamically imports all modules in `volatility3`, searches for usages of `VersionableInterface` objects within classes that inherit from `ConfigurableInterface` but don't enumerate the used component as a requirement in `get_requirements()`, and returns -1 if any violations are found. Fixes --- .github/workflows/check-requirements.yml | 25 ++ pyproject.toml | 2 + test/check_configurable_requirements.py | 300 +++++++++++++++++++++++ 3 files changed, 327 insertions(+) create mode 100644 .github/workflows/check-requirements.yml create mode 100644 test/check_configurable_requirements.py diff --git a/.github/workflows/check-requirements.yml b/.github/workflows/check-requirements.yml new file mode 100644 index 000000000..9892d7b94 --- /dev/null +++ b/.github/workflows/check-requirements.yml @@ -0,0 +1,25 @@ +name: Check Volatility3 Version Requirements +on: [push, pull_request] +jobs: + + build: + runs-on: ubuntu-22.04 + strategy: + matrix: + python-version: ["3.8"] + steps: + - uses: actions/checkout@v4 + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v5 + with: + python-version: ${{ matrix.python-version }} + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install .[test] + + - name: Testing... + run: | + # Verify completeness of ConfigurableInterface requirements + python ./test/check_configurable_requirements.py diff --git a/pyproject.toml b/pyproject.toml index abd2e79f7..8bc3693a2 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -46,6 +46,8 @@ test = [ "volatility3[dev]", "pytest>=8.3.3,<9", "yara-x>=0.10.0,<1", + "tree-sitter==0.21.3", + "tree-sitter-python==0.21.0", ] docs = [ diff --git a/test/check_configurable_requirements.py b/test/check_configurable_requirements.py new file mode 100644 index 000000000..e21df18ac --- /dev/null +++ b/test/check_configurable_requirements.py @@ -0,0 +1,300 @@ +import importlib +import inspect +import pkgutil +import sys +import traceback +import types +from textwrap import dedent +from typing import Dict, Iterator, List, NamedTuple, Optional, Tuple, Type + +from tree_sitter import Language, Node, Parser +from tree_sitter_python import language as python_language + +from volatility3.framework import configuration, interfaces + + +class UnrequiredVersionableUsage(NamedTuple): + versionable_item_class: str + """ + The name of the VersionableInterface class + """ + + consuming_class: str + """ + The name of the class that is using the imported VersionableInterface class + """ + + methodname: Optional[str] + """ + The name of the invoked method or attribute, if one is used or referenced + """ + + node: Node + """ + The tree-sitter node encapsulating the used module component. + """ + + def __str__(self) -> str: + return ( + f"Found usage of {self.versionable_item_class} " + f"in class {self.consuming_class} that is not declared " + f"in {self.consuming_class}'s `get_requirements()` classmethod" + ) + + +class RequirementValidator: + language = Language(python_language(), "python") + + def __init__(self, plugin_module: types.ModuleType) -> None: + if plugin_module.__file__ is None: + raise ValueError("Attempting to validate a module without a file") + + self._module = plugin_module + + # See which classes in *this* module are configurable (can have requirements declared) + self._configurable_classes = get_configurable_classes(plugin_module) + + # Get a mapping of class names to configurable classes that they declare in their requirements + self._versioned_item_mapping = get_versioned_item_mapping( + self._configurable_classes + ) + + # Get a mapping of module name -> versionable classes within the namespace of each module + self._imported_mod_classes = get_versionable_import_mapping( + get_imported_modules(plugin_module) + ) + + with open(plugin_module.__file__, "rb") as f: + source = f.read() + + self._parser = Parser() + self._parser.set_language(self.language) + self._tree = self._parser.parse(source) + + def enumerate_unrequired_usages( + self, + clazz: Type[interfaces.configuration.ConfigurableInterface], + class_node: Node, + ): + + # This query is designed to look for three different identifier usages: + # simple identifiers: PsList + # module attrs: pslist.PsList + # method calls: pslist.PsList.list_processes + obj_query = self.language.query( + dedent( + """ + [ + (identifier) + (attribute + object: (identifier) + attribute: (identifier)) + (attribute + object: (attribute + object: (identifier) + attribute: (identifier)) + ) + ] @ident + """ + ) + ) + + containing_name = class_node.child_by_field_name("name").text.decode("utf-8") + + valid_types = self._versioned_item_mapping[containing_name] + for _, match in obj_query.matches(class_node): + if "ident" not in match: + continue + + # Get the raw text of the match. This could be something like + # - PsList + # - pslist.PsList + # - pslist.PsList.list_processes + ident_text = match["ident"].text.decode("utf-8") + + # split the attributes + components = ident_text.split(".") + try: + # See if the first attribute is in the module namespace. + item = vars(self._module)[components[0]] + except KeyError: + # If it's not, it's likely a variable in a smaller scope and we + # can ignore it. + continue + + # If it's in the module namespace and is a module... + if isinstance(item, types.ModuleType): + try: + # We try getting attributes from it until we + # find one that is a versionable class + + # Ideally, we shouldn't have to look further than + # two levels + item = getattr(item, components[1]) + if not is_versionable(item): + item = getattr(item, components[2]) + if not is_versionable(item): + continue + + except (IndexError, AttributeError): + # we ran out of attributes to check + continue + + elif is_versionable(item): + # The versionable thing was at the top level. This + # goes against our preferred style, but is possible. + pass + else: + # This isn't something we care about. + continue + + if ( + item in valid_types + or item is clazz + or inspect.isabstract(item) + or item + is interfaces.configuration.VersionableInterface # Avoid checking the interface itself + ): + continue + + yield UnrequiredVersionableUsage( + item, + containing_name, + components[1] if len(components) > 1 else None, + match["ident"], + ) + + def find_class_nodes( + self, + ) -> Iterator[Tuple[Type[interfaces.configuration.ConfigurableInterface], Node]]: + """ + Yields an iterator of (classname, node) tuples, where the node is the subtree containing + the entire class definition. + """ + class_query = self.language.query("(class_definition) @classdef") + + matches = class_query.captures(self._tree.root_node) + for node, _ in matches: + classname = node.child_by_field_name("name").text.decode("utf-8") + if classname not in self._configurable_classes: + continue + + yield self._configurable_classes[classname], node + + +def is_versionable(var): + try: + return issubclass(var, interfaces.configuration.VersionableInterface) + except TypeError: + return False + + +def is_configurable(var): + try: + return issubclass(var, interfaces.configuration.ConfigurableInterface) + except TypeError: + return False + + +def get_imported_modules( + plugin_module: types.ModuleType, +) -> List[Tuple[str, types.ModuleType]]: + return [ + (name, var) + for name, var in vars(plugin_module).items() + if isinstance(var, types.ModuleType) + ] + + +def get_configurable_classes( + plugin_module: types.ModuleType, +) -> Dict[str, Type[interfaces.configuration.ConfigurableInterface]]: + return { + name: clazz + for name, clazz in vars(plugin_module).items() + if is_configurable(clazz) + } + + +def get_versioned_item_mapping( + configurable_classes: Dict[ + str, Type[interfaces.configuration.ConfigurableInterface] + ] +) -> Dict[str, List[Type[interfaces.configuration.VersionableInterface]]]: + return { + name: [ + req._component + for req in clazz.get_requirements() + if isinstance(req, configuration.requirements.VersionRequirement) + ] + for name, clazz in configurable_classes.items() + } + + +def get_versionable_import_mapping( + imported_modules: List[Tuple[str, types.ModuleType]] +) -> Dict[str, List[str]]: + return { + modname: [name for name, var in vars(module).items() if is_versionable(var)] + for modname, module in imported_modules + } + + +def report_missing_requirements() -> Iterator[Tuple[str, UnrequiredVersionableUsage]]: + vol3 = importlib.import_module("volatility3") + + for _, module_name, _ in pkgutil.walk_packages( + vol3.__path__, vol3.__name__ + ".", onerror=lambda _: None + ): + try: + # import the module that we want to check + modname = module_name.replace( + "volatility3.framework.plugins", "volatility3.plugins" + ) + plugin_module = importlib.import_module(modname) + + except ImportError: + continue + except Exception: + continue + + if plugin_module.__file__ is None: + continue + + try: + # construct a validator for the module + try: + validator = RequirementValidator(plugin_module) + except Exception: + traceback.print_stack() + continue + for clazz, node in validator.find_class_nodes(): + for item in validator.enumerate_unrequired_usages(clazz, node): + yield module_name, item + except Exception as exc: + traceback.print_exc() + print( + f"Failed to create validator for source code from {plugin_module.__file__}: {exc}" + ) + sys.exit(1) + + +def perform_review(): + found = 0 + for mod, usage in report_missing_requirements(): + found += 1 + print( + f"Violation in module {mod} (line {usage.node.start_point[0]}): {str(usage)}" + ) + + if found: + print( + f"Found {found} uses of versionable components not declared in get_requirements()" + ) + sys.exit(1) + + print("All configurable classes passed validation!") + + +if __name__ == "__main__": + perform_review() From 0f73686364392dbba36a4a20fff2a13f8df04c31 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Mar 2025 11:07:58 -0500 Subject: [PATCH 0945/1352] Framework: Fix remaining missing requirements This adds all of the missing requirements discovered via the new code analysis script. --- volatility3/cli/volshell/generic.py | 7 ++++++ volatility3/cli/volshell/linux.py | 5 ++++ volatility3/cli/volshell/mac.py | 5 ++++ volatility3/cli/volshell/windows.py | 5 ++++ volatility3/framework/automagic/pdbscan.py | 23 +++++++++++++++---- .../framework/automagic/symbol_finder.py | 7 +++++- volatility3/framework/layers/qemu.py | 11 +++++++++ .../framework/layers/scanners/__init__.py | 5 ++++ volatility3/framework/plugins/banners.py | 7 +++++- volatility3/framework/plugins/linux/bash.py | 10 ++++++++ .../framework/plugins/linux/check_modules.py | 5 ++++ .../framework/plugins/linux/hidden_modules.py | 5 ++++ volatility3/framework/plugins/linux/psscan.py | 5 ++++ .../framework/plugins/linux/vmaregexscan.py | 5 ++++ volatility3/framework/plugins/mac/bash.py | 10 ++++++++ .../framework/plugins/mac/list_files.py | 5 ++++ volatility3/framework/plugins/regexscan.py | 5 ++++ volatility3/framework/plugins/vmscan.py | 7 ++++++ .../framework/plugins/windows/cmdscan.py | 5 ++++ .../framework/plugins/windows/consoles.py | 5 ++++ .../framework/plugins/windows/mbrscan.py | 5 ++++ .../framework/plugins/windows/poolscanner.py | 7 ++++++ .../plugins/windows/skeleton_key_check.py | 5 ++++ .../framework/plugins/windows/svclist.py | 5 ++++ .../framework/plugins/windows/svcscan.py | 5 ++++ .../framework/plugins/windows/vadregexscan.py | 5 ++++ .../framework/plugins/windows/verinfo.py | 5 ++++ volatility3/framework/plugins/yarascan.py | 7 +++++- 28 files changed, 179 insertions(+), 7 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 3a5d514fe..1b3ae59d1 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -38,6 +38,8 @@ class Volshell(interfaces.plugins.PluginInterface): _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + DEFAULT_NUM_DISPLAY_BYTES = 128 def __init__(self, *args, **kwargs): @@ -61,6 +63,11 @@ class Volshell(interfaces.plugins.PluginInterface): default=None, optional=True, ), + requirements.VersionRequirement( + name="regex_scanner", + component=scanners.RegExScanner, + version=(1, 0, 0), + ), requirements.BooleanRequirement( name="script-only", description="Exit volshell after the script specified in --script completes", diff --git a/volatility3/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py index 27c630614..761b64084 100644 --- a/volatility3/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -36,6 +36,11 @@ class Volshell(generic.Volshell): requirements.IntRequirement( name="pid", description="Process ID", optional=True ), + requirements.VersionRequirement( + name="generic_volshell", + component=generic.Volshell, + version=(1, 0, 0), + ), ] def change_task(self, pid=None): diff --git a/volatility3/cli/volshell/mac.py b/volatility3/cli/volshell/mac.py index 393eff20b..fcb45e124 100644 --- a/volatility3/cli/volshell/mac.py +++ b/volatility3/cli/volshell/mac.py @@ -25,6 +25,11 @@ class Volshell(generic.Volshell): requirements.IntRequirement( name="pid", description="Process ID", optional=True ), + requirements.VersionRequirement( + name="generic_volshell", + component=generic.Volshell, + version=(1, 0, 0), + ), ] def change_task(self, pid=None): diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index ce5995648..a8c7af5b3 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -23,6 +23,11 @@ class Volshell(generic.Volshell): requirements.IntRequirement( name="pid", description="Process ID", optional=True ), + requirements.VersionRequirement( + name="generic_volshell", + component=generic.Volshell, + version=(1, 0, 0), + ), ] def change_process(self, pid=None): diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index dd2ad0683..55b9b81e1 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -17,7 +17,7 @@ from volatility3.framework import constants, exceptions, interfaces, layers from volatility3.framework.configuration import requirements from volatility3.framework.layers import intel, scanners from volatility3.framework.symbols import native -from volatility3.framework.symbols.windows.pdbutil import PDBUtility +from volatility3.framework.symbols.windows import pdbutil if __name__ == "__main__": import sys @@ -50,6 +50,21 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): max_pdb_size = 0x400000 exclusion_list = ["linux", "mac"] + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.VersionRequirement( + name="pdb_utility", + component=pdbutil.PDBUtility, + version=(1, 0, 1), + ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), + ] + def find_virtual_layers_from_req( self, context: interfaces.context.ContextInterface, @@ -120,7 +135,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): ): raise TypeError("PDB name or GUID not a string value") - PDBUtility.load_windows_symbol_table( + pdbutil.PDBUtility.load_windows_symbol_table( context=context, guid=kernel["GUID"], age=kernel["age"], @@ -259,7 +274,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): bytes(name + ".pdb", "utf-8") for name in constants.windows.KERNEL_MODULE_NAMES ] - kernels = PDBUtility.pdbname_scan( + kernels = pdbutil.PDBUtility.pdbname_scan( ctx=context, layer_name=layer_to_scan, start=start_scan_address, @@ -362,7 +377,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): with contextlib.suppress(exceptions.InvalidAddressException): if vlayer.read(address, 0x2) == b"MZ": res = list( - PDBUtility.pdbname_scan( + pdbutil.PDBUtility.pdbname_scan( ctx=context, layer_name=vlayer.name, page_size=vlayer.page_size, diff --git a/volatility3/framework/automagic/symbol_finder.py b/volatility3/framework/automagic/symbol_finder.py index 1d30f3f51..d7c6a22c1 100644 --- a/volatility3/framework/automagic/symbol_finder.py +++ b/volatility3/framework/automagic/symbol_finder.py @@ -40,7 +40,12 @@ class SymbolFinder(interfaces.automagic.AutomagicInterface): name="SQLiteCache", component=symbol_cache.SqliteCache, version=(1, 0, 0), - ) + ), + requirements.VersionRequirement( + name="multi_string_scanner", + component=scanners.MultiStringScanner, + version=(1, 0, 0), + ), ] @property diff --git a/volatility3/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py index a8127e954..eb44de347 100644 --- a/volatility3/framework/layers/qemu.py +++ b/volatility3/framework/layers/qemu.py @@ -9,6 +9,7 @@ import struct from typing import Any, Dict, List, Optional, Set, Tuple from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework.configuration import requirements from volatility3.framework.layers import scanners, segmented from volatility3.framework.symbols import intermed @@ -99,6 +100,16 @@ class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): context=context, config_path=config_path, name=name, metadata=metadata ) + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.VersionRequirement( + name="regex_scanner", + component=scanners.RegExScanner, + version=(1, 0, 0), + ), + ] + @classmethod def _check_header( cls, base_layer: interfaces.layers.DataLayerInterface, name: str = "" diff --git a/volatility3/framework/layers/scanners/__init__.py b/volatility3/framework/layers/scanners/__init__.py index be9f1c39a..f07849f42 100644 --- a/volatility3/framework/layers/scanners/__init__.py +++ b/volatility3/framework/layers/scanners/__init__.py @@ -11,6 +11,8 @@ from volatility3.framework.layers.scanners import multiregexp as multiregexp class BytesScanner(layers.ScannerInterface): thread_safe = True + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, needle: bytes) -> None: @@ -38,6 +40,8 @@ class RegExScanner(layers.ScannerInterface): thread_safe = True + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) def __init__(self, pattern: bytes, flags: int = re.DOTALL) -> None: @@ -57,6 +61,7 @@ class RegExScanner(layers.ScannerInterface): class MultiStringScanner(layers.ScannerInterface): thread_safe = True + _version = (1, 0, 0) _required_framework_version = (2, 0, 0) def __init__(self, patterns: List[bytes]) -> None: diff --git a/volatility3/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py index b3c2fd3a5..d4e6e2aa8 100644 --- a/volatility3/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -22,7 +22,12 @@ class Banners(interfaces.plugins.PluginInterface): return [ requirements.TranslationLayerRequirement( name="primary", description="Memory layer to scan" - ) + ), + requirements.VersionRequirement( + name="regex_scanner", + component=scanners.RegExScanner, + version=(1, 0, 0), + ), ] def _generator(self): diff --git a/volatility3/framework/plugins/linux/bash.py b/volatility3/framework/plugins/linux/bash.py index 2a63ac329..382b66194 100644 --- a/volatility3/framework/plugins/linux/bash.py +++ b/volatility3/framework/plugins/linux/bash.py @@ -40,6 +40,16 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): component=timeliner.TimeLinerInterface, version=(1, 0, 0), ), + requirements.VersionRequirement( + name="multi_string_scanner", + component=scanners.MultiStringScanner, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), requirements.ListRequirement( name="pid", element_type=int, diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index ec6f0b73d..7805bbd8a 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -46,6 +46,11 @@ class Check_modules(plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ + requirements.VersionRequirement( + name="modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 1), + ), requirements.VersionRequirement( name="linux_utilities_modules_module_display_plugin", component=linux_utilities_modules.ModuleDisplayPlugin, diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index 136aafdd9..dcd602c5d 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -93,6 +93,11 @@ class Hidden_modules(plugins.PluginInterface): component=linux_utilities_modules.ModuleDisplayPlugin, version=(1, 0, 0), ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 1), + ), ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() @staticmethod diff --git a/volatility3/framework/plugins/linux/psscan.py b/volatility3/framework/plugins/linux/psscan.py index 0813cebed..0013bc1d8 100644 --- a/volatility3/framework/plugins/linux/psscan.py +++ b/volatility3/framework/plugins/linux/psscan.py @@ -41,6 +41,11 @@ class PsScan(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(4, 0, 0) ), + requirements.VersionRequirement( + name="multi_string_scanner", + component=scanners.MultiStringScanner, + version=(1, 0, 0), + ), ] def _generator(self): diff --git a/volatility3/framework/plugins/linux/vmaregexscan.py b/volatility3/framework/plugins/linux/vmaregexscan.py index 4c8ef5b8f..37a1a5940 100644 --- a/volatility3/framework/plugins/linux/vmaregexscan.py +++ b/volatility3/framework/plugins/linux/vmaregexscan.py @@ -46,6 +46,11 @@ class VmaRegExScan(plugins.PluginInterface): requirements.StringRequirement( name="pattern", description="RegEx pattern", optional=False ), + requirements.VersionRequirement( + name="regex_scanner", + component=scanners.RegExScanner, + version=(1, 0, 0), + ), requirements.IntRequirement( name="maxsize", description="Maximum size in bytes for displayed context", diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index 4cbade1cf..5ad6facd0 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -38,6 +38,16 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): component=timeliner.TimeLinerInterface, version=(1, 0, 0), ), + requirements.VersionRequirement( + name="multi_string_scanner", + component=scanners.MultiStringScanner, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), requirements.ListRequirement( name="pid", description="Filter on specific process IDs", diff --git a/volatility3/framework/plugins/mac/list_files.py b/volatility3/framework/plugins/mac/list_files.py index bf3dcfce6..423e2e0da 100644 --- a/volatility3/framework/plugins/mac/list_files.py +++ b/volatility3/framework/plugins/mac/list_files.py @@ -31,6 +31,11 @@ class List_Files(plugins.PluginInterface): requirements.VersionRequirement( name="mount", component=mount.Mount, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="mac_utilities", + component=mac.MacUtilities, + version=(1, 3, 0), + ), ] @classmethod diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index c526b1697..343753e92 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -39,6 +39,11 @@ class RegExScan(plugins.PluginInterface): default=cls.MAXSIZE_DEFAULT, optional=True, ), + requirements.VersionRequirement( + name="regex_scanner", + component=scanners.RegExScanner, + version=(1, 0, 0), + ), ] def _generator(self, regex_pattern): diff --git a/volatility3/framework/plugins/vmscan.py b/volatility3/framework/plugins/vmscan.py index 64377d7d8..5322456b5 100644 --- a/volatility3/framework/plugins/vmscan.py +++ b/volatility3/framework/plugins/vmscan.py @@ -26,6 +26,8 @@ class VMCSTest(enum.IntFlag): class PageStartScanner(interfaces.layers.ScannerInterface): + _version = (1, 0, 0) + def __init__(self, signatures: List[bytes], page_size: int = 0x1000): super().__init__() if not len(signatures): @@ -69,6 +71,11 @@ class Vmscan(plugins.PluginInterface): requirements.TranslationLayerRequirement( name="primary", description="Physical base memory layer" ), + requirements.VersionRequirement( + name="page_start_scanner", + component=PageStartScanner, + version=(1, 0, 0), + ), requirements.IntRequirement( name="log-threshold", description="Number of criteria failed to log to debug output", diff --git a/volatility3/framework/plugins/windows/cmdscan.py b/volatility3/framework/plugins/windows/cmdscan.py index 8c477b57d..676050b65 100644 --- a/volatility3/framework/plugins/windows/cmdscan.py +++ b/volatility3/framework/plugins/windows/cmdscan.py @@ -41,6 +41,11 @@ class CmdScan(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="consoles", component=consoles.Consoles, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), requirements.BooleanRequirement( name="no_registry", description="Don't search the registry for possible values of CommandHistorySize", diff --git a/volatility3/framework/plugins/windows/consoles.py b/volatility3/framework/plugins/windows/consoles.py index 6cfc6d588..efc03ad1b 100644 --- a/volatility3/framework/plugins/windows/consoles.py +++ b/volatility3/framework/plugins/windows/consoles.py @@ -54,6 +54,11 @@ class Consoles(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), requirements.BooleanRequirement( name="no_registry", description="Don't search the registry for possible values of CommandHistorySize and HistoryBufferMax", diff --git a/volatility3/framework/plugins/windows/mbrscan.py b/volatility3/framework/plugins/windows/mbrscan.py index 4d5198181..541aae60d 100644 --- a/volatility3/framework/plugins/windows/mbrscan.py +++ b/volatility3/framework/plugins/windows/mbrscan.py @@ -37,6 +37,11 @@ class MBRScan(interfaces.plugins.PluginInterface): default=False, optional=True, ), + requirements.VersionRequirement( + name="multi_string_scanner", + component=scanners.MultiStringScanner, + version=(1, 0, 0), + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 975ed2326..7929b70e4 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -55,6 +55,8 @@ class PoolConstraint: class PoolHeaderScanner(interfaces.layers.ScannerInterface): + _version = (1, 0, 0) + def __init__( self, module: interfaces.context.ModuleInterface, @@ -142,6 +144,11 @@ class PoolScanner(plugins.PluginInterface): requirements.VersionRequirement( name="handles", component=handles.Handles, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="pool_header_scanner", + component=PoolHeaderScanner, + version=(1, 0, 0), + ), ] def _generator(self): diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index 4831362fd..6071a2a39 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -63,6 +63,11 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), ] def _check_for_skeleton_key_vad( diff --git a/volatility3/framework/plugins/windows/svclist.py b/volatility3/framework/plugins/windows/svclist.py index 24ac2278f..963b7fc71 100644 --- a/volatility3/framework/plugins/windows/svclist.py +++ b/volatility3/framework/plugins/windows/svclist.py @@ -42,6 +42,11 @@ class SvcList(svcscan.SvcScan): description="Windows kernel", architectures=["Intel32", "Intel64"], ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 94ce02897..5f0e4761e 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -56,6 +56,11 @@ class SvcScan(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="hivelist", component=hivelist.HiveList, version=(2, 0, 0) ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), ] @classmethod diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 9b666cbcb..5ead4e453 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -41,6 +41,11 @@ class VadRegExScan(plugins.PluginInterface): element_type=int, optional=True, ), + requirements.VersionRequirement( + name="regex_scanner", + component=scanners.RegExScanner, + version=(1, 0, 0), + ), requirements.StringRequirement( name="pattern", description="RegEx pattern", optional=False ), diff --git a/volatility3/framework/plugins/windows/verinfo.py b/volatility3/framework/plugins/windows/verinfo.py index b5eba7ec6..d2722418b 100644 --- a/volatility3/framework/plugins/windows/verinfo.py +++ b/volatility3/framework/plugins/windows/verinfo.py @@ -48,6 +48,11 @@ class VerInfo(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="modules", component=modules.Modules, version=(3, 0, 0) ), + requirements.VersionRequirement( + name="page_start_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), requirements.BooleanRequirement( name="extensive", description="Search physical layer for version information", diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 38c8b6085..bb86ab6f1 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -118,7 +118,12 @@ class YaraScan(plugins.PluginInterface): name="primary", description="Memory layer for the kernel", architectures=["Intel32", "Intel64"], - ) + ), + requirements.VersionRequirement( + name="yarascanner", + component=YaraScanner, + version=(2, 1, 1), + ), ] @classmethod From 68116556a8fbe01d63e7d8866d8b9330902d0bed Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Mar 2025 12:54:08 -0500 Subject: [PATCH 0946/1352] Add calls to super().get_requirements() on inherited classes --- volatility3/cli/volshell/linux.py | 2 +- volatility3/cli/volshell/mac.py | 2 +- volatility3/cli/volshell/windows.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/volshell/linux.py b/volatility3/cli/volshell/linux.py index 761b64084..8b9e236b4 100644 --- a/volatility3/cli/volshell/linux.py +++ b/volatility3/cli/volshell/linux.py @@ -41,7 +41,7 @@ class Volshell(generic.Volshell): component=generic.Volshell, version=(1, 0, 0), ), - ] + ] + super().get_requirements() def change_task(self, pid=None): """Change the current process and layer, based on a process ID""" diff --git a/volatility3/cli/volshell/mac.py b/volatility3/cli/volshell/mac.py index fcb45e124..190c7b9f7 100644 --- a/volatility3/cli/volshell/mac.py +++ b/volatility3/cli/volshell/mac.py @@ -30,7 +30,7 @@ class Volshell(generic.Volshell): component=generic.Volshell, version=(1, 0, 0), ), - ] + ] + super().get_requirements() def change_task(self, pid=None): """Change the current process and layer, based on a process ID""" diff --git a/volatility3/cli/volshell/windows.py b/volatility3/cli/volshell/windows.py index a8c7af5b3..e7e37ed61 100644 --- a/volatility3/cli/volshell/windows.py +++ b/volatility3/cli/volshell/windows.py @@ -28,7 +28,7 @@ class Volshell(generic.Volshell): component=generic.Volshell, version=(1, 0, 0), ), - ] + ] + super().get_requirements() def change_process(self, pid=None): """Change the current process and layer, based on a process ID""" From 9f024cf0f485cae6c03a4fb980687c1930f97a51 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 27 Mar 2025 17:30:17 -0500 Subject: [PATCH 0947/1352] Refactor: use builtin ast lib instead of treesitter Instead of using the tree-sitter third party library, this uses Python's `ast` module to parse the source code and traverse the tree with a visitor pattern. This is preferred because it's native to the language itself, and Python developers are more likely to be familiar with it. The traversal also handles nested scopes better than the prior implementation. For example, classes that are declared inside of other classes can now be looked up even though they don't exist at the top level of the module namespace, since any time a class definition is entered, that class is pushed to the top of a stack that can be examined when visiting inner classes. This also adds lots of log messages at different levels, plus a command line argument for specifying verbosity, which should help with debugging down the line. --- pyproject.toml | 2 - test/check_configurable_requirements.py | 464 +++++++++++++----------- 2 files changed, 253 insertions(+), 213 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 8bc3693a2..abd2e79f7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -46,8 +46,6 @@ test = [ "volatility3[dev]", "pytest>=8.3.3,<9", "yara-x>=0.10.0,<1", - "tree-sitter==0.21.3", - "tree-sitter-python==0.21.0", ] docs = [ diff --git a/test/check_configurable_requirements.py b/test/check_configurable_requirements.py index e21df18ac..d532d98b3 100644 --- a/test/check_configurable_requirements.py +++ b/test/check_configurable_requirements.py @@ -1,16 +1,57 @@ +import argparse +import ast import importlib import inspect +import logging import pkgutil import sys -import traceback import types -from textwrap import dedent -from typing import Dict, Iterator, List, NamedTuple, Optional, Tuple, Type - -from tree_sitter import Language, Node, Parser -from tree_sitter_python import language as python_language +from typing import Any, Iterator, NamedTuple, Optional, Tuple, Type, Union from volatility3.framework import configuration, interfaces +from volatility3.framework.deprecation import PluginRenameClass + +logging.basicConfig(format="%(levelname)s: %(message)s") +logger = logging.getLogger(__name__) + + +class NodeVisitor: + def visit(self, node): + """Visit a node.""" + method = "visit_" + node.__class__.__name__ + visitor = getattr(self, method, self.generic_visit) + self.enter(node) + result = visitor(node) + self.leave(node) + return result + + def enter(self, node): + """Called when entering a node.""" + method = "enter_" + node.__class__.__name__ + visitor = getattr(self, method, self.generic_enter) + return visitor(node) + + def leave(self, node): + """Called when leaving a node.""" + method = "leave_" + node.__class__.__name__ + visitor = getattr(self, method, self.generic_leave) + return visitor(node) + + def generic_visit(self, node): + """Called if no explicit visitor function exists for a node.""" + for _, value in ast.iter_fields(node): + if isinstance(value, list): + for item in value: + if isinstance(item, ast.AST): + self.visit(item) + elif isinstance(value, ast.AST): + self.visit(value) + + def generic_enter(self, node): + """Default enter behavior.""" + + def generic_leave(self, node): + """Default leave behavior.""" class UnrequiredVersionableUsage(NamedTuple): @@ -24,12 +65,7 @@ class UnrequiredVersionableUsage(NamedTuple): The name of the class that is using the imported VersionableInterface class """ - methodname: Optional[str] - """ - The name of the invoked method or attribute, if one is used or referenced - """ - - node: Node + node: Union[ast.Name, ast.Attribute] """ The tree-sitter node encapsulating the used module component. """ @@ -42,149 +78,13 @@ class UnrequiredVersionableUsage(NamedTuple): ) -class RequirementValidator: - language = Language(python_language(), "python") - - def __init__(self, plugin_module: types.ModuleType) -> None: - if plugin_module.__file__ is None: - raise ValueError("Attempting to validate a module without a file") - - self._module = plugin_module - - # See which classes in *this* module are configurable (can have requirements declared) - self._configurable_classes = get_configurable_classes(plugin_module) - - # Get a mapping of class names to configurable classes that they declare in their requirements - self._versioned_item_mapping = get_versioned_item_mapping( - self._configurable_classes - ) - - # Get a mapping of module name -> versionable classes within the namespace of each module - self._imported_mod_classes = get_versionable_import_mapping( - get_imported_modules(plugin_module) - ) - - with open(plugin_module.__file__, "rb") as f: - source = f.read() - - self._parser = Parser() - self._parser.set_language(self.language) - self._tree = self._parser.parse(source) - - def enumerate_unrequired_usages( - self, - clazz: Type[interfaces.configuration.ConfigurableInterface], - class_node: Node, - ): - - # This query is designed to look for three different identifier usages: - # simple identifiers: PsList - # module attrs: pslist.PsList - # method calls: pslist.PsList.list_processes - obj_query = self.language.query( - dedent( - """ - [ - (identifier) - (attribute - object: (identifier) - attribute: (identifier)) - (attribute - object: (attribute - object: (identifier) - attribute: (identifier)) - ) - ] @ident - """ - ) - ) - - containing_name = class_node.child_by_field_name("name").text.decode("utf-8") - - valid_types = self._versioned_item_mapping[containing_name] - for _, match in obj_query.matches(class_node): - if "ident" not in match: - continue - - # Get the raw text of the match. This could be something like - # - PsList - # - pslist.PsList - # - pslist.PsList.list_processes - ident_text = match["ident"].text.decode("utf-8") - - # split the attributes - components = ident_text.split(".") - try: - # See if the first attribute is in the module namespace. - item = vars(self._module)[components[0]] - except KeyError: - # If it's not, it's likely a variable in a smaller scope and we - # can ignore it. - continue - - # If it's in the module namespace and is a module... - if isinstance(item, types.ModuleType): - try: - # We try getting attributes from it until we - # find one that is a versionable class - - # Ideally, we shouldn't have to look further than - # two levels - item = getattr(item, components[1]) - if not is_versionable(item): - item = getattr(item, components[2]) - if not is_versionable(item): - continue - - except (IndexError, AttributeError): - # we ran out of attributes to check - continue - - elif is_versionable(item): - # The versionable thing was at the top level. This - # goes against our preferred style, but is possible. - pass - else: - # This isn't something we care about. - continue - - if ( - item in valid_types - or item is clazz - or inspect.isabstract(item) - or item - is interfaces.configuration.VersionableInterface # Avoid checking the interface itself - ): - continue - - yield UnrequiredVersionableUsage( - item, - containing_name, - components[1] if len(components) > 1 else None, - match["ident"], - ) - - def find_class_nodes( - self, - ) -> Iterator[Tuple[Type[interfaces.configuration.ConfigurableInterface], Node]]: - """ - Yields an iterator of (classname, node) tuples, where the node is the subtree containing - the entire class definition. - """ - class_query = self.language.query("(class_definition) @classdef") - - matches = class_query.captures(self._tree.root_node) - for node, _ in matches: - classname = node.child_by_field_name("name").text.decode("utf-8") - if classname not in self._configurable_classes: - continue - - yield self._configurable_classes[classname], node - - def is_versionable(var): try: - return issubclass(var, interfaces.configuration.VersionableInterface) + return ( + issubclass(var, interfaces.configuration.VersionableInterface) + and var is not interfaces.configuration.VersionableInterface + and not inspect.isabstract(var) + ) except TypeError: return False @@ -196,48 +96,162 @@ def is_configurable(var): return False -def get_imported_modules( - plugin_module: types.ModuleType, -) -> List[Tuple[str, types.ModuleType]]: - return [ - (name, var) - for name, var in vars(plugin_module).items() - if isinstance(var, types.ModuleType) - ] +class ModuleVisitor(NodeVisitor): + def __init__(self, module: types.ModuleType) -> None: + self._module = module + self._scopes = [] + self._violations = [] + + @property + def violations(self): + return self._violations + + def enter_ClassDef(self, node: ast.ClassDef) -> Any: + logger.debug("Entering class %s", node.name) + clazz = None + try: + clazz = vars(self._module)[str(node.name)] + except KeyError: + logger.debug( + "Failed to get %s from module scope: (%s)", + node.name, + self._module.__name__, + ) + if self._scopes: + try: + logger.debug( + "Attempting to get class %s from scope of %s", + node.name, + self._scopes[-1].__name__, + ) + clazz = getattr(self._scopes[-1], node.name) + except AttributeError: + logger.debug( + "Class not found in scope of %s", self._scopes[-1].__name__ + ) + if clazz: + self._scopes.append(clazz) + + if clazz and is_configurable(clazz): + logger.info("Checking configurable class %s", clazz.__name__) + visitor = ConfigurableClassVisitor(self._module, clazz) + visitor.visit(node) + self._violations += visitor.violations + + self.generic_visit(node) + + def leave_ClassDef(self, node: ast.ClassDef): + logger.debug("Leaving class %s", node.name) + try: + scoped_class = next( + scope for scope in self._scopes if scope.__name__ == node.name + ) + self._scopes.remove(scoped_class) + except StopIteration: + logger.debug("%s not found in scope list", node.name) -def get_configurable_classes( - plugin_module: types.ModuleType, -) -> Dict[str, Type[interfaces.configuration.ConfigurableInterface]]: - return { - name: clazz - for name, clazz in vars(plugin_module).items() - if is_configurable(clazz) - } +class ConfigurableClassVisitor(NodeVisitor): + def __init__( + self, + module: types.ModuleType, + clazz: Optional[Type[interfaces.configuration.ConfigurableInterface]], + ) -> None: + self._module = module + self._current_object = None + self._clazz = clazz + self._seen = set() + self._violations = [] + @property + def versioned_classes(self): + return ( + [ + req._component + for req in self._clazz.get_requirements() + if isinstance(req, configuration.requirements.VersionRequirement) + ] + if self._clazz is not None + else [] + ) -def get_versioned_item_mapping( - configurable_classes: Dict[ - str, Type[interfaces.configuration.ConfigurableInterface] - ] -) -> Dict[str, List[Type[interfaces.configuration.VersionableInterface]]]: - return { - name: [ - req._component - for req in clazz.get_requirements() - if isinstance(req, configuration.requirements.VersionRequirement) - ] - for name, clazz in configurable_classes.items() - } + def check_item(self, item: Type, node: Union[ast.Name, ast.Attribute]): + if ( + is_versionable(item) + and self._clazz is not None + and item not in self.versioned_classes + and item is not self._clazz + and not issubclass(self._clazz, PluginRenameClass) + ): + logger.info( + "Found versionable item %s, checking against %s", + str(item), + str(self.versioned_classes), + ) + result = UnrequiredVersionableUsage( + item.__name__, self._clazz.__name__, node + ) + self._violations.append(result) + @property + def violations(self): + return self._violations -def get_versionable_import_mapping( - imported_modules: List[Tuple[str, types.ModuleType]] -) -> Dict[str, List[str]]: - return { - modname: [name for name, var in vars(module).items() if is_versionable(var)] - for modname, module in imported_modules - } + def visit_Name(self, node: ast.Name): + try: + logger.debug( + "Checking module %s for name %s", self._module.__name__, node.id + ) + item = vars(self._module)[str(node.id)] + logger.debug("Found %s in %s namespace", node.id, self._module.__name__) + except KeyError: + return + + self.check_item(item, node) + + def visit_Attribute( + self, node: ast.Attribute + ) -> Optional[UnrequiredVersionableUsage]: + if self._clazz is None: + self.generic_visit(node) + return + + if (node.lineno, node.col_offset) in self._seen: + return + + self._seen.add((node.lineno, node.col_offset)) + + stack = [] + root = node + while True: + stack.append(node.attr) + if isinstance(node.value, ast.Attribute): + node = node.value + elif isinstance(node.value, ast.Name): + stack.append(node.value.id) + break + else: + break + + current = None + logger.debug("Checking %s", ".".join(stack[::-1])) + for item in stack[::-1]: + try: + current = ( + vars(self._module)[item] + if current is None + else getattr(current, item) + ) + except (KeyError, AttributeError) as exc: + logger.debug( + "Failed to get attribute %s (%s)%s", + item, + exc.__class__.__name__, + (" on" + str(current)) if current is not None else "", + ) + break + + self.check_item(current, root) def report_missing_requirements() -> Iterator[Tuple[str, UnrequiredVersionableUsage]]: @@ -246,46 +260,60 @@ def report_missing_requirements() -> Iterator[Tuple[str, UnrequiredVersionableUs for _, module_name, _ in pkgutil.walk_packages( vol3.__path__, vol3.__name__ + ".", onerror=lambda _: None ): + modname = module_name.replace( + "volatility3.framework.plugins", "volatility3.plugins" + ) try: # import the module that we want to check - modname = module_name.replace( - "volatility3.framework.plugins", "volatility3.plugins" - ) plugin_module = importlib.import_module(modname) - except ImportError: + except ImportError as exc: + logger.warning("Failed to import %s: %s", modname, str(exc)) continue - except Exception: + except Exception as exc: + logger.warning( + "An unexpected exception occurred while importing %s: %s", + modname, + str(exc), + ) continue + logger.info("Checking module %s", plugin_module.__name__) if plugin_module.__file__ is None: + logger.warning("Plugin module %s has no source file", modname) continue try: - # construct a validator for the module - try: - validator = RequirementValidator(plugin_module) - except Exception: - traceback.print_stack() - continue - for clazz, node in validator.find_class_nodes(): - for item in validator.enumerate_unrequired_usages(clazz, node): - yield module_name, item - except Exception as exc: - traceback.print_exc() - print( - f"Failed to create validator for source code from {plugin_module.__file__}: {exc}" + with open(plugin_module.__file__, "rb") as f: + source = f.read() + except OSError: + logger.warning( + "Failed to read file contents for %s", plugin_module.__file__ + ) + continue + + try: + module_ast_root = ast.parse(source) + except (SyntaxError, ValueError) as exc: + logger.warning( + "Failed to parse source for %s: %s", plugin_module.__file__, str(exc) + ) + raise + + mod_visitor = ModuleVisitor(plugin_module) + mod_visitor.visit(module_ast_root) + + if mod_visitor.violations: + yield from ( + (plugin_module.__name__, res) for res in iter(mod_visitor.violations) ) - sys.exit(1) def perform_review(): found = 0 for mod, usage in report_missing_requirements(): found += 1 - print( - f"Violation in module {mod} (line {usage.node.start_point[0]}): {str(usage)}" - ) + print(f"Violation in module {mod} (line {usage.node.lineno}): {str(usage)}") if found: print( @@ -296,5 +324,19 @@ def perform_review(): print("All configurable classes passed validation!") +def parse_args() -> argparse.Namespace: + parser = argparse.ArgumentParser() + parser.add_argument("-v", "--verbose", action="count", dest="verbosity", default=0) + return parser.parse_args() + + if __name__ == "__main__": + args = parse_args() + if args.verbosity == 0: + logger.setLevel(logging.WARNING) + elif args.verbosity == 1: + logger.setLevel(logging.INFO) + elif args.verbosity > 1: + logger.setLevel(logging.DEBUG) + perform_review() From 03c647790206267ecf4c3d4921b2a0164ea4dcd1 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 13:04:24 -0500 Subject: [PATCH 0948/1352] Volshell: Attempt to resolve requirement conflicts This change sets the `script`, `script-only`, and `primary` requirements to only apply to the `generic.Volshell` class. `regex-scanner` is okay to be shared between the base and inherited classes, but `script` and `script-only` have to be generic-only in order to avoid conflicts when populating the argparse parser. `primary` must be generic-only in order to avoid ending up unsatisfied when superclass requirements require a module, suppressing construction of the `primary` layer. --- volatility3/cli/volshell/generic.py | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 1b3ae59d1..39e4fc963 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -54,20 +54,24 @@ class Volshell(interfaces.plugins.PluginInterface): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - reqs: List[interfaces.configuration.RequirementInterface] = [] + reqs: List[interfaces.configuration.RequirementInterface] = [ + requirements.VersionRequirement( + name="regex_scanner", + component=scanners.RegExScanner, + version=(1, 0, 0), + ), + ] if cls == Volshell: - reqs = [ + reqs += [ + requirements.TranslationLayerRequirement( + name="primary", description="Memory layer for the kernel" + ), requirements.URIRequirement( name="script", description="File to load and execute at start", default=None, optional=True, ), - requirements.VersionRequirement( - name="regex_scanner", - component=scanners.RegExScanner, - version=(1, 0, 0), - ), requirements.BooleanRequirement( name="script-only", description="Exit volshell after the script specified in --script completes", @@ -75,11 +79,8 @@ class Volshell(interfaces.plugins.PluginInterface): optional=True, ), ] - return reqs + [ - requirements.TranslationLayerRequirement( - name="primary", description="Memory layer for the kernel" - ), - ] + + return reqs def run( self, additional_locals: Dict[str, Any] = {} From 27e59263a6825886cb5d8f1524f2e8d48955b57f Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 13:17:38 -0500 Subject: [PATCH 0949/1352] Docstring: explain version-checking script This documents the general behavior and expectations of the version-checking CI script. --- test/check_configurable_requirements.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/test/check_configurable_requirements.py b/test/check_configurable_requirements.py index d532d98b3..f856c80b7 100644 --- a/test/check_configurable_requirements.py +++ b/test/check_configurable_requirements.py @@ -1,3 +1,19 @@ +""" +This script performs syntax analysis on the volatility3 source tree through a combination of AST analysis and import-time introspection of classes. + +The current checks it implements are: + 1. Ensure that classes derived from `ConfigurableInterface` properly + declare all `VersionableInterface` classes that they make use of in their + `get_requirements()` classmethod. + + :WARNING: a notable exception to this are classes defined within factory + functions. Because these classes are not created until the factory function + is called, they therefore do no exist at import time and cannot be checked + by this script. It is important to keep in mind during code review that + this is a best-effort check and does not make guarantees about the + completeness of declared requirements. +""" + import argparse import ast import importlib From d0a1daf82c1a118b1b33958e4cd6dec2243df248 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 13:24:51 -0500 Subject: [PATCH 0950/1352] ModuleExtract: Add missing requirement --- volatility3/framework/plugins/linux/module_extract.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/volatility3/framework/plugins/linux/module_extract.py b/volatility3/framework/plugins/linux/module_extract.py index d7c875523..97824aca0 100644 --- a/volatility3/framework/plugins/linux/module_extract.py +++ b/volatility3/framework/plugins/linux/module_extract.py @@ -36,6 +36,11 @@ class ModuleExtract(interfaces.plugins.PluginInterface): description="Base virtual address to reconstruct an ELF file", optional=False, ), + requirements.VersionRequirement( + name="linux_utilities_module_extract", + version=(1, 0, 0), + component=linux_utilities_module_extract.ModuleExtract, + ), ] def _generator(self): From e21eb57b9009dec3046ac1c9d5e2e4cf93b42b6c Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 18:40:51 +0000 Subject: [PATCH 0951/1352] Volshell: handle case where paged out member would cause backtrace for dt output. Thanks to @atcuno for the code! --- volatility3/cli/volshell/generic.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 3a5d514fe..c153d281d 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -446,8 +446,14 @@ class Volshell(interfaces.plugins.PluginInterface): len_offset = len(hex(relative_offset)) len_member = len(member) len_typename = len(member_type.vol.type_name) + if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data + try: + value = self._display_value(getattr(volobject, member)) + except exceptions.InvalidAddressException: + value = self._display_value(renderers.NotAvailableValue()) + print( " " * (longest_offset - len_offset), hex(relative_offset), @@ -458,7 +464,7 @@ class Volshell(interfaces.plugins.PluginInterface): member_type.vol.type_name, " " * (longest_typename - len_typename), " ", - self._display_value(getattr(volobject, member)), + value, ) else: print( @@ -473,7 +479,9 @@ class Volshell(interfaces.plugins.PluginInterface): @classmethod def _display_value(cls, value: Any) -> str: - if isinstance(value, objects.PrimitiveObject): + if isinstance(value, interfaces.renderers.BaseAbsentValue): + return "N/A" + elif isinstance(value, objects.PrimitiveObject): return repr(value) elif isinstance(value, objects.Array): return repr([cls._display_value(val) for val in value]) From 23f2157931df51ff79d02f7d34e39691451e240a Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 28 Mar 2025 18:50:10 +0000 Subject: [PATCH 0952/1352] Volshell: update display_type to handle struct members that are also python functions, e.g. write(). Thanks to @atcuno for the suggestion --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index c153d281d..a487fa3cd 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -450,7 +450,7 @@ class Volshell(interfaces.plugins.PluginInterface): if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data try: - value = self._display_value(getattr(volobject, member)) + value = self._display_value(volobject.member(member)) except exceptions.InvalidAddressException: value = self._display_value(renderers.NotAvailableValue()) From 196556eab3ed0abbffd20bcec169d2f131535426 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 15:18:22 -0500 Subject: [PATCH 0953/1352] Test: Allow for other types of coding style violations --- test/check_configurable_requirements.py | 51 +++++++++++++++---------- 1 file changed, 31 insertions(+), 20 deletions(-) diff --git a/test/check_configurable_requirements.py b/test/check_configurable_requirements.py index f856c80b7..89e06e751 100644 --- a/test/check_configurable_requirements.py +++ b/test/check_configurable_requirements.py @@ -14,6 +14,7 @@ The current checks it implements are: completeness of declared requirements. """ +import abc import argparse import ast import importlib @@ -22,7 +23,7 @@ import logging import pkgutil import sys import types -from typing import Any, Iterator, NamedTuple, Optional, Tuple, Type, Union +from typing import Any, Iterator, List, Optional, Tuple, Type, Union from volatility3.framework import configuration, interfaces from volatility3.framework.deprecation import PluginRenameClass @@ -70,27 +71,37 @@ class NodeVisitor: """Default leave behavior.""" -class UnrequiredVersionableUsage(NamedTuple): - versionable_item_class: str - """ - The name of the VersionableInterface class - """ +class CodeViolation(metaclass=abc.ABCMeta): + def __init__(self, module: types.ModuleType, node: ast.AST) -> None: + self.module = module + self.node = node - consuming_class: str - """ - The name of the class that is using the imported VersionableInterface class - """ + def __str__(self): + return f"Code violation in module {self.module.__name__}: line {self.node.lineno}, col {self.node.col_offset}" - node: Union[ast.Name, ast.Attribute] - """ - The tree-sitter node encapsulating the used module component. - """ + +class UnrequiredVersionableUsage(CodeViolation): + + def __init__( + self, + module: types.ModuleType, + node: ast.AST, + consuming_class: str, + versionable_item_class: str, + ) -> None: + super().__init__(module, node) + self.consuming_class = consuming_class + self.versionable_item_class = versionable_item_class def __str__(self) -> str: return ( - f"Found usage of {self.versionable_item_class} " - f"in class {self.consuming_class} that is not declared " - f"in {self.consuming_class}'s `get_requirements()` classmethod" + super().__str__() + + ": " + + ( + f"Found usage of {self.versionable_item_class} " + f"in class {self.consuming_class} that is not declared " + f"in {self.consuming_class}'s `get_requirements()` classmethod" + ) ) @@ -177,7 +188,7 @@ class ConfigurableClassVisitor(NodeVisitor): self._current_object = None self._clazz = clazz self._seen = set() - self._violations = [] + self._violations: List[CodeViolation] = [] @property def versioned_classes(self): @@ -205,7 +216,7 @@ class ConfigurableClassVisitor(NodeVisitor): str(self.versioned_classes), ) result = UnrequiredVersionableUsage( - item.__name__, self._clazz.__name__, node + self._module, node, self._clazz.__name__, item.__name__ ) self._violations.append(result) @@ -333,7 +344,7 @@ def perform_review(): if found: print( - f"Found {found} uses of versionable components not declared in get_requirements()" + f"Found {found} coding standards violations" ) sys.exit(1) From 46e3b8ffdb4e9c4b536e2a6fc8217f2be3d77c4c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 15:21:54 -0500 Subject: [PATCH 0954/1352] Check for 'hidden' attribute when determining classes to validate --- test/check_configurable_requirements.py | 1 + 1 file changed, 1 insertion(+) diff --git a/test/check_configurable_requirements.py b/test/check_configurable_requirements.py index 89e06e751..ce65aca48 100644 --- a/test/check_configurable_requirements.py +++ b/test/check_configurable_requirements.py @@ -111,6 +111,7 @@ def is_versionable(var): issubclass(var, interfaces.configuration.VersionableInterface) and var is not interfaces.configuration.VersionableInterface and not inspect.isabstract(var) + and not (hasattr(var, "hidden") and getattr(var, "hidden") is True) ) except TypeError: return False From d7695ab9cfb507b3bb3e791f00bcd082f5de3afc Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 15:36:54 -0500 Subject: [PATCH 0955/1352] Simplify error message output --- test/check_configurable_requirements.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/check_configurable_requirements.py b/test/check_configurable_requirements.py index ce65aca48..b643facb5 100644 --- a/test/check_configurable_requirements.py +++ b/test/check_configurable_requirements.py @@ -341,7 +341,7 @@ def perform_review(): found = 0 for mod, usage in report_missing_requirements(): found += 1 - print(f"Violation in module {mod} (line {usage.node.lineno}): {str(usage)}") + print(str(usage)) if found: print( From 6452fc18bd6cb614e8eaa747bc2d5be36a224e52 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 15:39:09 -0500 Subject: [PATCH 0956/1352] Tone down language severity in messages --- test/check_configurable_requirements.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/check_configurable_requirements.py b/test/check_configurable_requirements.py index b643facb5..864c3e89e 100644 --- a/test/check_configurable_requirements.py +++ b/test/check_configurable_requirements.py @@ -77,7 +77,7 @@ class CodeViolation(metaclass=abc.ABCMeta): self.node = node def __str__(self): - return f"Code violation in module {self.module.__name__}: line {self.node.lineno}, col {self.node.col_offset}" + return f"Issue in module {self.module.__name__}: line {self.node.lineno}, col {self.node.col_offset}" class UnrequiredVersionableUsage(CodeViolation): @@ -345,7 +345,7 @@ def perform_review(): if found: print( - f"Found {found} coding standards violations" + f"Found {found} issues" ) sys.exit(1) From 07f7a2e2be24e6e82c232228f4899c052fbb741f Mon Sep 17 00:00:00 2001 From: ikelos Date: Sat, 29 Mar 2025 12:48:47 +0000 Subject: [PATCH 0957/1352] Revert "Feature/use less memory" --- volatility3/framework/interfaces/objects.py | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 1bca7a045..62c31481b 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -8,7 +8,7 @@ import collections import collections.abc import contextlib import logging -from typing import Any, List, Mapping, Optional +from typing import Any, Dict, List, Mapping, Optional from volatility3.framework import constants, interfaces @@ -127,11 +127,8 @@ class ObjectInterface(metaclass=abc.ABCMeta): mask = context.layers[object_info.layer_name].address_mask normalized_offset = object_info.offset & mask - vol = kwargs vol_info_dict = {"type_name": type_name, "offset": normalized_offset} - vol.update(object_info) - vol.update(vol_info_dict) - self._vol = collections.ChainMap({}, vol) + self._vol = collections.ChainMap({}, vol_info_dict, object_info, kwargs) self._context = context def __getattr__(self, attr: str) -> Any: @@ -312,9 +309,10 @@ class Template: """Stores the keyword arguments for later object creation.""" # Allow the updating of template arguments whilst still in template form super().__init__() - vol = {"type_name": type_name} - vol.update(arguments) - self._vol = collections.ChainMap({}, vol) + empty_dict: Dict[str, Any] = {} + self._vol = collections.ChainMap( + empty_dict, arguments, {"type_name": type_name} + ) @property def vol(self) -> ReadOnlyMapping: From b73e4f0d2bc093d55879fac7387f30afa44920fe Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 29 Mar 2025 14:32:14 +0000 Subject: [PATCH 0958/1352] Don't completely remove the chainmap, but change one dict to a namedmapping --- volatility3/framework/contexts/__init__.py | 2 +- volatility3/framework/interfaces/objects.py | 47 +++++++-------------- volatility3/framework/objects/__init__.py | 5 ++- 3 files changed, 20 insertions(+), 34 deletions(-) diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index e7c423a10..a000fce90 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -130,7 +130,7 @@ class Context(interfaces.context.ContextInterface): object_info=interfaces.objects.ObjectInformation( layer_name=layer_name, offset=offset, - native_layer_name=native_layer_name, + native_layer_name=native_layer_name or layer_name, size=object_template.size, ), ) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 62c31481b..2d8024465 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -8,7 +8,7 @@ import collections import collections.abc import contextlib import logging -from typing import Any, Dict, List, Mapping, Optional +from typing import Any, Dict, List, Mapping, NamedTuple, Optional from volatility3.framework import constants, interfaces @@ -52,7 +52,7 @@ class ReadOnlyMapping(collections.abc.Mapping): return dict(self) == dict(other) -class ObjectInformation(ReadOnlyMapping): +class ObjectInformation(NamedTuple): """Contains common information useful/pertinent only to an individual object (like an instance) @@ -63,35 +63,20 @@ class ObjectInformation(ReadOnlyMapping): in a single place. These values are based on the :class:`ReadOnlyMapping` class, to prevent their modification. """ - def __init__( - self, - layer_name: str, - offset: int, - member_name: Optional[str] = None, - parent: Optional["ObjectInterface"] = None, - native_layer_name: Optional[str] = None, - size: Optional[int] = None, - ): - """Constructs a container for basic information about an object. + layer_name: str + offset: int + native_layer_name: str + member_name: Optional[str] = None + parent: Optional["ObjectInterface"] = None + size: Optional[int] = None - Args: - layer_name: Layer from which the data for the object will be read - offset: Offset within the layer at which the data for the object will be read - member_name: If the object was accessed as a member of a parent object, this was the name used to access it - parent: If the object was accessed as a member of a parent object, this is the parent object - native_layer_name: If this object references other objects (such as a pointer), what layer those objects live in - size: The size that the whole structure consumes in bytes - """ - super().__init__( - { - "layer_name": layer_name, - "offset": offset, - "member_name": member_name, - "parent": parent, - "native_layer_name": native_layer_name or layer_name, - "size": size, - } - ) + def __getitem__(self, key): + if key in self._fields: + return getattr(self, key) + raise KeyError(f"NamedTuple does not have a key {key}") + + def __contains__(self, key): + return key in self._fields class ObjectInterface(metaclass=abc.ABCMeta): @@ -183,7 +168,7 @@ class ObjectInterface(metaclass=abc.ABCMeta): offset=self.vol.offset, member_name=self.vol.member_name, parent=self.vol.parent, - native_layer_name=self.vol.native_layer_name, + native_layer_name=self.vol.native_layer_name or self.vol.layer_name, size=object_template.size, ) return object_template(context=self._context, object_info=object_info) diff --git a/volatility3/framework/objects/__init__.py b/volatility3/framework/objects/__init__.py index b863e103b..08d6cb31e 100644 --- a/volatility3/framework/objects/__init__.py +++ b/volatility3/framework/objects/__init__.py @@ -458,6 +458,7 @@ class Pointer(Integer): offset=offset, parent=self, size=self.vol.subtype.size, + native_layer_name=layer_name, ), ) return self._cache[layer_name] @@ -811,7 +812,7 @@ class Array(interfaces.objects.ObjectInterface, collections.abc.Sequence): layer_name=self.vol.layer_name, offset=mask & (self.vol.offset + (self.vol.subtype.size * index)), parent=self, - native_layer_name=self.vol.native_layer_name, + native_layer_name=self.vol.native_layer_name or self.vol.layer_name, size=self.vol.subtype.size, ) result += [self.vol.subtype(context=self._context, object_info=object_info)] @@ -978,7 +979,7 @@ class AggregateType(interfaces.objects.ObjectInterface): offset=mask & (self.vol.offset + relative_offset), member_name=attr, parent=self, - native_layer_name=self.vol.native_layer_name, + native_layer_name=self.vol.native_layer_name or self.vol.layer_name, size=template.size, ) member = template(context=self._context, object_info=object_info) From e62cee391a2af40d0c7aaa03cc6d7555c87bf149 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 16:52:43 -0500 Subject: [PATCH 0959/1352] Testing: Adds validation of vol3 imports in check script This checks `ast.ImportFrom` statements to see if anything other than modules are being imported in this way. It enumerates all instances of this and suggests a fix. --- test/check_configurable_requirements.py | 69 +++++++++++++++++++++++-- 1 file changed, 66 insertions(+), 3 deletions(-) diff --git a/test/check_configurable_requirements.py b/test/check_configurable_requirements.py index 864c3e89e..ee1a54ce2 100644 --- a/test/check_configurable_requirements.py +++ b/test/check_configurable_requirements.py @@ -22,6 +22,7 @@ import inspect import logging import pkgutil import sys +import traceback import types from typing import Any, Iterator, List, Optional, Tuple, Type, Union @@ -105,6 +106,36 @@ class UnrequiredVersionableUsage(CodeViolation): ) +class DirectVolatilityImportUsage(CodeViolation): + + def __init__( + self, + module: types.ModuleType, + node: ast.AST, + importing_module: str, + imported_item: object, + imported_name: str, + ) -> None: + self.imported_item = imported_item + self.imported_name = imported_name + self.importing_module = importing_module + super().__init__(module, node) + + def __str__(self) -> str: + components = self.importing_module.split(".") + return ( + super().__str__() + + ": " + + ( + f"Direct import of {self.imported_name} " + f"({type(self.imported_item)}) " + f"from module {self.importing_module} - " + "change to " + f"'from {'.'.join(components[:-1])} import {components[-1]} and using {components[-1]}.{self.imported_name}" + ) + ) + + def is_versionable(var): try: return ( @@ -134,6 +165,39 @@ class ModuleVisitor(NodeVisitor): def violations(self): return self._violations + def enter_ImportFrom(self, node: ast.ImportFrom): + if not node.module: + return + + if ( + node.module + and node.module.startswith("volatility3") + and node.module != "volatility3.framework.constants._version" # make an exception for this + ): + for name in node.names: + try: + item = vars(self._module)[ + name.asname if name.asname is not None else name.name + ] + except KeyError: + logger.debug( + "Couldn't find imported name %s in module %s", + name.asname or name.name, + self._module.__name__, + ) + continue + + if not (isinstance(item, types.ModuleType) or inspect.isfunction(item)): + self._violations.append( + DirectVolatilityImportUsage( + self._module, + node, + node.module, + item, + name.asname or name.name, + ) + ) + def enter_ClassDef(self, node: ast.ClassDef) -> Any: logger.debug("Entering class %s", node.name) clazz = None @@ -304,6 +368,7 @@ def report_missing_requirements() -> Iterator[Tuple[str, UnrequiredVersionableUs modname, str(exc), ) + traceback.print_exc() continue logger.info("Checking module %s", plugin_module.__name__) @@ -344,9 +409,7 @@ def perform_review(): print(str(usage)) if found: - print( - f"Found {found} issues" - ) + print(f"Found {found} issues") sys.exit(1) print("All configurable classes passed validation!") From 47646c12d431707c2fb148a637289d79840998fa Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 16:53:55 -0500 Subject: [PATCH 0960/1352] Framework: Fix all direct non-module imports This fixes all import from statements in the codebase that were importing things other than modules into module namespaces from other volatility3 modules. This should prevent accidental re-exporting. --- volatility3/framework/exceptions.py | 5 +- .../framework/interfaces/configuration.py | 5 +- volatility3/framework/interfaces/symbols.py | 3 +- volatility3/framework/layers/elf.py | 4 +- volatility3/framework/layers/intel.py | 16 +++--- volatility3/framework/layers/registry.py | 11 ++-- volatility3/framework/layers/xen.py | 4 +- volatility3/framework/plugins/linux/bash.py | 4 +- volatility3/framework/plugins/linux/elfs.py | 4 +- .../framework/plugins/linux/modxview.py | 10 ++-- .../framework/plugins/linux/sockstat.py | 23 ++++---- .../framework/plugins/linux/tracing/ftrace.py | 14 ++--- .../plugins/linux/tracing/tracepoints.py | 18 +++---- volatility3/framework/plugins/mac/bash.py | 4 +- .../framework/plugins/windows/dumpfiles.py | 13 +++-- volatility3/framework/plugins/windows/info.py | 9 ++-- .../framework/plugins/windows/pe_symbols.py | 4 +- .../framework/plugins/windows/psxview.py | 6 +-- .../plugins/windows/registry/hashdump.py | 28 +++++----- .../plugins/windows/registry/lsadump.py | 23 ++++---- .../plugins/windows/registry/printkey.py | 53 ++++++++++--------- .../windows/registry/scheduled_tasks.py | 2 +- .../plugins/windows/registry/userassist.py | 17 +++--- .../framework/plugins/windows/truecrypt.py | 29 +++++----- .../framework/symbols/linux/network.py | 4 +- .../symbols/windows/extensions/__init__.py | 7 +-- .../symbols/windows/extensions/network.py | 8 ++- .../symbols/windows/extensions/pool.py | 4 +- .../symbols/windows/extensions/registry.py | 38 +++++++------ .../symbols/windows/extensions/services.py | 4 +- .../framework/symbols/windows/pdbutil.py | 3 +- .../plugins/windows/registry/certificates.py | 3 +- 32 files changed, 190 insertions(+), 190 deletions(-) diff --git a/volatility3/framework/exceptions.py b/volatility3/framework/exceptions.py index a3d660444..34b41727a 100644 --- a/volatility3/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -11,7 +11,6 @@ size of the invalid page. from typing import Callable, Dict, Optional, Tuple from volatility3.framework import interfaces -from volatility3.framework.interfaces.configuration import VersionableInterface class VolatilityException(Exception): @@ -143,7 +142,7 @@ class VersionMismatchException(VolatilityException): def __init__( self, source_component: Callable, - target_component: VersionableInterface, + target_component: interfaces.configuration.VersionableInterface, target_version: Tuple[int, int, int], failure_reason: str = None, *args, @@ -151,7 +150,7 @@ class VersionMismatchException(VolatilityException): """ Args: source_component: The component that required the target component - target_component: The component that is required. Must inherit from VersionableInterface + target_component: The component that is required. Must inherit from interfaces.configuration.VersionableInterface target_version: The version of the target component that was required, and ultimately was not satisfied failure_reason: A detailed failure reason to enhance debugging and bug tracking """ diff --git a/volatility3/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py index b6f4f889c..33d15d05e 100644 --- a/volatility3/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -37,7 +37,8 @@ from typing import ( Set, ) -from volatility3 import classproperty, framework +import volatility3 +from volatility3 import framework from volatility3.framework import constants, interfaces CONFIG_SEPARATOR = "." @@ -805,7 +806,7 @@ class VersionableInterface: framework.require_interface_version(*self._required_framework_version) super().__init__(*args, **kwargs) - @classproperty + @volatility3.classproperty def version(cls) -> Tuple[int, int, int]: """The version of the current interface (classmethods available on the component). diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index 2d142de9a..925be72c9 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -10,7 +10,6 @@ from typing import Any, Dict, Iterable, List, Mapping, Optional, Tuple, Type from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import configuration, objects -from volatility3.framework.interfaces.configuration import RequirementInterface class SymbolInterface: @@ -347,7 +346,7 @@ class SymbolTableInterface( return config @classmethod - def get_requirements(cls) -> List[RequirementInterface]: + def get_requirements(cls) -> List[configuration.RequirementInterface]: return super().get_requirements() + [ requirements.IntRequirement( name="symbol_mask", diff --git a/volatility3/framework/layers/elf.py b/volatility3/framework/layers/elf.py index 81f3c3634..5777981cb 100644 --- a/volatility3/framework/layers/elf.py +++ b/volatility3/framework/layers/elf.py @@ -6,7 +6,7 @@ import struct from typing import Optional from volatility3.framework import exceptions, interfaces, constants -from volatility3.framework.constants.linux import ELF_CLASS +from volatility3.framework.constants import linux as linux_constants from volatility3.framework.layers import segmented from volatility3.framework.symbols import intermed @@ -23,7 +23,7 @@ class Elf64Layer(segmented.SegmentedLayer): _header_struct = struct.Struct(" int: """Page shift for the intel memory layers.""" return cls._page_size_in_bits - @classproperty + @volatility3.classproperty @functools.lru_cache def page_size(cls) -> int: """Page size for the intel memory layers. @@ -90,30 +90,30 @@ class Intel(linear.LinearlyMappedLayer): """ return 1 << cls._page_size_in_bits - @classproperty + @volatility3.classproperty @functools.lru_cache def page_mask(cls) -> int: """Page mask for the intel memory layers.""" return ~(cls.page_size - 1) - @classproperty + @volatility3.classproperty @functools.lru_cache def bits_per_register(cls) -> int: """Returns the bits_per_register to determine the range of an IntelTranslationLayer.""" return cls._bits_per_register - @classproperty + @volatility3.classproperty @functools.lru_cache def minimum_address(cls) -> int: return 0 - @classproperty + @volatility3.classproperty @functools.lru_cache def maximum_address(cls) -> int: return (1 << cls._maxvirtaddr) - 1 - @classproperty + @volatility3.classproperty def structure(cls) -> List[Tuple[str, int, bool]]: return cls._structure diff --git a/volatility3/framework/layers/registry.py b/volatility3/framework/layers/registry.py index f324e24a0..e8b1246d3 100644 --- a/volatility3/framework/layers/registry.py +++ b/volatility3/framework/layers/registry.py @@ -7,11 +7,6 @@ from typing import Any, Callable, Dict, Iterable, List, Optional, Tuple, Union from volatility3.framework import constants, exceptions, interfaces, objects from volatility3.framework.configuration import requirements -from volatility3.framework.configuration.requirements import ( - IntRequirement, - TranslationLayerRequirement, -) -from volatility3.framework.exceptions import InvalidAddressException from volatility3.framework.layers import linear from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import extensions @@ -154,7 +149,7 @@ class RegistryHive(linear.LinearlyMappedLayer): @property def root_cell_offset(self) -> int: """Returns the offset for the root cell in this hive.""" - with contextlib.suppress(InvalidAddressException): + with contextlib.suppress(exceptions.InvalidAddressException): if ( self._base_block.Signature.cast( "string", max_length=4, encoding="latin-1" @@ -271,7 +266,7 @@ class RegistryHive(linear.LinearlyMappedLayer): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - IntRequirement( + requirements.IntRequirement( name="hive_offset", description="Offset within the base layer at which the hive lives", default=0, @@ -280,7 +275,7 @@ class RegistryHive(linear.LinearlyMappedLayer): requirements.SymbolTableRequirement( name="nt_symbols", description="Windows kernel symbols" ), - TranslationLayerRequirement( + requirements.TranslationLayerRequirement( name="base_layer", description="Layer in which the registry hive lives", optional=False, diff --git a/volatility3/framework/layers/xen.py b/volatility3/framework/layers/xen.py index c0a5e1a7d..7f42eb662 100644 --- a/volatility3/framework/layers/xen.py +++ b/volatility3/framework/layers/xen.py @@ -5,7 +5,7 @@ from typing import Optional from volatility3.framework import constants, interfaces, exceptions from volatility3.framework.layers import elf from volatility3.framework.symbols import intermed -from volatility3.framework.constants.linux import ELF_CLASS +from volatility3.framework.constants import linux as linux_constants vollog = logging.getLogger(__name__) @@ -15,7 +15,7 @@ class XenCoreDumpLayer(elf.Elf64Layer): _header_struct = struct.Struct(" ELF_MAX_EXTRACTION_SIZE: + if real_size < 0 or real_size > linux_constants.ELF_MAX_EXTRACTION_SIZE: raise ValueError(f"The claimed size of the ELF is invalid: {real_size}") sections[start] = real_size diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index ed21acfd1..c1707d26f 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -6,9 +6,9 @@ from typing import List, Dict, Iterator import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, deprecation +from volatility3.framework import interfaces, deprecation, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue +from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.linux import extensions from volatility3.framework.constants import architectures from volatility3.framework.symbols.linux.utilities import tainting @@ -156,12 +156,12 @@ spot modules presence and taints.""" yield ( 0, ( - module.get_name() or NotAvailableValue(), + module.get_name() or renderers.NotAvailableValue(), format_hints.Hex(module_offset), linux_utilities_modules.ModuleGathererLsmod.name in gatherers, linux_utilities_modules.ModuleGathererSysFs.name in gatherers, linux_utilities_modules.ModuleGathererScanner.name in gatherers, - taints or NotAvailableValue(), + taints or renderers.NotAvailableValue(), ), ) @@ -175,7 +175,7 @@ spot modules presence and taints.""" ("Taints", str), ] - return TreeGrid( + return renderers.TreeGrid( columns, self._generator(), ) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index da5d8cb8c..a6acf825b 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -5,8 +5,8 @@ import logging from typing import Callable, Tuple, List, Dict -from volatility3.framework import interfaces, exceptions, constants, objects -from volatility3.framework.renderers import TreeGrid, NotAvailableValue, format_hints +from volatility3.framework import interfaces, exceptions, constants, objects, renderers +from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -44,7 +44,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): try: netns_id = task.nsproxy.net_ns.get_inode() except AttributeError: - netns_id = NotAvailableValue() + netns_id = renderers.NotAvailableValue() self._netdevices = self._build_network_devices_map(netns_id) @@ -79,7 +79,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): ) for net_dev in net.dev_base_head.to_list(net_device_symname, "dev_list"): if ( - isinstance(netns_id, NotAvailableValue) + isinstance(netns_id, renderers.NotAvailableValue) or net.get_inode() != netns_id ): continue @@ -263,7 +263,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): # Kernel >= 3.7.10 src_port = netlink_sock.get_portid() except AttributeError: - src_port = NotAvailableValue() + src_port = renderers.NotAvailableValue() dst_addr = f"group:0x{netlink_sock.dst_group:08x}" module = netlink_sock.module @@ -273,7 +273,7 @@ class SockHandlers(interfaces.configuration.VersionableInterface): try: dst_port = netlink_sock.get_dst_portid() except AttributeError: - dst_port = NotAvailableValue() + dst_port = renderers.NotAvailableValue() state = netlink_sock.get_state() @@ -571,7 +571,7 @@ class Sockstat(plugins.PluginInterface): try: netns_id = net.get_inode() except AttributeError: - netns_id = NotAvailableValue() + netns_id = renderers.NotAvailableValue() yield task, netns_id, fd_num, family, sock_type, protocol, sock_fields @@ -586,10 +586,11 @@ class Sockstat(plugins.PluginInterface): `sock_stat` and `protocol` formatted. """ sock_stat = [ - NotAvailableValue() if field is None else str(field) for field in sock_stat + renderers.NotAvailableValue() if field is None else str(field) + for field in sock_stat ] if protocol is None: - protocol = NotAvailableValue() + protocol = renderers.NotAvailableValue() return tuple(sock_stat), protocol @@ -641,7 +642,7 @@ class Sockstat(plugins.PluginInterface): socket_filter_str = ( ",".join(f"{k}={v}" for k, v in extended.items()) if extended - else NotAvailableValue() + else renderers.NotAvailableValue() ) task_comm = utility.array_to_string(task.comm) @@ -685,6 +686,6 @@ class Sockstat(plugins.PluginInterface): ("Filter", str), ] - return TreeGrid( + return renderers.TreeGrid( tree_grid_args, self._generator(pids, netns_id, kernel_module_name) ) diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index c5e4f9ef8..afcc71784 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -10,9 +10,9 @@ from enum import Enum from dataclasses import dataclass import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, TreeGrid, NotAvailableValue +from volatility3.framework.renderers import format_hints from volatility3.framework.constants import architectures vollog = logging.getLogger(__name__) @@ -239,14 +239,14 @@ class CheckFtrace(interfaces.plugins.PluginInterface): ): formatted_results = ( format_hints.Hex(ftrace_ops_parsed.ftrace_ops_offset), - ftrace_ops_parsed.callback_symbol or NotAvailableValue(), + ftrace_ops_parsed.callback_symbol or renderers.NotAvailableValue(), format_hints.Hex(ftrace_ops_parsed.callback_address), - ftrace_ops_parsed.hooked_symbols or NotAvailableValue(), - ftrace_ops_parsed.module_name or NotAvailableValue(), + ftrace_ops_parsed.hooked_symbols or renderers.NotAvailableValue(), + ftrace_ops_parsed.module_name or renderers.NotAvailableValue(), ( format_hints.Hex(ftrace_ops_parsed.module_address) if ftrace_ops_parsed.module_address is not None - else NotAvailableValue() + else renderers.NotAvailableValue() ), ) if self.config["show_ftrace_flags"]: @@ -266,7 +266,7 @@ class CheckFtrace(interfaces.plugins.PluginInterface): if self.config.get("show_ftrace_flags"): columns.append(("Flags", str)) - return TreeGrid( + return renderers.TreeGrid( columns, self._generator(), ) diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 9d4a4a2e3..25c87b664 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -5,15 +5,15 @@ # Public researches: https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Fixing-A-Memory-Forensics-Blind-Spot-Linux-Kernel-Tracing-wp.pdf import logging -from typing import Iterable, List, Optional from dataclasses import dataclass +from typing import Iterable, List, Optional import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, NotAvailableValue, TreeGrid -from volatility3.framework.objects import utility from volatility3.framework.constants import architectures +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -250,14 +250,14 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): formatted_results = ( tracepoint_parsed.tracepoint_name, format_hints.Hex(tracepoint_parsed.tracepoint_address), - tracepoint_parsed.probe_name or NotAvailableValue(), + tracepoint_parsed.probe_name or renderers.NotAvailableValue(), format_hints.Hex(tracepoint_parsed.probe_address), - tracepoint_parsed.probe_priority or NotAvailableValue(), - tracepoint_parsed.module_name or NotAvailableValue(), + tracepoint_parsed.probe_priority or renderers.NotAvailableValue(), + tracepoint_parsed.module_name or renderers.NotAvailableValue(), ( format_hints.Hex(tracepoint_parsed.module_address) if tracepoint_parsed.module_address is not None - else NotAvailableValue() + else renderers.NotAvailableValue() ), ) yield ( @@ -276,7 +276,7 @@ class CheckTracepoints(interfaces.plugins.PluginInterface): ("Module address", format_hints.Hex), ] - return TreeGrid( + return renderers.TreeGrid( columns, self._generator(), ) diff --git a/volatility3/framework/plugins/mac/bash.py b/volatility3/framework/plugins/mac/bash.py index 5ad6facd0..ac10d4f4a 100644 --- a/volatility3/framework/plugins/mac/bash.py +++ b/volatility3/framework/plugins/mac/bash.py @@ -12,7 +12,7 @@ from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.layers import scanners from volatility3.framework.objects import utility -from volatility3.framework.symbols.linux.bash import BashIntermedSymbols +from volatility3.framework.symbols.linux import bash from volatility3.plugins import timeliner from volatility3.plugins.mac import pslist @@ -68,7 +68,7 @@ class Bash(plugins.PluginInterface, timeliner.TimeLinerInterface): pack_format = "Q" bash_json_file = "bash64" - bash_table_name = BashIntermedSymbols.create( + bash_table_name = bash.BashIntermedSymbols.create( self.context, self.config_path, "linux", bash_json_file ) diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index e0adad2b1..e23b8ec3a 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -7,9 +7,14 @@ import ntpath import re from typing import List, Tuple, Type, Optional, Generator -from volatility3.framework import interfaces, renderers, exceptions, constants +from volatility3.framework import ( + interfaces, + exceptions, + constants, + renderers, +) from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints, UnreadableValue +from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import handles from volatility3.plugins.windows import pslist @@ -258,7 +263,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): if file_re: name = file_obj.file_name_with_device() - if isinstance(name, UnreadableValue): + if isinstance(name, renderers.UnreadableValue): continue if not file_re.search(name): continue @@ -298,7 +303,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): if file_re: name = file_obj.file_name_with_device() - if isinstance(name, UnreadableValue): + if isinstance(name, renderers.UnreadableValue): continue if not file_re.search(name): continue diff --git a/volatility3/framework/plugins/windows/info.py b/volatility3/framework/plugins/windows/info.py index a2e438c3f..3ff224c68 100644 --- a/volatility3/framework/plugins/windows/info.py +++ b/volatility3/framework/plugins/windows/info.py @@ -3,12 +3,11 @@ # import time -from typing import List, Tuple, Iterable +from typing import Iterable, List, Tuple -from volatility3.framework import constants, interfaces, layers, symbols +from volatility3.framework import constants, interfaces, layers, renderers, symbols from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins -from volatility3.framework.renderers import TreeGrid from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import kdbg, pe @@ -294,4 +293,6 @@ class Info(plugins.PluginInterface): ) def run(self): - return TreeGrid([("Variable", str), ("Value", str)], self._generator()) + return renderers.TreeGrid( + [("Variable", str), ("Value", str)], self._generator() + ) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 3a08a1002..e3af0c28a 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -17,7 +17,7 @@ from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import pdbutil from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins.windows import pslist, modules -from volatility3.framework.constants.windows import KERNEL_MODULE_NAMES +from volatility3.framework.constants import windows vollog = logging.getLogger(__name__) @@ -533,7 +533,7 @@ class PESymbols(interfaces.plugins.PluginInterface): # a `ntoskrnl.exe` can have an internal PDB name of any of the ones in the following list # The code attempts to find all possible PDBs to ensure the best chance of recovery if mod_name == PESymbols.os_module_name: - pdb_names = [fn + ".pdb" for fn in KERNEL_MODULE_NAMES] + pdb_names = [fn + ".pdb" for fn in windows.KERNEL_MODULE_NAMES] # for non-kernel files, replace the exe, sys, or dll extension with pdb else: diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 7c3444f70..142987c3e 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -4,10 +4,10 @@ import string from itertools import chain from typing import Dict, Iterable, List -from volatility3.framework import constants, exceptions +from volatility3.framework import constants, exceptions, renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins -from volatility3.framework.renderers import TreeGrid, format_hints +from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.windows import extensions from volatility3.plugins.windows import ( handles, @@ -231,7 +231,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter offset_type = "(Physical)" if self.config["physical-offsets"] else "(Virtual)" offset_str = "Offset" + offset_type - return TreeGrid( + return renderers.TreeGrid( [ (offset_str, format_hints.Hex), ("Name", str), diff --git a/volatility3/framework/plugins/windows/registry/hashdump.py b/volatility3/framework/plugins/windows/registry/hashdump.py index 630aa1cfd..1883d4530 100644 --- a/volatility3/framework/plugins/windows/registry/hashdump.py +++ b/volatility3/framework/plugins/windows/registry/hashdump.py @@ -11,8 +11,7 @@ from Crypto.Cipher import AES, ARC4, DES from volatility3.framework import interfaces, renderers, exceptions, constants from volatility3.framework.configuration import requirements -from volatility3.framework.exceptions import InvalidAddressException -from volatility3.framework.layers import registry as registrylayer +from volatility3.framework.layers import registry as registry_layer from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist @@ -329,13 +328,13 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_hive_key( - cls, hive: registry.RegistryHive, key: str + cls, hive: registry_layer.RegistryHive, key: str ) -> Optional["registry.CM_KEY_NODE"]: result = None try: if hive: result = hive.get_key(key) - except (KeyError, registrylayer.RegistryException): + except (KeyError, registry_layer.RegistryException): vollog.info( f"Unable to load the required registry key {hive.get_name()}\\{key} from this memory image" ) @@ -343,7 +342,7 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_user_keys( - cls, samhive: registry.RegistryHive + cls, samhive: registry_layer.RegistryHive ) -> List[interfaces.objects.ObjectInterface]: user_key_path = "SAM\\Domains\\Account\\Users" @@ -354,7 +353,7 @@ class Hashdump(interfaces.plugins.PluginInterface): return [k for k in user_key.get_subkeys() if k.Name != "Names"] @classmethod - def get_bootkey(cls, syshive: registry.RegistryHive) -> Optional[bytes]: + def get_bootkey(cls, syshive: registry_layer.RegistryHive) -> Optional[bytes]: """ Returns the scrambled bootkey necesary to decrypt hashes """ @@ -382,8 +381,8 @@ class Hashdump(interfaces.plugins.PluginInterface): return None bootkey += class_data.decode("utf-16-le") except ( - InvalidAddressException, - registrylayer.RegistryException, + exceptions.InvalidAddressException, + registry_layer.RegistryException, ) as excp: vollog.log( constants.LOGLEVEL_VVV, f"Unable to read Lsa key {lk}: {excp}" @@ -398,7 +397,7 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_hbootkey( - cls, samhive: registry.RegistryHive, bootkey: bytes + cls, samhive: registry_layer.RegistryHive, bootkey: bytes ) -> Optional[bytes]: sam_account_path = "SAM\\Domains\\Account" @@ -456,7 +455,10 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_user_hashes( - cls, user: registry.CM_KEY_NODE, samhive: registry.RegistryHive, hbootkey: bytes + cls, + user: registry.CM_KEY_NODE, + samhive: registry_layer.RegistryHive, + hbootkey: bytes, ) -> Optional[Tuple[bytes, bytes]]: ## Will sometimes find extra user with rid = NAMES, returns empty strings right now try: @@ -470,7 +472,7 @@ class Hashdump(interfaces.plugins.PluginInterface): sam_data = samhive.read(v.Data + 4, v.DataLength) except ( exceptions.InvalidAddressException, - registrylayer.RegistryException, + registry_layer.RegistryException, ): return None @@ -570,7 +572,7 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_user_name( - cls, user: registry.CM_KEY_NODE, samhive: registry.RegistryHive + cls, user: registry.CM_KEY_NODE, samhive: registry_layer.RegistryHive ) -> Optional[bytes]: value = None for v in user.get_values(): @@ -593,7 +595,7 @@ class Hashdump(interfaces.plugins.PluginInterface): # replaces the dump_hashes method in vol2 def _generator( - self, syshive: registry.RegistryHive, samhive: registry.RegistryHive + self, syshive: registry_layer.RegistryHive, samhive: registry_layer.RegistryHive ): if syshive is None: vollog.debug("SYSTEM address is None: No system hive found") diff --git a/volatility3/framework/plugins/windows/registry/lsadump.py b/volatility3/framework/plugins/windows/registry/lsadump.py index 2154923ec..e394822d6 100644 --- a/volatility3/framework/plugins/windows/registry/lsadump.py +++ b/volatility3/framework/plugins/windows/registry/lsadump.py @@ -10,9 +10,8 @@ from Crypto.Cipher import ARC4, DES, AES from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements -from volatility3.framework.exceptions import InvalidAddressException -from volatility3.framework.layers import registry +from volatility3.framework.layers import registry as registry_layers from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows.registry import hashdump, hivelist from volatility3.framework.renderers import format_hints @@ -65,7 +64,7 @@ class Lsadump(interfaces.plugins.PluginInterface): @classmethod def get_lsa_key( - cls, sechive: registry.RegistryHive, bootkey: bytes, vista_or_later: bool + cls, sechive: registry_layers.RegistryHive, bootkey: bytes, vista_or_later: bool ) -> Optional[bytes]: if not bootkey: return None @@ -109,7 +108,7 @@ class Lsadump(interfaces.plugins.PluginInterface): @classmethod def get_secret_by_name( cls, - sechive: registry.RegistryHive, + sechive: registry_layers.RegistryHive, name: str, lsakey: bytes, is_vista_or_later: bool, @@ -123,8 +122,8 @@ class Lsadump(interfaces.plugins.PluginInterface): try: enc_secret_value = next(enc_secret_key.get_values(), None) except ( - InvalidAddressException, - registry.RegistryException, + exceptions.InvalidAddressException, + registry_layers.RegistryException, ): enc_secret_value = None @@ -171,7 +170,9 @@ class Lsadump(interfaces.plugins.PluginInterface): return decrypted_data[8 : 8 + dec_data_len] def _generator( - self, syshive: registry.RegistryHive, sechive: registry.RegistryHive + self, + syshive: registry_layers.RegistryHive, + sechive: registry_layers.RegistryHive, ): kernel = self.context.modules[self.config["kernel"]] @@ -206,8 +207,8 @@ class Lsadump(interfaces.plugins.PluginInterface): enc_secret_value = next(sec_val_key.get_values(), None) except ( StopIteration, - InvalidAddressException, - registry.RegistryException, + exceptions.InvalidAddressException, + registry_layers.RegistryException, ): enc_secret_value = None @@ -229,8 +230,8 @@ class Lsadump(interfaces.plugins.PluginInterface): try: key_name = key.get_name() except ( - InvalidAddressException, - registry.RegistryException, + exceptions.InvalidAddressException, + registry_layers.RegistryException, ): key_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/registry/printkey.py b/volatility3/framework/plugins/windows/registry/printkey.py index 6ca56b1bb..ab9a0392d 100644 --- a/volatility3/framework/plugins/windows/registry/printkey.py +++ b/volatility3/framework/plugins/windows/registry/printkey.py @@ -4,18 +4,13 @@ import datetime import logging -from typing import List, Optional, Sequence, Iterable, Tuple, Union +from typing import Iterable, List, Optional, Sequence, Tuple, Union -from volatility3.framework import objects, renderers, exceptions, interfaces, constants +from volatility3.framework import constants, exceptions, interfaces, objects, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.layers.registry import ( - RegistryHive, - RegistryFormatException, - InvalidAddressException, - RegistryException, -) -from volatility3.framework.renderers import TreeGrid, conversion, format_hints -from volatility3.framework.symbols.windows.extensions.registry import RegValueTypes +from volatility3.framework.layers import registry as registry_layer +from volatility3.framework.renderers import conversion, format_hints +from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist vollog = logging.getLogger(__name__) @@ -55,7 +50,7 @@ class PrintKey(interfaces.plugins.PluginInterface): @classmethod def key_iterator( cls, - hive: RegistryHive, + hive: registry_layer.RegistryHive, node_path: Optional[Sequence[objects.StructType]] = None, recurse: bool = False, ) -> Iterable[ @@ -87,14 +82,14 @@ class PrintKey(interfaces.plugins.PluginInterface): try: key_path_names.append(k.get_name()) except ( - InvalidAddressException, - RegistryException, + registry_layer.InvalidAddressException, + registry_layer.RegistryException, ): key_path_names.append("-") key_path = "\\".join([k for k in key_path_names]) if node.vol.type_name.endswith(constants.BANG + "_CELL_DATA"): - raise RegistryFormatException( + raise registry_layer.RegistryFormatException( hive.name, "Encountered _CELL_DATA instead of _CM_KEY_NODE" ) last_write_time = conversion.wintime_to_datetime(node.LastWriteTime.QuadPart) @@ -116,7 +111,7 @@ class PrintKey(interfaces.plugins.PluginInterface): key_node.get_name() except ( exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) continue @@ -138,7 +133,7 @@ class PrintKey(interfaces.plugins.PluginInterface): def _printkey_iterator( self, - hive: RegistryHive, + hive: registry_layer.RegistryHive, node_path: Optional[Sequence[objects.StructType]] = None, recurse: bool = False, ): @@ -166,7 +161,7 @@ class PrintKey(interfaces.plugins.PluginInterface): key_node_name = node.get_name() except ( exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) key_node_name = renderers.UnreadableValue() @@ -193,16 +188,16 @@ class PrintKey(interfaces.plugins.PluginInterface): value_node_name = node.get_name() or "(Default)" except ( exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) value_node_name = renderers.UnreadableValue() try: - value_type = RegValueTypes(node.Type).name + value_type = registry.RegValueTypes(node.Type).name except ( exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) value_type = renderers.UnreadableValue() @@ -222,11 +217,17 @@ class PrintKey(interfaces.plugins.PluginInterface): value_data = format_hints.MultiTypeData( value_data, encoding="utf-8" ) - elif RegValueTypes(node.Type) == RegValueTypes.REG_BINARY: + elif ( + registry.RegValueTypes(node.Type) + == registry.RegValueTypes.REG_BINARY + ): value_data = format_hints.MultiTypeData( value_data, show_hex=True ) - elif RegValueTypes(node.Type) == RegValueTypes.REG_MULTI_SZ: + elif ( + registry.RegValueTypes(node.Type) + == registry.RegValueTypes.REG_MULTI_SZ + ): value_data = format_hints.MultiTypeData( value_data, encoding="utf-16-le", split_nulls=True ) @@ -237,7 +238,7 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( ValueError, exceptions.InvalidAddressException, - RegistryException, + registry_layer.RegistryException, ) as excp: vollog.debug(excp) value_data = renderers.UnreadableValue() @@ -279,13 +280,13 @@ class PrintKey(interfaces.plugins.PluginInterface): except ( exceptions.InvalidAddressException, KeyError, - RegistryException, + registry_layer.RegistryException, ) as excp: if isinstance(excp, KeyError): vollog.debug( f"Key '{key}' not found in Hive at offset {hex(hive.hive_offset)}." ) - elif isinstance(excp, RegistryException): + elif isinstance(excp, registry_layer.RegistryException): vollog.debug(excp) elif isinstance(excp, exceptions.InvalidAddressException): vollog.debug( @@ -308,7 +309,7 @@ class PrintKey(interfaces.plugins.PluginInterface): def run(self): offset = self.config.get("offset", None) - return TreeGrid( + return renderers.TreeGrid( columns=[ ("Last Write Time", datetime.datetime), ("Hive Offset", format_hints.Hex), diff --git a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py index 09ebed7b9..a2789e5df 100644 --- a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py @@ -1216,7 +1216,7 @@ class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInte @classmethod def _get_task_keys( - cls, software_hive: reg_extensions.RegistryHive + cls, software_hive: registry.RegistryHive ) -> Tuple[ Optional[reg_extensions.CM_KEY_NODE], Optional[reg_extensions.CM_KEY_NODE] ]: diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 809d0b2b3..3272b241c 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -12,11 +12,8 @@ from typing import Any, Generator, List, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.layers.physical import BufferDataLayer -from volatility3.framework.layers.registry import ( - RegistryHive, - RegistryException, -) +from volatility3.framework.layers import physical +from volatility3.framework.layers import registry as registry_layers from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed from volatility3.plugins.windows.registry import hivelist @@ -94,7 +91,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac return item userassist_layer_name = self.context.layers.free_layer_name("userassist_buffer") - buffer = BufferDataLayer( + buffer = physical.BufferDataLayer( self.context, self._config_path, userassist_layer_name, userassist_data ) self.context.add_layer(buffer) @@ -158,7 +155,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac ).has_member("CookiePad") def list_userassist( - self, hive: RegistryHive + self, hive: registry_layers.RegistryHive ) -> Generator[Tuple[int, Tuple], None, None]: """Generate userassist data for a registry hive.""" @@ -180,7 +177,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac "software\\microsoft\\windows\\currentversion\\explorer\\userassist", return_list=True, ) - except RegistryException as e: + except registry_layers.RegistryException as e: vollog.warning( f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}: {e}" ) @@ -250,7 +247,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac subkey_name = subkey.get_name() except ( exceptions.InvalidAddressException, - RegistryException, + registry_layers.RegistryException, ): subkey_name = renderers.UnreadableValue() @@ -279,7 +276,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac value_name = value.get_name() except ( exceptions.InvalidAddressException, - RegistryException, + registry_layers.RegistryException, ): value_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/truecrypt.py b/volatility3/framework/plugins/windows/truecrypt.py index aaab49d20..0478e37a5 100644 --- a/volatility3/framework/plugins/windows/truecrypt.py +++ b/volatility3/framework/plugins/windows/truecrypt.py @@ -3,20 +3,15 @@ # import logging +from typing import Generator, Iterable, List, Tuple -from typing import Iterable, Generator, List, Tuple - -from volatility3.framework import constants, interfaces, renderers +from volatility3.framework import constants, interfaces, objects, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces.configuration import RequirementInterface -from volatility3.framework.interfaces.objects import ObjectInterface -from volatility3.framework.objects import Bytes, DataFormatInfo, Integer, StructType -from volatility3.framework.objects.templates import ObjectTemplate +from volatility3.framework.interfaces import configuration from volatility3.framework.objects.utility import array_to_string from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows.extensions import pe - from volatility3.plugins.windows import modules vollog = logging.getLogger(__name__) @@ -29,7 +24,7 @@ class Passphrase(interfaces.plugins.PluginInterface): _required_framework_version = (2, 5, 2) @classmethod - def get_requirements(cls) -> List[RequirementInterface]: + def get_requirements(cls) -> List[configuration.RequirementInterface]: return [ requirements.ModuleRequirement( "kernel", @@ -67,7 +62,7 @@ class Passphrase(interfaces.plugins.PluginInterface): layer_name, module_base, ) - data_section: StructType = next( + data_section: objects.StructType = next( sec for sec in dos_header.get_nt_header().get_sections() if array_to_string(sec.Name) == ".data" @@ -76,11 +71,11 @@ class Passphrase(interfaces.plugins.PluginInterface): size: int = data_section.Misc.VirtualSize # Looking at `Length` in TrueCrypt/Common/Password.h::Password struct DWORD_SIZE_BYTES: int = 4 - format = DataFormatInfo( + format = objects.DataFormatInfo( length=DWORD_SIZE_BYTES, byteorder="little", signed=True ) - int32 = ObjectTemplate( - Integer, pe_table_name + constants.BANG + "int", data_format=format + int32 = objects.templates.ObjectTemplate( + objects.Integer, pe_table_name + constants.BANG + "int", data_format=format ) count, not_aligned = divmod(size, DWORD_SIZE_BYTES) if not_aligned: @@ -99,7 +94,7 @@ class Passphrase(interfaces.plugins.PluginInterface): if not min_length <= length <= 64: continue offset = length.vol["offset"] + DWORD_SIZE_BYTES - passphrase: Bytes = self.context.object( + passphrase: objects.Bytes = self.context.object( pe_table_name + constants.BANG + "bytes", layer_name, offset, @@ -111,7 +106,7 @@ class Passphrase(interfaces.plugins.PluginInterface): continue # TrueCrypt/Common/Password.h::Password struct is padded with # 3 zero bytes to keep 64-byte alignment. - buf: Bytes = self.context.object( + buf: objects.Bytes = self.context.object( pe_table_name + constants.BANG + "bytes", layer_name, offset + length + 1, # +1 for '\0'-terminated password string @@ -124,8 +119,8 @@ class Passphrase(interfaces.plugins.PluginInterface): def _generator(self): kernel = self.context.modules[self.config["kernel"]] - mods: Iterable[ObjectInterface] = modules.Modules.list_modules( - self.context, self.config["kernel"] + mods: Iterable[interfaces.objects.ObjectInterface] = ( + modules.Modules.list_modules(self.context, self.config["kernel"]) ) try: truecrypt_module_base = next( diff --git a/volatility3/framework/symbols/linux/network.py b/volatility3/framework/symbols/linux/network.py index c88e6fc69..72ffe8047 100644 --- a/volatility3/framework/symbols/linux/network.py +++ b/volatility3/framework/symbols/linux/network.py @@ -1,9 +1,9 @@ from volatility3.framework.symbols import intermed from volatility3.framework.symbols.linux.extensions import network -from volatility3.framework.interfaces.configuration import VersionableInterface +from volatility3.framework.interfaces import configuration -class NetSymbols(VersionableInterface): +class NetSymbols(configuration.VersionableInterface): _version = (1, 0, 0) @classmethod diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 75608cfc6..9fe250ba5 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -18,7 +18,6 @@ from volatility3.framework import ( renderers, symbols, ) -from volatility3.framework.interfaces.objects import ObjectInterface from volatility3.framework.layers import intel from volatility3.framework.objects import utility from volatility3.framework.renderers import conversion @@ -413,7 +412,9 @@ class DEVICE_OBJECT(objects.StructType, pool.ExecutiveObject): header = self.get_object_header() return header.NameInfo.Name.String # type: ignore - def get_attached_devices(self) -> Generator[ObjectInterface, None, None]: + def get_attached_devices( + self, + ) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Enumerate the attached device's objects""" seen = set() @@ -443,7 +444,7 @@ class DRIVER_OBJECT(objects.StructType, pool.ExecutiveObject): header = self.get_object_header() return header.NameInfo.Name.String # type: ignore - def get_devices(self) -> Generator[ObjectInterface, None, None]: + def get_devices(self) -> Generator[interfaces.objects.ObjectInterface, None, None]: """Enumerate the driver's device objects""" seen = set() diff --git a/volatility3/framework/symbols/windows/extensions/network.py b/volatility3/framework/symbols/windows/extensions/network.py index e41ac6a05..62cb4fba4 100644 --- a/volatility3/framework/symbols/windows/extensions/network.py +++ b/volatility3/framework/symbols/windows/extensions/network.py @@ -4,17 +4,15 @@ import logging import socket -from typing import Dict, Tuple, List, Union, Optional +from typing import Dict, List, Optional, Tuple, Union -from volatility3.framework import exceptions -from volatility3.framework import objects, interfaces -from volatility3.framework.objects import Array +from volatility3.framework import exceptions, interfaces, objects from volatility3.framework.renderers import conversion vollog = logging.getLogger(__name__) -def inet_ntop(address_family: int, packed_ip: Union[List[int], Array]) -> str: +def inet_ntop(address_family: int, packed_ip: Union[List[int], objects.Array]) -> str: if address_family in [socket.AF_INET6, socket.AF_INET]: try: return socket.inet_ntop(address_family, bytes(packed_ip)) diff --git a/volatility3/framework/symbols/windows/extensions/pool.py b/volatility3/framework/symbols/windows/extensions/pool.py index b0c480d19..f12182fa7 100644 --- a/volatility3/framework/symbols/windows/extensions/pool.py +++ b/volatility3/framework/symbols/windows/extensions/pool.py @@ -4,7 +4,7 @@ import logging import struct from typing import Dict, List, Optional, Tuple, Union -from volatility3.plugins.windows.poolscanner import PoolConstraint +from volatility3.plugins.windows import poolscanner from volatility3.framework import ( constants, @@ -28,7 +28,7 @@ class POOL_HEADER(objects.StructType): def get_object( self, - constraint: PoolConstraint, + constraint: poolscanner.PoolConstraint, use_top_down: bool, kernel_symbol_table: Optional[str] = None, native_layer_name: Optional[str] = None, diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index 987f01ac1..e3419fab0 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -8,10 +8,7 @@ import struct from typing import Iterator, Optional, Union, cast from volatility3.framework import constants, exceptions, interfaces, objects -from volatility3.framework.layers.registry import ( - RegistryException, - RegistryHive, -) +from volatility3.framework.layers import registry vollog = logging.getLogger(__name__) @@ -102,7 +99,9 @@ class CMHIVE(objects.StructType): for attr in ["FileFullPath", "FileUserName", "HiveRootPath"]: with contextlib.suppress( - AttributeError, exceptions.InvalidAddressException, RegistryException + AttributeError, + exceptions.InvalidAddressException, + registry.RegistryException, ): name = getattr(self, attr) if name.Length > 0: @@ -172,7 +171,9 @@ class CM_KEY_NODE(objects.StructType): Raises TypeError if the key was not instantiated on a RegistryHive layer """ - if not isinstance(self._context.layers[self.vol.layer_name], RegistryHive): + if not isinstance( + self._context.layers[self.vol.layer_name], registry.RegistryHive + ): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") return bool(self.vol.offset & 0x80000000) @@ -182,7 +183,7 @@ class CM_KEY_NODE(objects.StructType): Raises TypeError if the key was not instantiated on a RegistryHive layer """ hive = self._context.layers[self.vol.layer_name] - if not isinstance(hive, RegistryHive): + if not isinstance(hive, registry.RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") for index in range(2): # Use get_cell because it should *always* be a KeyIndex @@ -190,7 +191,7 @@ class CM_KEY_NODE(objects.StructType): yield from self._get_subkeys_recursive(hive, subkey_node) def _get_subkeys_recursive( - self, hive: RegistryHive, node: interfaces.objects.ObjectInterface + self, hive: registry.RegistryHive, node: interfaces.objects.ObjectInterface ) -> Iterator["CM_KEY_NODE"]: """Recursively descend a node returning subkeys.""" # The keylist appears to include 4 bytes of key name after each value @@ -200,7 +201,7 @@ class CM_KEY_NODE(objects.StructType): signature = node.cast("string", max_length=2, encoding="latin-1") except ( exceptions.InvalidAddressException, - RegistryException, + registry.RegistryException, ): return None @@ -229,7 +230,7 @@ class CM_KEY_NODE(objects.StructType): subnode = hive.get_node(subnode_offset) except ( exceptions.InvalidAddressException, - RegistryException, + registry.RegistryException, ): vollog.log( constants.LOGLEVEL_VVV, @@ -244,7 +245,7 @@ class CM_KEY_NODE(objects.StructType): Raises TypeError if the key was not instantiated on a RegistryHive layer """ hive = self._context.layers[self.vol.layer_name] - if not isinstance(hive, RegistryHive): + if not isinstance(hive, registry.RegistryHive): raise TypeError("CM_KEY_NODE was not instantiated on a RegistryHive layer") try: @@ -255,7 +256,7 @@ class CM_KEY_NODE(objects.StructType): if v != 0: try: node = hive.get_node(v) - except (RegistryException,) as excp: + except (registry.RegistryException,) as excp: vollog.debug(f"Invalid address {excp}") continue if isinstance(node, CM_KEY_VALUE): @@ -263,7 +264,7 @@ class CM_KEY_NODE(objects.StructType): except ( exceptions.InvalidAddressException, - RegistryException, + registry.RegistryException, ) as excp: vollog.debug(f"Invalid address in get_values iteration: {excp}") return None @@ -281,7 +282,7 @@ class CM_KEY_NODE(objects.StructType): Raises TypeError if the key was not instantiated on a RegistryHive layer """ reg = self._context.layers[self.vol.layer_name] - if not isinstance(reg, RegistryHive): + if not isinstance(reg, registry.RegistryHive): raise TypeError("Key was not instantiated on a RegistryHive layer") # Using the offset adds a significant delay (since it cannot be cached easily) # if self.vol.offset == reg.get_node(reg.root_cell_offset).vol.offset: @@ -320,7 +321,7 @@ class CM_KEY_VALUE(objects.StructType): data = b"" # Check if the data is stored inline layer = self._context.layers[self.vol.layer_name] - if not isinstance(layer, RegistryHive): + if not isinstance(layer, registry.RegistryHive): raise TypeError("Key value was not instantiated on a RegistryHive layer") # If the high-bit is set @@ -353,7 +354,10 @@ class CM_KEY_VALUE(objects.StructType): offset=layer.get_cell(block_offset).vol.offset, length=amount, ) - except (exceptions.InvalidAddressException, RegistryException): + except ( + exceptions.InvalidAddressException, + registry.RegistryException, + ): vollog.debug( f"Failed to read {amount:x} bytes of data, padding with {amount:x}" ) @@ -363,7 +367,7 @@ class CM_KEY_VALUE(objects.StructType): # but the length at the start could be negative so just adding 4 to jump past it try: data = layer.read(self.Data + 4, datalen) - except (exceptions.InvalidAddressException, RegistryException): + except (exceptions.InvalidAddressException, registry.RegistryException): vollog.debug( f"Failed to read {datalen:x} bytes of data, returning {datalen:x} null bytes" ) diff --git a/volatility3/framework/symbols/windows/extensions/services.py b/volatility3/framework/symbols/windows/extensions/services.py index 0a2194e07..9f36a1b9c 100644 --- a/volatility3/framework/symbols/windows/extensions/services.py +++ b/volatility3/framework/symbols/windows/extensions/services.py @@ -4,7 +4,7 @@ from volatility3.framework import objects, interfaces from volatility3.framework import exceptions -from volatility3.framework.symbols.wrappers import Flags +from volatility3.framework.symbols import wrappers from volatility3.framework import renderers from typing import Union @@ -91,7 +91,7 @@ class SERVICE_RECORD(objects.StructType): "SERVICE_INTERACTIVE_PROCESS": 256, } - type_flags = Flags(choices=SERVICE_TYPE_FLAGS) + type_flags = wrappers.Flags(choices=SERVICE_TYPE_FLAGS) return "|".join(type_flags(self.Type)) def traverse(self): diff --git a/volatility3/framework/symbols/windows/pdbutil.py b/volatility3/framework/symbols/windows/pdbutil.py index 3c23eddb8..5f5c8cac8 100644 --- a/volatility3/framework/symbols/windows/pdbutil.py +++ b/volatility3/framework/symbols/windows/pdbutil.py @@ -16,7 +16,6 @@ from volatility3 import symbols from volatility3.framework import constants, contexts, exceptions, interfaces from volatility3.framework.automagic import symbol_cache from volatility3.framework.configuration import requirements -from volatility3.framework.configuration.requirements import SymbolTableRequirement from volatility3.framework.symbols import intermed from volatility3.framework.symbols.windows import pdbconv @@ -140,7 +139,7 @@ class PDBUtility(interfaces.configuration.VersionableInterface): requirement_name = interfaces.configuration.path_head(config_path) # Construct the appropriate symbol table - requirement = SymbolTableRequirement( + requirement = requirements.SymbolTableRequirement( name=requirement_name, description="PDBUtility generated symbol table" ) requirement.construct(context, parent_config_path) diff --git a/volatility3/plugins/windows/registry/certificates.py b/volatility3/plugins/windows/registry/certificates.py index caf244f95..d96284036 100644 --- a/volatility3/plugins/windows/registry/certificates.py +++ b/volatility3/plugins/windows/registry/certificates.py @@ -4,6 +4,7 @@ import struct from typing import Iterator, List, Optional, Tuple, Type from volatility3.framework import exceptions, interfaces, renderers +from volatility3.framework.layers import registry as registry_layer from volatility3.framework.configuration import requirements from volatility3.framework.symbols.windows.extensions import registry from volatility3.plugins.windows.registry import hivelist, printkey @@ -80,7 +81,7 @@ class Certificates(interfaces.plugins.PluginInterface): ]: with contextlib.suppress( KeyError, - registry.RegistryException, + registry_layer.RegistryException, exceptions.InvalidAddressException, ): # Walk it From a3353a3cb60ea55a7893cb28488cb2465f67224e Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 16:57:15 -0500 Subject: [PATCH 0961/1352] CI Testing: Renames script and updates job name --- .../{check-requirements.yml => vol3-code-analysis.yml} | 5 ++--- ...igurable_requirements.py => volatility3_code_analysis.py} | 0 2 files changed, 2 insertions(+), 3 deletions(-) rename .github/workflows/{check-requirements.yml => vol3-code-analysis.yml} (73%) rename test/{check_configurable_requirements.py => volatility3_code_analysis.py} (100%) diff --git a/.github/workflows/check-requirements.yml b/.github/workflows/vol3-code-analysis.yml similarity index 73% rename from .github/workflows/check-requirements.yml rename to .github/workflows/vol3-code-analysis.yml index 9892d7b94..fc2b297fd 100644 --- a/.github/workflows/check-requirements.yml +++ b/.github/workflows/vol3-code-analysis.yml @@ -1,4 +1,4 @@ -name: Check Volatility3 Version Requirements +name: Volatility3 Code Analysis on: [push, pull_request] jobs: @@ -21,5 +21,4 @@ jobs: - name: Testing... run: | - # Verify completeness of ConfigurableInterface requirements - python ./test/check_configurable_requirements.py + python ./test/volatility3_code_analysis.py diff --git a/test/check_configurable_requirements.py b/test/volatility3_code_analysis.py similarity index 100% rename from test/check_configurable_requirements.py rename to test/volatility3_code_analysis.py From f72b717c0001426abfcb50e6a37717df4a80ddf7 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 28 Mar 2025 22:25:52 -0500 Subject: [PATCH 0962/1352] Comment type annotation to fix circular import --- volatility3/framework/symbols/windows/extensions/registry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/registry.py b/volatility3/framework/symbols/windows/extensions/registry.py index e3419fab0..e18a15cba 100644 --- a/volatility3/framework/symbols/windows/extensions/registry.py +++ b/volatility3/framework/symbols/windows/extensions/registry.py @@ -191,7 +191,7 @@ class CM_KEY_NODE(objects.StructType): yield from self._get_subkeys_recursive(hive, subkey_node) def _get_subkeys_recursive( - self, hive: registry.RegistryHive, node: interfaces.objects.ObjectInterface + self, hive: "registry.RegistryHive", node: interfaces.objects.ObjectInterface ) -> Iterator["CM_KEY_NODE"]: """Recursively descend a node returning subkeys.""" # The keylist appears to include 4 bytes of key name after each value From 296cb3c1131c7379d27668da7d5cfa9278a6eb79 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Sat, 29 Mar 2025 15:48:24 -0500 Subject: [PATCH 0963/1352] Code Analysis: Give pass to 'volatility3' Also moves some code into a private method with a docstring in the visitor class. --- test/volatility3_code_analysis.py | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/test/volatility3_code_analysis.py b/test/volatility3_code_analysis.py index ee1a54ce2..100ad3074 100644 --- a/test/volatility3_code_analysis.py +++ b/test/volatility3_code_analysis.py @@ -165,13 +165,16 @@ class ModuleVisitor(NodeVisitor): def violations(self): return self._violations - def enter_ImportFrom(self, node: ast.ImportFrom): - if not node.module: - return - + def _check_vol3_import_from(self, node: ast.ImportFrom): + """ + Ensure that the only thing imported from a volatility3 module (apart + from the root volatility3 module) are functions and modules. This + prevents re-exporting of classes and variables from modules that use + them. + """ if ( node.module - and node.module.startswith("volatility3") + and node.module.startswith("volatility3.") # Give a pass to volatility3 module and node.module != "volatility3.framework.constants._version" # make an exception for this ): for name in node.names: @@ -198,6 +201,10 @@ class ModuleVisitor(NodeVisitor): ) ) + def enter_ImportFrom(self, node: ast.ImportFrom): + self._check_vol3_import_from(node) + + def enter_ClassDef(self, node: ast.ClassDef) -> Any: logger.debug("Entering class %s", node.name) clazz = None From ee3d965ef6cffe9c1011124f0c4bbf9cd64d7173 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Sat, 29 Mar 2025 15:50:36 -0500 Subject: [PATCH 0964/1352] Revert changes to configuration.py --- volatility3/framework/interfaces/configuration.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/interfaces/configuration.py b/volatility3/framework/interfaces/configuration.py index 33d15d05e..b6f4f889c 100644 --- a/volatility3/framework/interfaces/configuration.py +++ b/volatility3/framework/interfaces/configuration.py @@ -37,8 +37,7 @@ from typing import ( Set, ) -import volatility3 -from volatility3 import framework +from volatility3 import classproperty, framework from volatility3.framework import constants, interfaces CONFIG_SEPARATOR = "." @@ -806,7 +805,7 @@ class VersionableInterface: framework.require_interface_version(*self._required_framework_version) super().__init__(*args, **kwargs) - @volatility3.classproperty + @classproperty def version(cls) -> Tuple[int, int, int]: """The version of the current interface (classmethods available on the component). From c17bcb644ba9a3b1750d84856619902dd79b034a Mon Sep 17 00:00:00 2001 From: David McDonald Date: Sat, 29 Mar 2025 15:51:19 -0500 Subject: [PATCH 0965/1352] Revert changes to intel.py --- volatility3/framework/layers/intel.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index a79d1ef5c..1069b7f6d 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -9,7 +9,7 @@ import math import struct from typing import Any, Dict, Iterable, List, Optional, Tuple -import volatility3 +from volatility3 import classproperty from volatility3.framework import exceptions, interfaces, constants from volatility3.framework.configuration import requirements from volatility3.framework.layers import linear @@ -75,13 +75,13 @@ class Intel(linear.LinearlyMappedLayer): # These can vary depending on the type of space self._index_shift = math.ceil(math.log2(struct.calcsize(self._entry_format))) - @volatility3.classproperty + @classproperty @functools.lru_cache def page_shift(cls) -> int: """Page shift for the intel memory layers.""" return cls._page_size_in_bits - @volatility3.classproperty + @classproperty @functools.lru_cache def page_size(cls) -> int: """Page size for the intel memory layers. @@ -90,30 +90,30 @@ class Intel(linear.LinearlyMappedLayer): """ return 1 << cls._page_size_in_bits - @volatility3.classproperty + @classproperty @functools.lru_cache def page_mask(cls) -> int: """Page mask for the intel memory layers.""" return ~(cls.page_size - 1) - @volatility3.classproperty + @classproperty @functools.lru_cache def bits_per_register(cls) -> int: """Returns the bits_per_register to determine the range of an IntelTranslationLayer.""" return cls._bits_per_register - @volatility3.classproperty + @classproperty @functools.lru_cache def minimum_address(cls) -> int: return 0 - @volatility3.classproperty + @classproperty @functools.lru_cache def maximum_address(cls) -> int: return (1 << cls._maxvirtaddr) - 1 - @volatility3.classproperty + @classproperty def structure(cls) -> List[Tuple[str, int, bool]]: return cls._structure From 14120044227d722d58f62b50552953a9f7771759 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Sat, 29 Mar 2025 15:56:25 -0500 Subject: [PATCH 0966/1352] Make `registry_layers` -> `registry_layer` for consistency --- .../plugins/windows/registry/lsadump.py | 16 ++++++++-------- .../plugins/windows/registry/userassist.py | 10 +++++----- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/registry/lsadump.py b/volatility3/framework/plugins/windows/registry/lsadump.py index e394822d6..50ecaebc1 100644 --- a/volatility3/framework/plugins/windows/registry/lsadump.py +++ b/volatility3/framework/plugins/windows/registry/lsadump.py @@ -11,7 +11,7 @@ from Crypto.Cipher import ARC4, DES, AES from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements -from volatility3.framework.layers import registry as registry_layers +from volatility3.framework.layers import registry as registry_layer from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows.registry import hashdump, hivelist from volatility3.framework.renderers import format_hints @@ -64,7 +64,7 @@ class Lsadump(interfaces.plugins.PluginInterface): @classmethod def get_lsa_key( - cls, sechive: registry_layers.RegistryHive, bootkey: bytes, vista_or_later: bool + cls, sechive: registry_layer.RegistryHive, bootkey: bytes, vista_or_later: bool ) -> Optional[bytes]: if not bootkey: return None @@ -108,7 +108,7 @@ class Lsadump(interfaces.plugins.PluginInterface): @classmethod def get_secret_by_name( cls, - sechive: registry_layers.RegistryHive, + sechive: registry_layer.RegistryHive, name: str, lsakey: bytes, is_vista_or_later: bool, @@ -123,7 +123,7 @@ class Lsadump(interfaces.plugins.PluginInterface): enc_secret_value = next(enc_secret_key.get_values(), None) except ( exceptions.InvalidAddressException, - registry_layers.RegistryException, + registry_layer.RegistryException, ): enc_secret_value = None @@ -171,8 +171,8 @@ class Lsadump(interfaces.plugins.PluginInterface): def _generator( self, - syshive: registry_layers.RegistryHive, - sechive: registry_layers.RegistryHive, + syshive: registry_layer.RegistryHive, + sechive: registry_layer.RegistryHive, ): kernel = self.context.modules[self.config["kernel"]] @@ -208,7 +208,7 @@ class Lsadump(interfaces.plugins.PluginInterface): except ( StopIteration, exceptions.InvalidAddressException, - registry_layers.RegistryException, + registry_layer.RegistryException, ): enc_secret_value = None @@ -231,7 +231,7 @@ class Lsadump(interfaces.plugins.PluginInterface): key_name = key.get_name() except ( exceptions.InvalidAddressException, - registry_layers.RegistryException, + registry_layer.RegistryException, ): key_name = renderers.UnreadableValue() diff --git a/volatility3/framework/plugins/windows/registry/userassist.py b/volatility3/framework/plugins/windows/registry/userassist.py index 3272b241c..d27c8eb0c 100644 --- a/volatility3/framework/plugins/windows/registry/userassist.py +++ b/volatility3/framework/plugins/windows/registry/userassist.py @@ -13,7 +13,7 @@ from typing import Any, Generator, List, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.layers import physical -from volatility3.framework.layers import registry as registry_layers +from volatility3.framework.layers import registry as registry_layer from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed from volatility3.plugins.windows.registry import hivelist @@ -155,7 +155,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac ).has_member("CookiePad") def list_userassist( - self, hive: registry_layers.RegistryHive + self, hive: registry_layer.RegistryHive ) -> Generator[Tuple[int, Tuple], None, None]: """Generate userassist data for a registry hive.""" @@ -177,7 +177,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac "software\\microsoft\\windows\\currentversion\\explorer\\userassist", return_list=True, ) - except registry_layers.RegistryException as e: + except registry_layer.RegistryException as e: vollog.warning( f"Error accessing UserAssist key in {hive_name} at {hive.hive_offset:#x}: {e}" ) @@ -247,7 +247,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac subkey_name = subkey.get_name() except ( exceptions.InvalidAddressException, - registry_layers.RegistryException, + registry_layer.RegistryException, ): subkey_name = renderers.UnreadableValue() @@ -276,7 +276,7 @@ class UserAssist(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterfac value_name = value.get_name() except ( exceptions.InvalidAddressException, - registry_layers.RegistryException, + registry_layer.RegistryException, ): value_name = renderers.UnreadableValue() From 524d89ad6ce21c944fcd643beae2cbfc61d1ed29 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Mon, 31 Mar 2025 23:08:49 +0000 Subject: [PATCH 0967/1352] Fix several bugs in check_afinfo. Update through latest kernels. Match current Volatility coding standards --- .../framework/plugins/linux/check_afinfo.py | 189 ++++++++++++------ 1 file changed, 131 insertions(+), 58 deletions(-) diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index 7aa3cbdd2..034d4c24f 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -4,7 +4,7 @@ """A module containing a plugin that verifies the operation function pointers of network protocols.""" import logging -from typing import List +from typing import List, Tuple, Generator from volatility3.framework import exceptions, interfaces from volatility3.framework import renderers @@ -18,6 +18,7 @@ vollog = logging.getLogger(__name__) class Check_afinfo(plugins.PluginInterface): """Verifies the operation function pointers of network protocols.""" + _version = (1, 0, 0) _required_framework_version = (2, 0, 0) @classmethod @@ -30,61 +31,80 @@ class Check_afinfo(plugins.PluginInterface): ), ] - # returns whether the symbol is found within the kernel (system.map) or not - def _is_known_address(self, handler_addr): - symbols = list(self.context.symbol_space.get_symbols_by_location(handler_addr)) + @classmethod + def _check_members( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + var_ops: interfaces.objects.ObjectInterface, + var_name: str, + members: List[str], + ) -> Generator[Tuple[str, str, int], None, None]: + """ + Yields any members that are not pointing inside the kernel + """ - return len(symbols) > 0 + vmlinux = context.modules[vmlinux_name] - def _check_members(self, var_ops, var_name, members): for check in members: # redhat-specific garbage if check.startswith("__UNIQUE_ID_rh_kabi_hide"): continue - if check == "write": - addr = var_ops.member(attr="write") - else: - addr = getattr(var_ops, check) + # These structures have members like `write` and `next`, which are built in Python functions + addr = var_ops.member(attr=check) - if addr and addr != 0 and not self._is_known_address(addr): - yield check, addr + # Unimplemented handlers are set to 0 + if not addr: + continue - def _check_afinfo(self, var_name, var, op_members, seq_members): - # check if object has a least one of the members used for analysis by this function - required_members = ["seq_fops", "seq_ops", "seq_show"] - has_required_member = any(var.has_member(member) for member in required_members) - if not has_required_member: - vollog.debug( - f"{var_name} object at {hex(var.vol.offset)} had none of the required members: {', '.join([member for member in required_members])}" - ) - raise exceptions.PluginRequirementException + if len(vmlinux.get_symbols_by_absolute_location(addr)) == 0: + yield var_name, check, addr + + @classmethod + def _check_pre_4_18_ops( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + var_name: str, + var: interfaces.objects.ObjectInterface, + op_members: List[str], + seq_members: List[str], + ): + """ + Finds the correct way to reference `op_members` + """ + vmlinux = context.modules[vmlinux_name] if var.has_member("seq_fops"): - for hooked_member, hook_address in self._check_members( - var.seq_fops, var_name, op_members - ): - yield var_name, hooked_member, hook_address - + yield from cls._check_members( + context, vmlinux_name, var.seq_fops, var_name, op_members + ) # newer kernels if var.has_member("seq_ops"): - for hooked_member, hook_address in self._check_members( - var.seq_ops, var_name, seq_members - ): - yield var_name, hooked_member, hook_address + yield from cls._check_members( + context, vmlinux_name, var.seq_ops, var_name, seq_members + ) # this is the most commonly hooked member by rootkits, so a force a check on it + elif var.has_member("seq_show"): + if len(vmlinux.get_symbols_by_location(var.seq_show)) == 0: + yield var_name, "show", var.seq_show else: - if var.has_member("seq_show"): - if not self._is_known_address(var.seq_show): - yield var_name, "show", var.seq_show - - def _generator(self): - vmlinux = self.context.modules[self.config["kernel"]] - - op_members = vmlinux.get_type("file_operations").members - seq_members = vmlinux.get_type("seq_operations").members + raise exceptions.VolatilityException( + "_check_afinfo_pre_4_18: Unable to find sequence operations members for checking." + ) + @classmethod + def _check_afinfo_pre_4_18( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + seq_members: str, + ) -> Generator[Tuple[str, str, int], None, None]: + """ + Checks the operations structures for network protocols of < 4.18 systems + """ tcp = ("tcp_seq_afinfo", ["tcp6_seq_afinfo", "tcp4_seq_afinfo"]) udp = ( "udp_seq_afinfo", @@ -97,39 +117,92 @@ class Check_afinfo(plugins.PluginInterface): ) protocols = [tcp, udp] - # used to track the calls to _check_afinfo and the - # number of errors produced due to missing members - symbols_checked = set() - symbols_with_errors = set() + vmlinux = context.modules[vmlinux_name] + + op_members = vmlinux.get_type("file_operations").members # loop through all symbols for struct_type, global_vars in protocols: for global_var_name in global_vars: # this will lookup fail for the IPv6 protocols on kernels without IPv6 support try: - global_var = vmlinux.get_symbol(global_var_name) + global_var = vmlinux.object_from_symbol(global_var_name) except exceptions.SymbolError: continue - global_var = vmlinux.object( - object_type=struct_type, offset=global_var.address + yield from cls._check_pre_4_18_ops( + context, + vmlinux_name, + global_var_name, + global_var, + op_members, + seq_members, ) - symbols_checked.add(global_var_name) - try: - for name, member, address in self._check_afinfo( - global_var_name, global_var, op_members, seq_members - ): - yield 0, (name, member, format_hints.Hex(address)) - except exceptions.PluginRequirementException: - symbols_with_errors.add(global_var_name) + @classmethod + def _check_afinfo_post_4_18( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + seq_members: str, + ) -> Generator[Tuple[str, str, int], None, None]: + """ + Checks the operations structures for network protocols of >= 4.18 systems + """ + vmlinux = context.modules[vmlinux_name] - # if every call to _check_afinfo failed show a warning - if symbols_checked == symbols_with_errors: - vollog.warning( - "This plugin was not able to check for hooks. This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." + ops_structs = [ + "raw_seq_ops", + "udp_seq_ops", + "arp_seq_ops", + "unix_seq_ops", + "udp6_seq_ops" "raw6_seq_ops", + "tcp_seq_ops", + "tcp4_seq_ops", + "tcp6_seq_ops", + "packet_seq_ops", + ] + + for protocol_ops_var in ops_structs: + # These will fail if the particular kernel doesn't have support for a protocol like IPv6 + try: + protocol_ops = vmlinux.object_from_symbol(protocol_ops_var) + except exceptions.SymbolError: + continue + + yield from cls._check_members( + context, vmlinux_name, protocol_ops, protocol_ops_var, seq_members ) + @classmethod + def check_afinfo( + cls, context: interfaces.context.ContextInterface, vmlinux_name + ) -> Generator[Tuple[str, str, int], None, None]: + """ + Walks the network protocol operations structures for common network protocols. + Reports any initialized operations members that do not point inside the kernel. + """ + vmlinux = context.modules[vmlinux_name] + + type_check = vmlinux.get_type("tcp_seq_afinfo") + if type_check.has_member("seq_fops"): + checker = cls._check_afinfo_pre_4_18 + else: + checker = cls._check_afinfo_post_4_18 + + seq_members = vmlinux.get_type("seq_operations").members + + yield from checker(context, vmlinux_name, seq_members) + + def _generator(self): + """ + A simple wrapper around `check_afino` + """ + for name, member, address in self.check_afinfo( + self.context, self.config["kernel"] + ): + yield 0, (name, member, format_hints.Hex(address)) + def run(self): return renderers.TreeGrid( [ From 9c58cfc2a844f545626ddcc8e1e8d385c56684bd Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 1 Apr 2025 11:20:48 +0100 Subject: [PATCH 0968/1352] Potential fix for code scanning alert no. 416: Implicit string concatenation in a list Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- volatility3/framework/plugins/linux/check_afinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index 034d4c24f..310e7da6c 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -156,7 +156,7 @@ class Check_afinfo(plugins.PluginInterface): "udp_seq_ops", "arp_seq_ops", "unix_seq_ops", - "udp6_seq_ops" "raw6_seq_ops", + "udp6_seq_ops", "raw6_seq_ops", "tcp_seq_ops", "tcp4_seq_ops", "tcp6_seq_ops", From 2ca5fd5fe584372dbbcdf43759f54b370cdaaf58 Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 1 Apr 2025 11:22:55 +0100 Subject: [PATCH 0969/1352] Update volatility3/framework/plugins/linux/check_afinfo.py Fix up ruff error. --- volatility3/framework/plugins/linux/check_afinfo.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index 310e7da6c..aa734b25d 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -156,7 +156,8 @@ class Check_afinfo(plugins.PluginInterface): "udp_seq_ops", "arp_seq_ops", "unix_seq_ops", - "udp6_seq_ops", "raw6_seq_ops", + "udp6_seq_ops", + "raw6_seq_ops", "tcp_seq_ops", "tcp4_seq_ops", "tcp6_seq_ops", From caedfc564f150f00c877f0ccfc5fce745217776c Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Tue, 1 Apr 2025 13:34:24 +0000 Subject: [PATCH 0970/1352] Fix black error --- volatility3/framework/plugins/linux/check_afinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index aa734b25d..47da21615 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -156,7 +156,7 @@ class Check_afinfo(plugins.PluginInterface): "udp_seq_ops", "arp_seq_ops", "unix_seq_ops", - "udp6_seq_ops", + "udp6_seq_ops", "raw6_seq_ops", "tcp_seq_ops", "tcp4_seq_ops", From 9791ae587898cc7b7324eeaf6d95ca58aae273ae Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 1 Apr 2025 22:23:03 +0100 Subject: [PATCH 0971/1352] Fix up direct import issue --- volatility3/cli/text_renderer.py | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 1d39e3fa6..1453c0ea1 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -9,11 +9,10 @@ import random import string import sys from functools import wraps -from typing import Any, Callable, Dict, List, Tuple, TypeVar, Union +from typing import Any, Callable, Dict, List, Optional, Tuple, TypeVar, Union from volatility3.cli import text_filter from volatility3.framework import exceptions, interfaces, renderers -from volatility3.framework.interfaces.renderers import BaseAbsentValue from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -84,7 +83,9 @@ def multitypedata_as_text(value: format_hints.MultiTypeData) -> str: T = TypeVar("T") -def optional(func: Callable[[Union[BaseAbsentValue, T]], str]) -> Callable[[T], str]: +def optional( + func: Callable[[Union[interfaces.renderers.BaseAbsentValue, T]], str], +) -> Callable[[T], str]: @wraps(func) def wrapped(x: Any) -> str: if isinstance(x, interfaces.renderers.BaseAbsentValue): @@ -156,8 +157,10 @@ class LayerDataRenderer(CLITypeRenderer): self.display_hex = True self.display_ascii = True - def render(data: Union[renderers.LayerData, BaseAbsentValue]): - if isinstance(data, BaseAbsentValue): + def render( + data: Union[renderers.LayerData, interfaces.renderers.BaseAbsentValue], + ): + if isinstance(data, interfaces.renderers.BaseAbsentValue): # FIXME: Do something cleverer here return "" @@ -241,8 +244,8 @@ class CLIRenderer(interfaces.renderers.Renderer): name = "unnamed" structured_output = False - filter: text_filter.CLIFilter = None - column_hide_list: list = None + filter: Optional[text_filter.CLIFilter] = None + column_hide_list: Optional[list] = None def ignored_columns( self, From bb2f28a39e096009dd249633cb508d94b8f39336 Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 1 Apr 2025 22:29:48 +0100 Subject: [PATCH 0972/1352] Update volatility3/cli/volshell/generic.py --- volatility3/cli/volshell/generic.py | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 11814f20a..1c70ceb0a 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -605,9 +605,7 @@ class Volshell(interfaces.plugins.PluginInterface): # volobject branch if isinstance( value, - Union[ - interfaces.objects.ObjectInterface, interfaces.objects.Template - ], + (interfaces.objects.ObjectInterface, interfaces.objects.Template), ): if isinstance(value, objects.Pointer): # show pointers in hex to match output for struct addrs From e2fb96a0d338109ddb9d2431ea7fb18ed8b20041 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 1 Apr 2025 23:14:03 +0100 Subject: [PATCH 0973/1352] Fix up JSON rendering of hex bytes and LayerData --- volatility3/cli/text_renderer.py | 77 ++++++++++++++++++-------------- 1 file changed, 44 insertions(+), 33 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 1453c0ea1..39abb265e 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -159,42 +159,12 @@ class LayerDataRenderer(CLITypeRenderer): def render( data: Union[renderers.LayerData, interfaces.renderers.BaseAbsentValue], - ): + ) -> str: if isinstance(data, interfaces.renderers.BaseAbsentValue): # FIXME: Do something cleverer here return "" - context_byte_len = self.context_byte_len if not data.no_surrounding else 0 - - layer = data.context.layers[data.layer_name] - # Map of the holes - error_bytes = set() - start_offset = data.offset - context_byte_len - end_offset = data.offset + data.length + context_byte_len - if isinstance(layer, interfaces.layers.TranslationLayerInterface): - error_bytes = set() - mapping = iter(layer.mapping(start_offset, end_offset, True)) - current_map = next(mapping) - for i in range(start_offset, end_offset): - # Run through the bytes, check if they're present - offset, sublength, _, _, _ = current_map - if i < offset: - error_bytes.add(i - start_offset) - if i > offset + sublength: - try: - current_map = next(mapping) - except StopIteration: - pass - offset, sublength, _, _, _ = current_map - if i > offset + sublength: - error_bytes.add(i - start_offset) - - # Padded data - specific_data = data.context.layers[data.layer_name].read( - start_offset, - end_offset - start_offset, - True, - ) + specific_data, error_bytes = self.render_bytes(data) printables = "" output = "\n" @@ -224,6 +194,46 @@ class LayerDataRenderer(CLITypeRenderer): render_func = render return super().__init__(render_func) + def render_bytes(self, data: renderers.LayerData) -> tuple[bytes, set[int]]: + """Renders a valid LayerData into bytes (with context bytes)""" + context_byte_len = self.context_byte_len if not data.no_surrounding else 0 + + layer = data.context.layers[data.layer_name] + # Map of the holes + error_bytes = set() + start_offset = data.offset - context_byte_len + end_offset = data.offset + data.length + context_byte_len + if isinstance(layer, interfaces.layers.TranslationLayerInterface): + error_bytes = set() + mapping = iter(layer.mapping(start_offset, end_offset, True)) + current_map = next(mapping) + for i in range(start_offset, end_offset): + # Run through the bytes, check if they're present + offset, sublength, _, _, _ = current_map + if i < offset: + error_bytes.add(i - start_offset) + if i > offset + sublength: + try: + current_map = next(mapping) + except StopIteration: + pass + offset, sublength, _, _, _ = current_map + if i > offset + sublength: + error_bytes.add(i - start_offset) + + # Padded data + specific_data = data.context.layers[data.layer_name].read( + start_offset, + end_offset - start_offset, + True, + ) + + import pdb + + pdb.set_trace() + + return specific_data, error_bytes + class CLIRenderer(interfaces.renderers.Renderer): """Class to add specific requirements for CLI renderers.""" @@ -525,9 +535,10 @@ class PrettyTextRenderer(CLIRenderer): class JsonRenderer(CLIRenderer): _type_renderers = { - format_hints.HexBytes: quoted_optional(hex_bytes_as_text), + format_hints.HexBytes: lambda x: x.hex(" "), renderers.Disassembly: quoted_optional(display_disassembly), format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), + renderers.LayerData: lambda x: LayerDataRenderer().render_bytes(x)[0].hex(" "), bytes: optional(lambda x: " ".join(f"{b:02x}" for b in x)), datetime.datetime: lambda x: ( x.isoformat() From aad6a563364fc36f582751f27fc72c041cb364b6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 1 Apr 2025 23:20:49 +0100 Subject: [PATCH 0974/1352] Fix old typing mechanism --- volatility3/cli/text_renderer.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 39abb265e..06c6564de 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -9,7 +9,7 @@ import random import string import sys from functools import wraps -from typing import Any, Callable, Dict, List, Optional, Tuple, TypeVar, Union +from typing import Any, Callable, Dict, List, Optional, Set, Tuple, TypeVar, Union from volatility3.cli import text_filter from volatility3.framework import exceptions, interfaces, renderers @@ -194,7 +194,7 @@ class LayerDataRenderer(CLITypeRenderer): render_func = render return super().__init__(render_func) - def render_bytes(self, data: renderers.LayerData) -> tuple[bytes, set[int]]: + def render_bytes(self, data: renderers.LayerData) -> Tuple[bytes, Set[int]]: """Renders a valid LayerData into bytes (with context bytes)""" context_byte_len = self.context_byte_len if not data.no_surrounding else 0 From d3d19fe776782f2a82b39ea3bbe38082e61b4169 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 1 Apr 2025 23:37:57 +0100 Subject: [PATCH 0975/1352] CLI: Handle BaseAbsentValues in JSON --- volatility3/cli/text_renderer.py | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 06c6564de..69a5468a7 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -535,10 +535,18 @@ class PrettyTextRenderer(CLIRenderer): class JsonRenderer(CLIRenderer): _type_renderers = { - format_hints.HexBytes: lambda x: x.hex(" "), + format_hints.HexBytes: lambda x: ( + x.hex(" ") + if not isinstance(x, interfaces.renderers.BaseAbsentValue) + else "N/A" + ), renderers.Disassembly: quoted_optional(display_disassembly), format_hints.MultiTypeData: quoted_optional(multitypedata_as_text), - renderers.LayerData: lambda x: LayerDataRenderer().render_bytes(x)[0].hex(" "), + renderers.LayerData: lambda x: ( + LayerDataRenderer().render_bytes(x)[0].hex(" ") + if not isinstance(x, interfaces.renderers.BaseAbsentValue) + else "N/A" + ), bytes: optional(lambda x: " ".join(f"{b:02x}" for b in x)), datetime.datetime: lambda x: ( x.isoformat() From 0b1bbb87eee2d0a700d7601170e92ff630cf2782 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 2 Apr 2025 09:36:07 -0500 Subject: [PATCH 0976/1352] Windows Tests: Update userassist JSON output The new layer data type renders the output a little differently, and the plugin also seems to render 'N/A' for a missing value where previously it was an empty string. --- ...windows.registry.userassist.UserAssist.json | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json b/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json index 6ae740822..fd1c997b0 100644 --- a/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json +++ b/test/plugins/windows/test_data/windows.registry.userassist.UserAssist.json @@ -9,7 +9,7 @@ "Last Write Time": "2025-03-06T17:57:09+00:00", "Name": null, "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", - "Raw Data": "", + "Raw Data": "N/A", "Time Focused": null, "Type": "Key", "__children": [ @@ -23,7 +23,7 @@ "Last Write Time": "2025-03-06T17:57:09+00:00", "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", - "Raw Data": "\"\n00 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 90 86 6b 31 ..............k1\nfd 8d db 01 00 00 00 00 ........ \"", + "Raw Data": "00 00 00 00 07 00 00 00 00 00 00 00 07 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff 90 86 6b 31 fd 8d db 01 00 00 00 00", "Time Focused": "0:00:00.507000", "Type": "Value", "__children": [] @@ -38,7 +38,7 @@ "Last Write Time": "2025-03-06T17:57:09+00:00", "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Registry Editor.lnk", "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", - "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff f0 82 cf ca ................\n95 8e db 01 00 00 00 00 ........ \"", + "Raw Data": "00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff f0 82 cf ca 95 8e db 01 00 00 00 00", "Time Focused": "0:00:00.501000", "Type": "Value", "__children": [] @@ -53,7 +53,7 @@ "Last Write Time": "2025-03-06T17:57:09+00:00", "Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", - "Raw Data": "\"\n00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 10 67 cf 4d .............g.M\nbe 8e db 01 00 00 00 00 ........ \"", + "Raw Data": "00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff 10 67 cf 4d be 8e db 01 00 00 00 00", "Time Focused": "0:00:00.504000", "Type": "Value", "__children": [] @@ -68,7 +68,7 @@ "Last Write Time": "2025-03-06T17:57:09+00:00", "Name": "%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", - "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff d0 99 66 6c ..............fl\nc0 8e db 01 00 00 00 00 ........ \"", + "Raw Data": "00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff d0 99 66 6c c0 8e db 01 00 00 00 00", "Time Focused": "0:00:00.501000", "Type": "Value", "__children": [] @@ -83,7 +83,7 @@ "Last Write Time": "2025-03-06T17:57:09+00:00", "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", - "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 00 62 ba 89 .............b..\nc0 8e db 01 00 00 00 00 ........ \"", + "Raw Data": "00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff 00 62 ba 89 c0 8e db 01 00 00 00 00", "Time Focused": "0:00:00.501000", "Type": "Value", "__children": [] @@ -98,7 +98,7 @@ "Last Write Time": "2025-03-06T17:57:09+00:00", "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", - "Raw Data": "\"\n00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff b0 24 49 23 .............$I#\nc1 8e db 01 00 00 00 00 ........ \"", + "Raw Data": "00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff b0 24 49 23 c1 8e db 01 00 00 00 00", "Time Focused": "0:00:00.502000", "Type": "Value", "__children": [] @@ -113,11 +113,11 @@ "Last Write Time": "2025-03-06T17:57:09+00:00", "Name": "%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk", "Path": "ntuser.dat\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count", - "Raw Data": "\"\n00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ................\n00 00 80 bf 00 00 80 bf ff ff ff ff 60 3d 89 2e ............`=..\nc1 8e db 01 00 00 00 00 ........ \"", + "Raw Data": "00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf ff ff ff ff 60 3d 89 2e c1 8e db 01 00 00 00 00", "Time Focused": "0:00:00.501000", "Type": "Value", "__children": [] } ] } -} \ No newline at end of file +} From e446c1081de5a54afe2a02f6bea581d6ec9880f8 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 2 Apr 2025 09:43:20 -0500 Subject: [PATCH 0977/1352] Remove debugging call --- volatility3/cli/text_renderer.py | 4 ---- 1 file changed, 4 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 69a5468a7..3fd804d1b 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -228,10 +228,6 @@ class LayerDataRenderer(CLITypeRenderer): True, ) - import pdb - - pdb.set_trace() - return specific_data, error_bytes From 5befbf86298cbff014996e4b59c58f850aafb388 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 2 Apr 2025 14:08:18 -0500 Subject: [PATCH 0978/1352] Tests: Fix MFTScan testdata These test values needed updating now that the `LayerData` type is used and presents the data a little differently than before. --- test/plugins/windows/windows.py | 37 ++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index c9cf93391..6733d543e 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -1,10 +1,10 @@ -import json -import hashlib -import shutil import contextlib -import tempfile +import hashlib +import json import os -from test import test_volatility, WindowsSamples +import shutil +import tempfile +from test import WindowsSamples, test_volatility class TestWindowsVolshell: @@ -843,20 +843,22 @@ class TestWindowsMFTscan: { "ADS Filename": "Zone.Identifier", "Filename": "libby_hoeler_part1.wmv", - "Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a ZoneId=3.. "', + "Hexdump": "5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a 5a 6f 6e 65 49 64 3d 33 0d 0a", "MFT Type": "DATA", "Offset": 55926304, "Record Number": 323, "Record Type": "FILE", + "__children": [], }, { "ADS Filename": "Zone.Identifier", "Filename": "NetZeroQuickHelpLite.exe", - "Hexdump": '"\n5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a [ZoneTransfer]..\n5a 6f 6e 65 49 64 3d 33 0d 0a ZoneId=3.. "', + "Hexdump": "5b 5a 6f 6e 65 54 72 61 6e 73 66 65 72 5d 0d 0a 5a 6f 6e 65 49 64 3d 33 0d 0a", "MFT Type": "DATA", "Offset": 56102400, "Record Number": 347, "Record Type": "FILE", + "__children": [], }, ] for expected_row in expected_rows: @@ -877,20 +879,22 @@ class TestWindowsMFTscan: { "ADS Filename": "$Max", "Filename": "$UsnJrnl", - "Hexdump": '"\n00 00 00 02 00 00 00 00 00 00 80 00 00 00 00 00 ................\nb9 dd f0 cc df 73 db 01 00 00 00 00 00 00 00 00 .....s.........."', + "Hexdump": "00 00 00 02 00 00 00 00 00 00 80 00 00 00 00 00 b9 dd f0 cc df 73 db 01 00 00 00 00 00 00 00 00", "MFT Type": "DATA", - "Offset": 1058018088, + "Offset": 26235616, "Record Number": 107240, "Record Type": "FILE", + "__children": [], }, { - "ADS Filename": "$Config", - "Filename": "$Repair", - "Hexdump": '"\n01 00 00 00 03 00 00 00 ........ "', + "ADS Filename": "$SRAT", + "Filename": "$Bitmap", + "Hexdump": "a4 5f fd 60 38 00 01 03 10 00 0c 00 04 00 00 00 01 00 00 00 01 00 00 00 8d 4e 16 00 02 00 00 00 a0 00 00 00 00 00 06 00 03 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a 7b 01 00 00 00 00 00", "MFT Type": "DATA", - "Offset": 5009678688, - "Record Number": 28, + "Offset": 1052277088, + "Record Number": 6, "Record Type": "FILE", + "__children": [], }, ] for expected_row in expected_rows: @@ -924,7 +928,7 @@ class TestWindowsMFTscan: expected_rows = [ { "Filename": "index", - "Hexdump": '"\n30 5c 72 a7 1b 6d fb fc 09 00 00 00 00 00 00 00 0\\r..m..........\n00 00 00 00 00 00 00 00 ........ "', + "Hexdump": "30 5c 72 a7 1b 6d fb fc 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "MFT Type": "DATA", "Offset": 4961536280, "Record Number": 116474, @@ -932,7 +936,7 @@ class TestWindowsMFTscan: }, { "Filename": "0.2.filtertrie.intermediate.txt", - "Hexdump": '"\n30 09 32 0d 0a 0.2.. "', + "Hexdump": "30 09 32 0d 0a", "MFT Type": "DATA", "Offset": 619242944, "Record Number": 113013, @@ -1411,4 +1415,3 @@ class TestWindowsVirtMap: ) for expected_row in expected_rows: assert test_volatility.match_output_row(expected_row, json_out) - From 3c3b2b3bbd12576cb1a489fbe273a34de29160e6 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 2 Apr 2025 14:14:52 -0500 Subject: [PATCH 0979/1352] MFT Extensions: Fix type hints These type hints are a bit misleading, and have been updated to reflect their real return type. --- volatility3/framework/symbols/windows/extensions/mft.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index ebba882c0..86580be16 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -10,7 +10,7 @@ from volatility3.framework import objects, constants, exceptions class MFTEntry(objects.StructType): """This represents the base MFT Record""" - def get_signature(self) -> str: + def get_signature(self) -> "objects.String": signature = self.Signature.cast("string", max_length=4, encoding="latin-1") return signature @@ -18,7 +18,7 @@ class MFTEntry(objects.StructType): class MFTFileName(objects.StructType): """This represents an MFT $FILE_NAME Attribute""" - def get_full_name(self) -> str: + def get_full_name(self) -> "objects.String": output = self.Name.cast( "string", encoding="utf16", max_length=self.NameLength * 2, errors="replace" ) @@ -28,7 +28,7 @@ class MFTFileName(objects.StructType): class MFTAttribute(objects.StructType): """This represents an MFT ATTRIBUTE""" - def get_resident_filename(self) -> Optional[str]: + def get_resident_filename(self) -> Optional["objects.String"]: # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous if ( @@ -51,7 +51,7 @@ class MFTAttribute(objects.StructType): except exceptions.InvalidAddressException: return None - def get_resident_filecontent(self) -> Optional[bytes]: + def get_resident_filecontent(self) -> Optional["objects.Bytes"]: # smear observed in mass testing of samples # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems if ( From 86c5c16ed6f9729913a6ba797013a2ad03d6faa0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 2 Apr 2025 14:40:44 -0500 Subject: [PATCH 0980/1352] Windows MFTScan Plugins: Performance fixes There was a subtle issue that was causing substantial performance issues in the MFTScan plugins. The `record_map` was purportedly of type `Dict[str, Tuple[int, str, int]]`, but in reality, the second member was a list, and its `str` item was actually being populated with unprocessed values from method calls on the MFT extension classes, which actually return `object.String`. These objects are substantially larger than basic `str` types: ``` [ins] In [5]: pympler.asizeof.asizeof(rec_name) Out[5]: 312648 [ins] In [6]: pympler.asizeof.asizeof(str(rec_name)) Out[6]: 64 ``` This caused this dictionary to grow in size to several gigabytes on larger samples, resulting in thrashing and OOM errors. --- .../framework/plugins/windows/mftscan.py | 130 +++++++++++------- 1 file changed, 79 insertions(+), 51 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 7f9095c6a..9281c964e 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -4,8 +4,14 @@ import contextlib import datetime import logging +from typing import ( + Callable, + Iterator, + Optional, + Tuple, + DefaultDict, +) -from typing import Generator, Iterable, Dict, Tuple, Callable from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -17,6 +23,22 @@ from volatility3.plugins import timeliner, yarascan vollog = logging.getLogger(__name__) +class MFTRecord: + # TODO: Change to dataclass with (slots=True) if/when we move minimum + # Python version up to 3.10 + __slots__ = ["record_name", "data_count", "offset"] + + def __init__( + self, + record_name: Optional[str] = None, + data_count: int = 0, + offset: Optional[int] = None, + ): + self.record_name = record_name + self.data_count = data_count + self.offset = offset + + class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for MFT FILE objects present in a particular windows memory image.""" @@ -53,14 +75,14 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): primary_layer_name: str, attr_callback: Callable[ [ - Dict[int, Tuple[str, int, int]], - interfaces.objects.ObjectInterface, - interfaces.objects.ObjectInterface, + DefaultDict[str, MFTRecord], + mft.MFTEntry, + mft.MFTAttribute, str, ], - Generator, + Iterator[Tuple], ], - ) -> interfaces.objects.ObjectInterface: + ) -> Iterator[Tuple]: try: primary = context.layers[primary_layer_name] except KeyError: @@ -70,14 +92,14 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): return try: - phys_layer = primary.config["memory_layer"] + memory_layer_name = primary.config["memory_layer"] except KeyError: vollog.error( "Unable to obtain memory layer from primary layer. Please file a bug on GitHub about this issue." ) return - layer = context.layers[phys_layer] + layer = context.layers[memory_layer_name] # Yara Rule to scan for MFT Header Signatures rules = yarascan.YaraScan.process_yara_options( @@ -98,23 +120,24 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) # get each of the individual Field Sets - mft_object = symbol_table + constants.BANG + "MFT_ENTRY" - attribute_object = symbol_table + constants.BANG + "ATTRIBUTE" + mft_object_typ_name = symbol_table + constants.BANG + "MFT_ENTRY" + attribute_object_typ_name = symbol_table + constants.BANG + "ATTRIBUTE" - record_map = {} + record_map: DefaultDict[str, MFTRecord] = DefaultDict(MFTRecord) # Scan the layer for Raw MFT records and parse the fields for offset, _rule_name, _name, _value in layer.scan( context=context, scanner=yarascan.YaraScanner(rules=rules) ): with contextlib.suppress(exceptions.InvalidAddressException): - mft_record = context.object( - mft_object, offset=offset, layer_name=layer.name + mft_record: mft.MFTEntry = context.object( + mft_object_typ_name, offset=offset, layer_name=layer.name ) + # We will update this on each pass in the next loop and use it as the new offset. attr_base_offset = mft_record.FirstAttrOffset - attr = context.object( - attribute_object, + attr: mft.MFTAttribute = context.object( + attribute_object_typ_name, offset=offset + attr_base_offset, layer_name=layer.name, ) @@ -131,8 +154,8 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # Update the base offset to point to the next attribute attr_base_offset += attr.Attr_Header.Length # Get the next attribute - attr = context.object( - attribute_object, + attr: mft.MFTAttribute = context.object( + attribute_object_typ_name, offset=offset + attr_base_offset, layer_name=layer.name, ) @@ -140,9 +163,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def parse_mft_records( cls, - record_map: Dict[int, Tuple[str, int, int]], - mft_record: interfaces.objects.ObjectInterface, - attr: interfaces.objects.ObjectInterface, + record_map: DefaultDict[str, MFTRecord], + mft_record: mft.MFTEntry, + attr: mft.MFTAttribute, symbol_table_name: str, ): # MFT Flags determine the file type or dir @@ -160,7 +183,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): attr_data = attr.Attr_Data.cast(si_object) yield 0, ( format_hints.Hex(attr_data.vol.offset), - mft_record.get_signature(), + str(mft_record.get_signature()), mft_record.RecordNumber, mft_record.LinkCount, mft_flag, @@ -178,7 +201,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): fn_object = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" attr_data = attr.Attr_Data.cast(fn_object) - file_name = attr_data.get_full_name() + file_name = str(attr_data.get_full_name()) # If we don't have a valid enum, coerce to hex so we can keep the record try: @@ -188,7 +211,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): yield 1, ( format_hints.Hex(attr_data.vol.offset), - mft_record.get_signature(), + str(mft_record.get_signature()), mft_record.RecordNumber, mft_record.LinkCount, mft_flag, @@ -204,11 +227,11 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def parse_data_record( cls, - mft_record: interfaces.objects.ObjectInterface, - attr: interfaces.objects.ObjectInterface, - record_map: Dict[int, Tuple[str, int, int]], + mft_record: mft.MFTEntry, + attr: mft.MFTAttribute, + record_map: DefaultDict[str, MFTRecord], return_first_record: bool, - ) -> Generator[Iterable, None, None]: + ) -> Iterator[Tuple]: """ Returns the parsed data from a MFT record """ @@ -227,7 +250,12 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): else: # past the first $DATA record, attempt to get the ADS name # NotAvailableValue = > 1st Data, but name was not parsable - ads_name = attr.get_resident_filename() or renderers.NotAvailableValue() + ads_name_obj = attr.get_resident_filename() + ads_name = ( + str(ads_name_obj) + if ads_name_obj is not None + else renderers.NotAvailableValue() + ) content = attr.get_resident_filecontent() if content: @@ -236,11 +264,12 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): content = renderers.NotAvailableValue() yield ( - format_hints.Hex(record_map[mft_record.vol.offset][2]), - mft_record.get_signature(), + format_hints.Hex(record_map[mft_record.vol.offset].offset), + str(mft_record.get_signature()), mft_record.RecordNumber, attr.Attr_Header.AttrType.lookup(), - record_map[mft_record.vol.offset][0], + record_map[mft_record.vol.offset].record_name + or renderers.NotAvailableValue(), ads_name, content, ) @@ -248,41 +277,40 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): @classmethod def parse_data_records( cls, - record_map: Dict[int, Tuple[str, int, int]], - mft_record: interfaces.objects.ObjectInterface, - attr: interfaces.objects.ObjectInterface, + record_map: DefaultDict[str, MFTRecord], + mft_record: mft.MFTEntry, + attr: mft.MFTAttribute, symbol_table_name: str, return_first_record: bool, - ) -> Generator[Iterable, None, None]: + ) -> Iterator[Tuple]: """ Parses DATA records while maintaining the FILE_NAME association from previous parsing of the record Suports returning the first/main $DATA as well as however many ADS records a file might have """ - if mft_record.vol.offset not in record_map: - # file name, DATA count, offset - record_map[mft_record.vol.offset] = [renderers.NotAvailableValue(), 0, None] + rec = record_map[mft_record.vol.offset] + if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - fn_object = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" - attr_data = attr.Attr_Data.cast(fn_object) - rec_name = attr_data.get_full_name() - record_map[mft_record.vol.offset][0] = rec_name + fn_object_typename = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" + attr_data = attr.Attr_Data.cast(fn_object_typename) + name_obj = attr_data.get_full_name() + rec.record_name = str(name_obj) if name_obj is not None else None elif attr.Attr_Header.AttrType.lookup() == "DATA": # first data - record_map[mft_record.vol.offset][2] = attr.Attr_Data.vol.offset + rec.offset = attr.Attr_Data.vol.offset display_data = False # first DATA attribute of this record - if record_map[mft_record.vol.offset][1] == 0: + if rec.data_count == 0: if return_first_record: display_data = True - record_map[mft_record.vol.offset][1] = 1 + rec.data_count = 1 # at the second DATA attribute of this record - elif record_map[mft_record.vol.offset][1] == 1 and not return_first_record: + elif rec.data_count == 1 and not return_first_record: display_data = True if display_data: @@ -357,7 +385,7 @@ class ADS(interfaces.plugins.PluginInterface): @classmethod def parse_ads_data_records( cls, - record_map: Dict[int, Tuple[str, int, int]], + record_map: DefaultDict[str, MFTRecord], mft_record: interfaces.objects.ObjectInterface, attr: interfaces.objects.ObjectInterface, symbol_table_name: str, @@ -427,11 +455,11 @@ class ResidentData(interfaces.plugins.PluginInterface): @classmethod def parse_first_data_records( cls, - record_map: Dict[int, Tuple[str, int, int]], - mft_record: interfaces.objects.ObjectInterface, - attr: interfaces.objects.ObjectInterface, + record_map: DefaultDict[str, MFTRecord], + mft_record: mft.MFTEntry, + attr: mft.MFTAttribute, symbol_table_name: str, - ): + ) -> Iterator[Tuple]: return MFTScan.parse_data_records( record_map, mft_record, attr, symbol_table_name, True ) From 57524edb874a2dbb30ad2adba3d092f39757c4c4 Mon Sep 17 00:00:00 2001 From: David McDonald <49174690+dgmcdona@users.noreply.github.com> Date: Thu, 3 Apr 2025 09:58:35 -0500 Subject: [PATCH 0981/1352] Remove unnecessary quotes from type hints Co-authored-by: ikelos --- volatility3/framework/symbols/windows/extensions/mft.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 86580be16..9dd7f1a6a 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -10,7 +10,7 @@ from volatility3.framework import objects, constants, exceptions class MFTEntry(objects.StructType): """This represents the base MFT Record""" - def get_signature(self) -> "objects.String": + def get_signature(self) -> objects.String: signature = self.Signature.cast("string", max_length=4, encoding="latin-1") return signature @@ -18,7 +18,7 @@ class MFTEntry(objects.StructType): class MFTFileName(objects.StructType): """This represents an MFT $FILE_NAME Attribute""" - def get_full_name(self) -> "objects.String": + def get_full_name(self) -> objects.String: output = self.Name.cast( "string", encoding="utf16", max_length=self.NameLength * 2, errors="replace" ) @@ -28,7 +28,7 @@ class MFTFileName(objects.StructType): class MFTAttribute(objects.StructType): """This represents an MFT ATTRIBUTE""" - def get_resident_filename(self) -> Optional["objects.String"]: + def get_resident_filename(self) -> Optional[objects.String]: # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous if ( @@ -51,7 +51,7 @@ class MFTAttribute(objects.StructType): except exceptions.InvalidAddressException: return None - def get_resident_filecontent(self) -> Optional["objects.Bytes"]: + def get_resident_filecontent(self) -> Optional[objects.Bytes]: # smear observed in mass testing of samples # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems if ( From e84036c5a6b56f3899c339b04b445c4d81cbf7bc Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 10:02:08 -0500 Subject: [PATCH 0982/1352] Add missing 'e' to variable names --- .../framework/plugins/windows/mftscan.py | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 9281c964e..0c204ac1f 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -4,14 +4,7 @@ import contextlib import datetime import logging -from typing import ( - Callable, - Iterator, - Optional, - Tuple, - DefaultDict, -) - +from typing import Callable, DefaultDict, Iterator, Optional, Tuple from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements @@ -120,8 +113,8 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) # get each of the individual Field Sets - mft_object_typ_name = symbol_table + constants.BANG + "MFT_ENTRY" - attribute_object_typ_name = symbol_table + constants.BANG + "ATTRIBUTE" + mft_object_type_name = symbol_table + constants.BANG + "MFT_ENTRY" + attribute_object_type_name = symbol_table + constants.BANG + "ATTRIBUTE" record_map: DefaultDict[str, MFTRecord] = DefaultDict(MFTRecord) @@ -131,13 +124,13 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ): with contextlib.suppress(exceptions.InvalidAddressException): mft_record: mft.MFTEntry = context.object( - mft_object_typ_name, offset=offset, layer_name=layer.name + mft_object_type_name, offset=offset, layer_name=layer.name ) # We will update this on each pass in the next loop and use it as the new offset. attr_base_offset = mft_record.FirstAttrOffset attr: mft.MFTAttribute = context.object( - attribute_object_typ_name, + attribute_object_type_name, offset=offset + attr_base_offset, layer_name=layer.name, ) @@ -155,7 +148,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): attr_base_offset += attr.Attr_Header.Length # Get the next attribute attr: mft.MFTAttribute = context.object( - attribute_object_typ_name, + attribute_object_type_name, offset=offset + attr_base_offset, layer_name=layer.name, ) From b01c17f419266a71a3554d82e9d4aaa280785e9a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 3 Apr 2025 16:24:44 +0100 Subject: [PATCH 0983/1352] CLI: Fix bad typing issue in pretty printer Fixes #1759 --- volatility3/cli/text_renderer.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 3fd804d1b..044f33ed1 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -466,7 +466,9 @@ class PrettyTextRenderer(CLIRenderer): accumulator.append((node.path_depth, line)) return accumulator - final_output: List[Tuple[int, Dict[interfaces.renderers.Column, str]]] = [] + final_output: List[Tuple[int, Dict[interfaces.renderers.Column, list[str]]]] = ( + [] + ) if not grid.populated: grid.populate(visitor, final_output) else: @@ -503,7 +505,9 @@ class PrettyTextRenderer(CLIRenderer): if column in ignore_columns: del line[column] else: - line[column] = line[column] + ("" * (nums_line - len(line[column]))) + line[column] = line[column] + ( + [""] * (nums_line - len(line[column])) + ) for index in range(nums_line): if index == 0: outfd.write( From ed1b1f5369b75efb9a0a581c6757efce60efb7d6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 2 Apr 2025 21:10:06 +0100 Subject: [PATCH 0984/1352] Avoid bumping the version too quickly without reason --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 64707b782..a299f15a2 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 26 # Number of changes that only add to the interface -VERSION_PATCH = 0 # Number of changes that do not change the interface +VERSION_PATCH = 1 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From b1c16456575d4d771f5b7db25a3085b450dd6cd6 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 3 Apr 2025 16:38:55 +0100 Subject: [PATCH 0985/1352] volshell: inform user that value displayed is only an offset for types like embedded structs --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 1c70ceb0a..e80d65957 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -622,7 +622,7 @@ class Volshell(interfaces.plugins.PluginInterface): elif isinstance(value, objects.Array): return repr([self._display_value(val) for val in value]) else: - return hex(value.vol.offset) + return f"offset: {hex(value.vol.offset)}" else: # non volobject if value is None: From 4492da0263d866ed36d0e6f0b197789896d347b2 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 10:38:13 -0500 Subject: [PATCH 0986/1352] Create attribute iterator method Moves logic for iterating through `MFTEntry` attributes into a new `attributes()` method on the extension class. --- .../framework/plugins/windows/mftscan.py | 28 ++--------------- .../symbols/windows/extensions/mft.py | 31 ++++++++++++++++++- 2 files changed, 33 insertions(+), 26 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 0c204ac1f..78312f284 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -114,7 +114,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # get each of the individual Field Sets mft_object_type_name = symbol_table + constants.BANG + "MFT_ENTRY" - attribute_object_type_name = symbol_table + constants.BANG + "ATTRIBUTE" record_map: DefaultDict[str, MFTRecord] = DefaultDict(MFTRecord) @@ -127,30 +126,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): mft_object_type_name, offset=offset, layer_name=layer.name ) - # We will update this on each pass in the next loop and use it as the new offset. - attr_base_offset = mft_record.FirstAttrOffset - attr: mft.MFTAttribute = context.object( - attribute_object_type_name, - offset=offset + attr_base_offset, - layer_name=layer.name, - ) - - # There is no field that has a count of Attributes - # Keep Attempting to read attributes until we get an invalid attr_header.AttrType - while attr.Attr_Header.AttrType.is_valid_choice: - yield from attr_callback(record_map, mft_record, attr, symbol_table) - - # If there's no advancement the loop will never end, so break it now - if attr.Attr_Header.Length == 0: - break - - # Update the base offset to point to the next attribute - attr_base_offset += attr.Attr_Header.Length - # Get the next attribute - attr: mft.MFTAttribute = context.object( - attribute_object_type_name, - offset=offset + attr_base_offset, - layer_name=layer.name, + for attribute in mft_record.attributes(symbol_table): + yield from attr_callback( + record_map, mft_record, attribute, symbol_table ) @classmethod diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 9dd7f1a6a..4e1140e25 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Optional +from typing import Optional, Iterator from volatility3.framework import objects, constants, exceptions @@ -14,6 +14,35 @@ class MFTEntry(objects.StructType): signature = self.Signature.cast("string", max_length=4, encoding="latin-1") return signature + def attributes(self, symbol_table_name: str) -> Iterator["MFTAttribute"]: + # We will update this on each pass in the next loop and use it as the new offset. + attr_base_offset = self.FirstAttrOffset + attribute_object_type_name = symbol_table_name + constants.BANG + "ATTRIBUTE" + + attr: MFTAttribute = self._context.object( + attribute_object_type_name, + offset=self.vol.offset + attr_base_offset, + layer_name=self.vol.layer_name, + ) + + # There is no field that has a count of Attributes + # Keep Attempting to read attributes until we get an invalid attr_header.AttrType + while attr.Attr_Header.AttrType.is_valid_choice: + yield attr + + # If there's no advancement the loop will never end, so break it now + if attr.Attr_Header.Length == 0: + break + + # Update the base offset to point to the next attribute + attr_base_offset += attr.Attr_Header.Length + # Get the next attribute + attr: MFTAttribute = self._context.object( + attribute_object_type_name, + offset=self.vol.offset + attr_base_offset, + layer_name=self.vol.layer_name, + ) + class MFTFileName(objects.StructType): """This represents an MFT $FILE_NAME Attribute""" From 86945492a71c07d718bf5db8c95c87f31bf88f89 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 3 Apr 2025 16:49:27 +0100 Subject: [PATCH 0987/1352] Volshell: display if embedded struct offest is unreadable in dt output --- volatility3/cli/volshell/generic.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index e80d65957..a524efe38 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -622,7 +622,12 @@ class Volshell(interfaces.plugins.PluginInterface): elif isinstance(value, objects.Array): return repr([self._display_value(val) for val in value]) else: - return f"offset: {hex(value.vol.offset)}" + if self.context.layers[self.current_layer].is_valid( + value.vol.offset + ): + return f"offset: {hex(value.vol.offset)}" + else: + return f"offset: {hex(value.vol.offset)} (unreadable)" else: # non volobject if value is None: From 69e3c7d9aefb0b1964f82b7afd76c8ed2bb2782b Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 3 Apr 2025 17:01:21 +0100 Subject: [PATCH 0988/1352] Volshell: use built in formatting rather than hex() function --- volatility3/cli/volshell/generic.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 2021911ae..32a5bd933 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -636,9 +636,9 @@ class Volshell(interfaces.plugins.PluginInterface): if self.context.layers[self.current_layer].is_valid( value.vol.offset ): - return f"offset: {hex(value.vol.offset)}" + return f"offset: 0x{value.vol.offset:x}" else: - return f"offset: {hex(value.vol.offset)} (unreadable)" + return f"offset: 0x{value.vol.offset:x} (unreadable)" else: # non volobject if value is None: From 3b21b350f1e470c064396055e6e0c0c17c2940a6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 3 Apr 2025 17:04:18 +0100 Subject: [PATCH 0989/1352] Documentation: Add in a small section on the coding style about using f-string modifiers over separate calls --- CODING_STYLE.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CODING_STYLE.md b/CODING_STYLE.md index 700167258..520450fe8 100644 --- a/CODING_STYLE.md +++ b/CODING_STYLE.md @@ -83,6 +83,12 @@ Default Arguments Default arguments are fine, but not with mutable types (because they're constructed once at module load time and can lead to confusion/errors.) +Format strings +-------------- +Generally f-strings are preferred, and where possible a format modifier should be used over a separate method call. As an example, hex output should be `f"0x{offset:x}"` rather than `f"{hex(offset)}"`. +F-strings should be used over other formatting methods *except* in cases of logging where the f-string gets calculated/executed whether the log message is displayed or not (where as parameters are not evaluated if not needed). +The ruff linter should alert about these situations and exceptions can be maded if needed. + True/False Evaluations ---------------------- From 338c76c2ca8deb0a6f085e0effe7600f0f836ba9 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 3 Apr 2025 17:08:13 +0100 Subject: [PATCH 0990/1352] Documentation: Add in @dgmcdonna suggestions/corrections --- CODING_STYLE.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CODING_STYLE.md b/CODING_STYLE.md index 520450fe8..a4e248ffe 100644 --- a/CODING_STYLE.md +++ b/CODING_STYLE.md @@ -14,10 +14,10 @@ This is heavily based upon https://google.github.io/styleguide/pyguide.html with Imports ------- -Use import statements for packages and modules only, not for individual types, classes, or functions and ideally not aliased naming would cause confusion. This is to prevent people importing an imported method (which can lead to confusion and add in an unnecessary dependency in the import chain). +Use import statements for packages and modules only, not for individual types, classes, or functions and ideally not aliased unless the imported name would cause confusion. This is to prevent people from importing something that was itself imported from elsewhere (which can lead to confusion and add in an unnecessary dependency in the import chain). * Use `import x` for importing packages and modules. -* Use `from x import y where x` is the package prefix and y is the module name with no prefix. +* Use `from x import y` where x is the package prefix and y is the module name with no prefix. * Use `from x import y as z` in any of the following circumstances: * Two modules named `y` are to be imported. * `y` conflicts with a top-level name defined in the current module. From 43e6fefe395f901ec1ae01faf325b8a00c33e7b9 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 11:33:56 -0500 Subject: [PATCH 0991/1352] Add attribute iterator to MFTEntry extension class --- .../framework/plugins/windows/mftscan.py | 13 +++-- .../symbols/windows/extensions/mft.py | 56 +++++++++++++++++-- 2 files changed, 60 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 78312f284..0ad2747c3 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -100,7 +100,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) # Read in the Symbol File - symbol_table = intermed.IntermediateSymbolTable.create( + symbol_table_name = intermed.IntermediateSymbolTable.create( context=context, config_path=config_path, sub_path="windows", @@ -113,9 +113,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) # get each of the individual Field Sets - mft_object_type_name = symbol_table + constants.BANG + "MFT_ENTRY" record_map: DefaultDict[str, MFTRecord] = DefaultDict(MFTRecord) + mft_object_type_name = symbol_table_name + constants.BANG + "MFT_ENTRY" # Scan the layer for Raw MFT records and parse the fields for offset, _rule_name, _name, _value in layer.scan( @@ -123,12 +123,15 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ): with contextlib.suppress(exceptions.InvalidAddressException): mft_record: mft.MFTEntry = context.object( - mft_object_type_name, offset=offset, layer_name=layer.name + mft_object_type_name, + offset=offset, + layer_name=layer.name, + symbol_table_name=symbol_table_name, ) - for attribute in mft_record.attributes(symbol_table): + for attribute in mft_record.attributes(): yield from attr_callback( - record_map, mft_record, attribute, symbol_table + record_map, mft_record, attribute, symbol_table_name ) @classmethod diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 4e1140e25..e004aa590 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -2,22 +2,70 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Optional, Iterator +from typing import Dict, Iterator, List, Optional, Tuple -from volatility3.framework import objects, constants, exceptions +from volatility3.framework import constants, exceptions, interfaces, objects class MFTEntry(objects.StructType): """This represents the base MFT Record""" + def __init__( + self, + context: interfaces.context.ContextInterface, + type_name: str, + object_info: interfaces.objects.ObjectInformation, + size: int, + members: Dict[str, Tuple[int, interfaces.objects.Template]], + **kwargs, + ) -> None: + super().__init__(context, type_name, object_info, size, members) + + self._symbol_table_name = kwargs.get("symbol_table_name") + self._attr_generator = self._attributes() + self._attrs: List[MFTAttribute] = [] + + @property + def symbol_table_name(self) -> str: + if self._symbol_table_name is None: + raise ValueError( + "MFTEntry was instantiated without an MFT symbol table name" + ) + return self._symbol_table_name + def get_signature(self) -> objects.String: signature = self.Signature.cast("string", max_length=4, encoding="latin-1") return signature - def attributes(self, symbol_table_name: str) -> Iterator["MFTAttribute"]: + def filename(self, symbol_table_name: str) -> Optional[objects.String]: + try: + fname_attr = next( + attr + for attr in self.attributes() + if attr.Attr_Header.AttrType.lookup() == "FILE_NAME" + ) + except StopIteration: + return None + + fn_object = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" + attr_data = fname_attr.Attr_Data.cast(fn_object) + + return attr_data.get_full_name() + + def attributes(self) -> Iterator["MFTAttribute"]: + yield from self._attrs + + for attr in self._attr_generator: + self._attrs.append(attr) + yield attr + + def _attributes(self) -> Iterator["MFTAttribute"]: + # We will update this on each pass in the next loop and use it as the new offset. attr_base_offset = self.FirstAttrOffset - attribute_object_type_name = symbol_table_name + constants.BANG + "ATTRIBUTE" + attribute_object_type_name = ( + self.symbol_table_name + constants.BANG + "ATTRIBUTE" + ) attr: MFTAttribute = self._context.object( attribute_object_type_name, From 41cf17ed653eb5794c4fc7ba7146b296014882b5 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 16:43:57 -0500 Subject: [PATCH 0992/1352] Refactor: Ditch dictionary usage, eliminate callbacks This simplifies the design of these plugins by moving as much MFTEntry specific data into the extension class (caching attributes, since they'll need to be accessed repeatedly) and moving away from the callback-based implementation to one where classmethods consume `mft.MFTEntry` objects in order to produce their values. These changes do two important things: - They allow us to preserve `object.String` objects until the generator function, which makes the public interface much better since people can navigate back the the source of the data within their context - Completely eliminates the `record_map` that was causing so much memory consumption. --- .../framework/plugins/windows/mftscan.py | 437 +++++++++--------- .../symbols/windows/extensions/mft.py | 105 +++-- 2 files changed, 282 insertions(+), 260 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 0ad2747c3..a4cdad582 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -1,12 +1,11 @@ # This file is Copyright 2022 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import contextlib import datetime import logging -from typing import Callable, DefaultDict, Iterator, Optional, Tuple +from typing import Iterator, NamedTuple, Optional, Tuple, Union -from volatility3.framework import constants, exceptions, interfaces, renderers +from volatility3.framework import constants, exceptions, interfaces, objects, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import conversion, format_hints from volatility3.framework.symbols import intermed @@ -16,22 +15,6 @@ from volatility3.plugins import timeliner, yarascan vollog = logging.getLogger(__name__) -class MFTRecord: - # TODO: Change to dataclass with (slots=True) if/when we move minimum - # Python version up to 3.10 - __slots__ = ["record_name", "data_count", "offset"] - - def __init__( - self, - record_name: Optional[str] = None, - data_count: int = 0, - offset: Optional[int] = None, - ): - self.record_name = record_name - self.data_count = data_count - self.offset = offset - - class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for MFT FILE objects present in a particular windows memory image.""" @@ -39,6 +22,20 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _version = (2, 0, 1) + class MFTScanResult(NamedTuple): + offset: format_hints.Hex + record_type: str + record_number: int + link_count: int + mft_type: str + permissions: Union[str, interfaces.renderers.BaseAbsentValue] + attribute_type: str + created: Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] + modified: Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] + updated: Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] + accessed: Union[interfaces.renderers.BaseAbsentValue, datetime.datetime] + filename: Union[interfaces.renderers.BaseAbsentValue, objects.String] + @classmethod def get_requirements(cls): return [ @@ -66,16 +63,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): context: interfaces.context.ContextInterface, config_path: str, primary_layer_name: str, - attr_callback: Callable[ - [ - DefaultDict[str, MFTRecord], - mft.MFTEntry, - mft.MFTAttribute, - str, - ], - Iterator[Tuple], - ], - ) -> Iterator[Tuple]: + ) -> Iterator[mft.MFTEntry]: try: primary = context.layers[primary_layer_name] except KeyError: @@ -114,34 +102,25 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # get each of the individual Field Sets - record_map: DefaultDict[str, MFTRecord] = DefaultDict(MFTRecord) mft_object_type_name = symbol_table_name + constants.BANG + "MFT_ENTRY" # Scan the layer for Raw MFT records and parse the fields for offset, _rule_name, _name, _value in layer.scan( context=context, scanner=yarascan.YaraScanner(rules=rules) ): - with contextlib.suppress(exceptions.InvalidAddressException): - mft_record: mft.MFTEntry = context.object( - mft_object_type_name, - offset=offset, - layer_name=layer.name, - symbol_table_name=symbol_table_name, - ) + mft_record: mft.MFTEntry = context.object( + mft_object_type_name, + offset=offset, + layer_name=layer.name, + symbol_table_name=symbol_table_name, + ) - for attribute in mft_record.attributes(): - yield from attr_callback( - record_map, mft_record, attribute, symbol_table_name - ) + yield mft_record @classmethod - def parse_mft_records( - cls, - record_map: DefaultDict[str, MFTRecord], - mft_record: mft.MFTEntry, - attr: mft.MFTAttribute, - symbol_table_name: str, - ): + def parse_standard_information_records( + cls, mft_record: mft.MFTEntry + ) -> Iterator[Tuple[int, MFTScanResult]]: # MFT Flags determine the file type or dir # If we don't have a valid enum, coerce to hex so we can keep the record try: @@ -150,155 +129,104 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): mft_flag = hex(mft_record.Flags) # Standard Information Attribute - if attr.Attr_Header.AttrType.lookup() == "STANDARD_INFORMATION": - si_object = ( - symbol_table_name + constants.BANG + "STANDARD_INFORMATION_ENTRY" - ) - attr_data = attr.Attr_Data.cast(si_object) - yield 0, ( - format_hints.Hex(attr_data.vol.offset), - str(mft_record.get_signature()), - mft_record.RecordNumber, - mft_record.LinkCount, - mft_flag, - renderers.NotApplicableValue(), - attr.Attr_Header.AttrType.lookup(), - conversion.wintime_to_datetime(attr_data.CreationTime), - conversion.wintime_to_datetime(attr_data.ModifiedTime), - conversion.wintime_to_datetime(attr_data.UpdatedTime), - conversion.wintime_to_datetime(attr_data.AccessedTime), - renderers.NotApplicableValue(), - ) + try: + # There should only be one STANDARD_INFORMATION attribute, but we + # do this just in case. + for std_information in mft_record.standard_information_attributes(): + yield 0, cls.MFTScanResult( + format_hints.Hex(std_information.vol.offset), + str(mft_record.get_signature()), + mft_record.RecordNumber, + mft_record.LinkCount, + mft_flag, + renderers.NotApplicableValue(), + "STANDARD_INFORMATION", + conversion.wintime_to_datetime(std_information.CreationTime), + conversion.wintime_to_datetime(std_information.ModifiedTime), + conversion.wintime_to_datetime(std_information.UpdatedTime), + conversion.wintime_to_datetime(std_information.AccessedTime), + renderers.NotApplicableValue(), + ) + except exceptions.InvalidAddressException: + pass + + @classmethod + def parse_filename_records( + cls, mft_record: mft.MFTEntry + ) -> Iterator[Tuple[int, MFTScanResult]]: + # MFT Flags determine the file type or dir + # If we don't have a valid enum, coerce to hex so we can keep the record + try: + mft_flag = mft_record.Flags.lookup() + except ValueError: + mft_flag = hex(mft_record.Flags) # File Name Attribute - elif attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - fn_object = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" + try: + for filename_info in mft_record.filename_attributes(): - attr_data = attr.Attr_Data.cast(fn_object) - file_name = str(attr_data.get_full_name()) + # If we don't have a valid enum, coerce to hex so we can keep the record + try: + permissions = filename_info.Flags.lookup() + except ValueError: + permissions = hex(filename_info.Flags) - # If we don't have a valid enum, coerce to hex so we can keep the record - try: - permissions = attr_data.Flags.lookup() - except ValueError: - permissions = hex(attr_data.Flags) - - yield 1, ( - format_hints.Hex(attr_data.vol.offset), - str(mft_record.get_signature()), - mft_record.RecordNumber, - mft_record.LinkCount, - mft_flag, - permissions, - attr.Attr_Header.AttrType.lookup(), - conversion.wintime_to_datetime(attr_data.CreationTime), - conversion.wintime_to_datetime(attr_data.ModifiedTime), - conversion.wintime_to_datetime(attr_data.UpdatedTime), - conversion.wintime_to_datetime(attr_data.AccessedTime), - file_name, - ) - - @classmethod - def parse_data_record( - cls, - mft_record: mft.MFTEntry, - attr: mft.MFTAttribute, - record_map: DefaultDict[str, MFTRecord], - return_first_record: bool, - ) -> Iterator[Tuple]: - """ - Returns the parsed data from a MFT record - """ - # we only care about resident data - if attr.Attr_Header.NonResidentFlag: - return - - # we aren't looking ADS when we want the first data record - if return_first_record: - ads_name = renderers.NotApplicableValue() - - # skip records without a name if we want ADS entries - elif attr.Attr_Header.NameLength == 0: - return - - else: - # past the first $DATA record, attempt to get the ADS name - # NotAvailableValue = > 1st Data, but name was not parsable - ads_name_obj = attr.get_resident_filename() - ads_name = ( - str(ads_name_obj) - if ads_name_obj is not None - else renderers.NotAvailableValue() - ) - - content = attr.get_resident_filecontent() - if content: - content = renderers.LayerData.from_object(content) - else: - content = renderers.NotAvailableValue() - - yield ( - format_hints.Hex(record_map[mft_record.vol.offset].offset), - str(mft_record.get_signature()), - mft_record.RecordNumber, - attr.Attr_Header.AttrType.lookup(), - record_map[mft_record.vol.offset].record_name - or renderers.NotAvailableValue(), - ads_name, - content, - ) - - @classmethod - def parse_data_records( - cls, - record_map: DefaultDict[str, MFTRecord], - mft_record: mft.MFTEntry, - attr: mft.MFTAttribute, - symbol_table_name: str, - return_first_record: bool, - ) -> Iterator[Tuple]: - """ - Parses DATA records while maintaining the FILE_NAME association - from previous parsing of the record - Suports returning the first/main $DATA as well as however many - ADS records a file might have - """ - rec = record_map[mft_record.vol.offset] - - if attr.Attr_Header.AttrType.lookup() == "FILE_NAME": - fn_object_typename = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" - attr_data = attr.Attr_Data.cast(fn_object_typename) - name_obj = attr_data.get_full_name() - rec.record_name = str(name_obj) if name_obj is not None else None - elif attr.Attr_Header.AttrType.lookup() == "DATA": - # first data - rec.offset = attr.Attr_Data.vol.offset - - display_data = False - - # first DATA attribute of this record - if rec.data_count == 0: - if return_first_record: - display_data = True - - rec.data_count = 1 - - # at the second DATA attribute of this record - elif rec.data_count == 1 and not return_first_record: - display_data = True - - if display_data: - yield from cls.parse_data_record( - mft_record, attr, record_map, return_first_record + yield 1, cls.MFTScanResult( + format_hints.Hex(filename_info.vol.offset), + str(mft_record.get_signature()), + mft_record.RecordNumber, + mft_record.LinkCount, + mft_flag, + permissions, + "FILE_NAME", + conversion.wintime_to_datetime(filename_info.CreationTime), + conversion.wintime_to_datetime(filename_info.ModifiedTime), + conversion.wintime_to_datetime(filename_info.UpdatedTime), + conversion.wintime_to_datetime(filename_info.AccessedTime), + filename_info.get_full_name(), ) + except exceptions.InvalidAddressException: + return + + @classmethod + def parse_mft_records( + cls, + context: interfaces.context.ContextInterface, + config_path: str, + primary_layer_name: str, + ) -> Iterator[Tuple[int, MFTScanResult]]: + for mft_record in cls.enumerate_mft_records( + context=context, + config_path=config_path, + primary_layer_name=primary_layer_name, + ): + yield from cls.parse_standard_information_records(mft_record) + yield from cls.parse_filename_records(mft_record) def _generator(self): - yield from self.enumerate_mft_records( + for level, record in self.parse_mft_records( self.context, self.config_path, self.config["primary"], - self.parse_mft_records, - ) + ): + yield level, ( + record.offset, + record.record_type, + record.record_number, + record.link_count, + record.mft_type, + record.permissions, + record.attribute_type, + record.created, + record.modified, + record.updated, + record.accessed, + ( + str(record.filename) + if isinstance(record.filename, objects.String) + else record.filename + ), + ) def generate_timeline(self): for row in self._generator(): @@ -340,6 +268,15 @@ class ADS(interfaces.plugins.PluginInterface): _version = (1, 0, 2) + class ADSResult(NamedTuple): + offset: format_hints.Hex + signature: str + record_number: int + attribute_type: str + filename: Union[objects.String, interfaces.renderers.BaseAbsentValue] + stream_name: Union[objects.String, interfaces.renderers.BaseAbsentValue] + content: Union[renderers.LayerData, interfaces.renderers.BaseAbsentValue] + @classmethod def get_requirements(cls): return [ @@ -357,36 +294,57 @@ class ADS(interfaces.plugins.PluginInterface): ] @classmethod - def parse_ads_data_records( - cls, - record_map: DefaultDict[str, MFTRecord], - mft_record: interfaces.objects.ObjectInterface, - attr: interfaces.objects.ObjectInterface, - symbol_table_name: str, - ): - return MFTScan.parse_data_records( - record_map, mft_record, attr, symbol_table_name, False - ) + def parse_ads_data_records(cls, mft_record: mft.MFTEntry) -> Iterator[ADSResult]: + for data_attr in mft_record.alternate_data_streams(): + record_filename = ( + mft_record.longest_filename() or renderers.NotAvailableValue() + ) + content_obj = data_attr.get_resident_filecontent() + content = ( + renderers.LayerData.from_object(content_obj) + if content_obj + else renderers.NotAvailableValue() + ) + ads_filename = ( + data_attr.get_resident_filename() or renderers.NotAvailableValue() + ) + + yield cls.ADSResult( + format_hints.Hex(data_attr.Attr_Data.vol.offset), + mft_record.get_signature(), + mft_record.RecordNumber, + data_attr.Attr_Header.AttrType.lookup(), + record_filename, + ads_filename, + content, + ) def _generator(self): - for ( - offset, - rec_type, - rec_num, - attr_type, - file_name, - ads_name, - content, - ) in MFTScan.enumerate_mft_records( + for mft_entry in MFTScan.enumerate_mft_records( self.context, self.config_path, self.config["primary"], - self.parse_ads_data_records, ): - yield ( - 0, - (offset, rec_type, rec_num, attr_type, file_name, ads_name, content), - ) + for record in self.parse_ads_data_records(mft_entry): + # Convert to basic strings here __only__ because they'll use so + # much memory in the tree otherwise. + yield 0, ( + record.offset, + record.signature, + record.record_number, + record.attribute_type, + ( + str(record.filename) + if isinstance(record.filename, objects.String) + else record.filename + ), + ( + str(record.stream_name) + if isinstance(record.stream_name, objects.String) + else record.stream_name + ), + record.content, + ) def run(self): return renderers.TreeGrid( @@ -410,6 +368,14 @@ class ResidentData(interfaces.plugins.PluginInterface): _version = (1, 0, 2) + class ResidentDataResult(NamedTuple): + offset: format_hints.Hex + signature: str + record_number: int + attribute_type: str + filename: Union[objects.String, interfaces.renderers.BaseAbsentValue] + content: Union[renderers.LayerData, interfaces.renderers.BaseAbsentValue] + @classmethod def get_requirements(cls): return [ @@ -427,33 +393,46 @@ class ResidentData(interfaces.plugins.PluginInterface): ] @classmethod - def parse_first_data_records( + def parse_resident_data( cls, - record_map: DefaultDict[str, MFTRecord], mft_record: mft.MFTEntry, - attr: mft.MFTAttribute, - symbol_table_name: str, - ) -> Iterator[Tuple]: - return MFTScan.parse_data_records( - record_map, mft_record, attr, symbol_table_name, True + ) -> Optional[ResidentDataResult]: + """ + Returns the parsed data from a MFT record + """ + + try: + attr = next(mft_record.resident_data_attributes()) + except StopIteration: + return None + + content = attr.get_resident_filecontent() + if content: + content = renderers.LayerData.from_object(content) + else: + content = renderers.NotAvailableValue() + + # Choose the longest of the two, since it often includes a DOS 8.3 name + filename = mft_record.longest_filename() or renderers.NotAvailableValue() + + return cls.ResidentDataResult( + format_hints.Hex(attr.Attr_Data.vol.offset), + str(mft_record.get_signature()), + mft_record.RecordNumber, + attr.Attr_Header.AttrType.lookup(), + filename, + content, ) def _generator(self): - for ( - offset, - rec_type, - rec_num, - attr_type, - file_name, - _, - content, - ) in MFTScan.enumerate_mft_records( + for mft_record in MFTScan.enumerate_mft_records( self.context, self.config_path, self.config["primary"], - self.parse_first_data_records, ): - yield (0, (offset, rec_type, rec_num, attr_type, file_name, content)) + resident_data_entry = self.parse_resident_data(mft_record) + if resident_data_entry: + yield 0, resident_data_entry def run(self): return renderers.TreeGrid( diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index e004aa590..90ce6b6f2 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -22,7 +22,7 @@ class MFTEntry(objects.StructType): super().__init__(context, type_name, object_info, size, members) self._symbol_table_name = kwargs.get("symbol_table_name") - self._attr_generator = self._attributes() + self._attrs_loaded = False self._attrs: List[MFTAttribute] = [] @property @@ -37,27 +37,24 @@ class MFTEntry(objects.StructType): signature = self.Signature.cast("string", max_length=4, encoding="latin-1") return signature - def filename(self, symbol_table_name: str) -> Optional[objects.String]: - try: - fname_attr = next( - attr - for attr in self.attributes() - if attr.Attr_Header.AttrType.lookup() == "FILE_NAME" - ) - except StopIteration: - return None - - fn_object = symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" - attr_data = fname_attr.Attr_Data.cast(fn_object) - - return attr_data.get_full_name() - + @property def attributes(self) -> Iterator["MFTAttribute"]: + """ + Lazily evaluate and yield attributes, caching them in an internal list + for re-retrieval. + """ + if not self._attrs_loaded: + self._attrs = list(self._attributes()) + self._attrs_loaded = True + yield from self._attrs - for attr in self._attr_generator: - self._attrs.append(attr) - yield attr + def longest_filename(self) -> Optional[objects.String]: + names = [name.get_full_name() for name in self.filename_attributes()] + if not names: + return None + + return max(names, key=lambda x: len(str(x))) def _attributes(self) -> Iterator["MFTAttribute"]: @@ -75,21 +72,67 @@ class MFTEntry(objects.StructType): # There is no field that has a count of Attributes # Keep Attempting to read attributes until we get an invalid attr_header.AttrType - while attr.Attr_Header.AttrType.is_valid_choice: + try: + while attr.Attr_Header.AttrType.is_valid_choice: + yield attr + + # If there's no advancement the loop will never end, so break it now + if attr.Attr_Header.Length == 0: + break + + # Update the base offset to point to the next attribute + attr_base_offset += attr.Attr_Header.Length + # Get the next attribute + attr: MFTAttribute = self._context.object( + attribute_object_type_name, + offset=self.vol.offset + attr_base_offset, + layer_name=self.vol.layer_name, + ) + except exceptions.InvalidAddressException: + return + + def standard_information_attributes(self) -> Iterator[objects.StructType]: + for attr in self.attributes: + if attr.Attr_Header.AttrType.lookup() != "STANDARD_INFORMATION": + continue + + si_object = ( + self.symbol_table_name + constants.BANG + "STANDARD_INFORMATION_ENTRY" + ) + + yield attr.Attr_Data.cast(si_object) + + def filename_attributes(self) -> Iterator["MFTFileName"]: + for attr in self.attributes: + try: + if attr.Attr_Header.AttrType.lookup() != "FILE_NAME": + continue + + fn_object = self.symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" + attr_data = attr.Attr_Data.cast(fn_object) + except exceptions.InvalidAddressException: + continue + yield attr_data + + def _data_attributes(self): + for attr in self.attributes: + if not ( + attr.Attr_Header.AttrType.lookup() == "DATA" + and attr.Attr_Header.NonResidentFlag == 0 + ): + continue + yield attr - # If there's no advancement the loop will never end, so break it now - if attr.Attr_Header.Length == 0: - break + def resident_data_attributes(self) -> Iterator["MFTAttribute"]: + for attr in self._data_attributes(): + if attr.Attr_Header.NameLength == 0: + yield attr - # Update the base offset to point to the next attribute - attr_base_offset += attr.Attr_Header.Length - # Get the next attribute - attr: MFTAttribute = self._context.object( - attribute_object_type_name, - offset=self.vol.offset + attr_base_offset, - layer_name=self.vol.layer_name, - ) + def alternate_data_streams(self) -> Iterator["MFTAttribute"]: + for attr in self._data_attributes(): + if attr.Attr_Header.NameLength != 0: + yield attr class MFTFileName(objects.StructType): From 5fda7409eb4aabaeff611ea7a6b31eaff6cfd5a0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 17:09:02 -0500 Subject: [PATCH 0993/1352] Log `InvalidAddressException` instances --- .../symbols/windows/extensions/mft.py | 23 +++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 90ce6b6f2..4c5be81ee 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -2,10 +2,13 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging from typing import Dict, Iterator, List, Optional, Tuple from volatility3.framework import constants, exceptions, interfaces, objects +vollog = logging.getLogger(__name__) + class MFTEntry(objects.StructType): """This represents the base MFT Record""" @@ -88,7 +91,10 @@ class MFTEntry(objects.StructType): offset=self.vol.offset + attr_base_offset, layer_name=self.vol.layer_name, ) - except exceptions.InvalidAddressException: + except exceptions.InvalidAddressException as e: + vollog.debug( + f"Failed to read attribute at {attr.vol.offset:#x}: {e.__class__.__name__}" + ) return def standard_information_attributes(self) -> Iterator[objects.StructType]: @@ -110,7 +116,10 @@ class MFTEntry(objects.StructType): fn_object = self.symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" attr_data = attr.Attr_Data.cast(fn_object) - except exceptions.InvalidAddressException: + except exceptions.InvalidAddressException as e: + vollog.debug( + f"Failed to read attr at {attr.vol.offset:#x}: {e.__class__.__name__}" + ) continue yield attr_data @@ -168,7 +177,10 @@ class MFTAttribute(objects.StructType): encoding="utf16", ) return name - except exceptions.InvalidAddressException: + except exceptions.InvalidAddressException as e: + vollog.debug( + f"Failed to get resident file content due to {e.__class__.__name__}" + ) return None def get_resident_filecontent(self) -> Optional[objects.Bytes]: @@ -190,5 +202,8 @@ class MFTAttribute(objects.StructType): length=self.Attr_Header.ContentLength, ) return bytesobj - except exceptions.InvalidAddressException: + except exceptions.InvalidAddressException as e: + vollog.debug( + f"Failed to get resident file content due to {e.__class__.__name__}" + ) return None From 9f85e1465e2378f8dbbe5084ee436f5f978f9906 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 17:19:17 -0500 Subject: [PATCH 0994/1352] Major version bumps for all three plugins --- volatility3/framework/plugins/windows/mftscan.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index a4cdad582..5c8b419c3 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -20,7 +20,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) - _version = (2, 0, 1) + _version = (3, 0, 0) class MFTScanResult(NamedTuple): offset: format_hints.Hex @@ -266,7 +266,7 @@ class ADS(interfaces.plugins.PluginInterface): _required_framework_version = (2, 22, 0) - _version = (1, 0, 2) + _version = (2, 0, 0) class ADSResult(NamedTuple): offset: format_hints.Hex @@ -366,7 +366,7 @@ class ResidentData(interfaces.plugins.PluginInterface): _required_framework_version = (2, 22, 0) - _version = (1, 0, 2) + _version = (2, 0, 0) class ResidentDataResult(NamedTuple): offset: format_hints.Hex From 8b308133f532e389d2bf2d967f29e3f2f42adcd2 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 17:32:25 -0500 Subject: [PATCH 0995/1352] Bump required version numbers --- volatility3/framework/plugins/windows/mftscan.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 5c8b419c3..eacd43b8a 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -281,7 +281,7 @@ class ADS(interfaces.plugins.PluginInterface): def get_requirements(cls): return [ requirements.VersionRequirement( - name="MFTScan", component=MFTScan, version=(2, 0, 0) + name="MFTScan", component=MFTScan, version=(3, 0, 0) ), requirements.TranslationLayerRequirement( name="primary", @@ -380,7 +380,7 @@ class ResidentData(interfaces.plugins.PluginInterface): def get_requirements(cls): return [ requirements.VersionRequirement( - name="MFTScan", component=MFTScan, version=(2, 0, 0) + name="MFTScan", component=MFTScan, version=(3, 0, 0) ), requirements.TranslationLayerRequirement( name="primary", From 1d20e6575908e118ad71746ff9d64b6cd5d23d9f Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 17:39:14 -0500 Subject: [PATCH 0996/1352] Add versioning to MFT extension classes --- .../framework/plugins/windows/mftscan.py | 15 ++++++++++++ .../symbols/windows/extensions/mft.py | 24 ++++++++++++++++--- 2 files changed, 36 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index eacd43b8a..7df895f15 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -49,6 +49,21 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): component=timeliner.TimeLinerInterface, version=(1, 0, 0), ), + requirements.VersionRequirement( + name="mft_entry", + component=mft.MFTEntry, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="mft_filename", + component=mft.MFTFileName, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="mft_attribute", + component=mft.MFTAttribute, + version=(1, 0, 0), + ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) ), diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 4c5be81ee..32261c4ff 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -5,14 +5,20 @@ import logging from typing import Dict, Iterator, List, Optional, Tuple +from volatility3 import framework from volatility3.framework import constants, exceptions, interfaces, objects vollog = logging.getLogger(__name__) -class MFTEntry(objects.StructType): +class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface): """This represents the base MFT Record""" + _version = (1, 0, 0) + _required_framework_version = (2, 26, 0) + + framework.require_interface_version(*_required_framework_version) + def __init__( self, context: interfaces.context.ContextInterface, @@ -144,9 +150,15 @@ class MFTEntry(objects.StructType): yield attr -class MFTFileName(objects.StructType): +class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterface): """This represents an MFT $FILE_NAME Attribute""" + _version = (1, 0, 0) + + _required_framework_version = (2, 26, 0) + + framework.require_interface_version(*_required_framework_version) + def get_full_name(self) -> objects.String: output = self.Name.cast( "string", encoding="utf16", max_length=self.NameLength * 2, errors="replace" @@ -154,9 +166,15 @@ class MFTFileName(objects.StructType): return output -class MFTAttribute(objects.StructType): +class MFTAttribute(objects.StructType, interfaces.configuration.VersionableInterface): """This represents an MFT ATTRIBUTE""" + _version = (1, 0, 0) + + _required_framework_version = (2, 26, 0) + + framework.require_interface_version(*_required_framework_version) + def get_resident_filename(self) -> Optional[objects.String]: # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous From ebbbe913dc92d609b8315a9d1761ee8eab8791d5 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 17:55:28 -0500 Subject: [PATCH 0997/1352] Convert remaining values to Python primitives --- .../framework/plugins/windows/mftscan.py | 37 +++++++++++++++---- 1 file changed, 30 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 7df895f15..cb4b880d5 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -224,11 +224,17 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): self.config_path, self.config["primary"], ): + # Convert all `objects.PrimitiveObject` to their simpler Python + # types. This is normally not something we would do, since it's + # lossy and prevents users from getting back to the data source, + # but in this case memory usage is so extreme due to the number of + # records that it becomes necessary. The rich types are still + # exposed through classmethods. yield level, ( record.offset, record.record_type, - record.record_number, - record.link_count, + int(record.record_number), + int(record.link_count), record.mft_type, record.permissions, record.attribute_type, @@ -341,12 +347,16 @@ class ADS(interfaces.plugins.PluginInterface): self.config["primary"], ): for record in self.parse_ads_data_records(mft_entry): - # Convert to basic strings here __only__ because they'll use so - # much memory in the tree otherwise. + # Convert all `objects.PrimitiveObject` to their simpler Python + # types. This is normally not something we would do, since it's + # lossy and prevents users from getting back to the data source, + # but in this case memory usage is so extreme due to the number of + # records that it becomes necessary. The rich types are still + # exposed through classmethods. yield 0, ( record.offset, - record.signature, - record.record_number, + str(record.signature), + int(record.record_number), record.attribute_type, ( str(record.filename) @@ -447,7 +457,20 @@ class ResidentData(interfaces.plugins.PluginInterface): ): resident_data_entry = self.parse_resident_data(mft_record) if resident_data_entry: - yield 0, resident_data_entry + # Convert all `objects.PrimitiveObject` to their simpler Python + # types. This is normally not something we would do, since it's + # lossy and prevents users from getting back to the data source, + # but in this case memory usage is so extreme due to the number of + # records that it becomes necessary. The rich types are still + # exposed through classmethods. + yield 0, ( + resident_data_entry.offset, + resident_data_entry.signature, + int(resident_data_entry.record_number), + resident_data_entry.attribute_type, + str(resident_data_entry.filename), + resident_data_entry.content, + ) def run(self): return renderers.TreeGrid( From 41de562e550424a43fecbebf5f6560be3ec66571 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 17:56:16 -0500 Subject: [PATCH 0998/1352] Revert "Add versioning to MFT extension classes" This reverts commit 1d20e6575908e118ad71746ff9d64b6cd5d23d9f. --- .../framework/plugins/windows/mftscan.py | 15 ------------ .../symbols/windows/extensions/mft.py | 24 +++---------------- 2 files changed, 3 insertions(+), 36 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index cb4b880d5..f50801c70 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -49,21 +49,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): component=timeliner.TimeLinerInterface, version=(1, 0, 0), ), - requirements.VersionRequirement( - name="mft_entry", - component=mft.MFTEntry, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="mft_filename", - component=mft.MFTFileName, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="mft_attribute", - component=mft.MFTAttribute, - version=(1, 0, 0), - ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) ), diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 32261c4ff..4c5be81ee 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -5,20 +5,14 @@ import logging from typing import Dict, Iterator, List, Optional, Tuple -from volatility3 import framework from volatility3.framework import constants, exceptions, interfaces, objects vollog = logging.getLogger(__name__) -class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface): +class MFTEntry(objects.StructType): """This represents the base MFT Record""" - _version = (1, 0, 0) - _required_framework_version = (2, 26, 0) - - framework.require_interface_version(*_required_framework_version) - def __init__( self, context: interfaces.context.ContextInterface, @@ -150,15 +144,9 @@ class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface yield attr -class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterface): +class MFTFileName(objects.StructType): """This represents an MFT $FILE_NAME Attribute""" - _version = (1, 0, 0) - - _required_framework_version = (2, 26, 0) - - framework.require_interface_version(*_required_framework_version) - def get_full_name(self) -> objects.String: output = self.Name.cast( "string", encoding="utf16", max_length=self.NameLength * 2, errors="replace" @@ -166,15 +154,9 @@ class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterf return output -class MFTAttribute(objects.StructType, interfaces.configuration.VersionableInterface): +class MFTAttribute(objects.StructType): """This represents an MFT ATTRIBUTE""" - _version = (1, 0, 0) - - _required_framework_version = (2, 26, 0) - - framework.require_interface_version(*_required_framework_version) - def get_resident_filename(self) -> Optional[objects.String]: # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous From de117042fe748e855ce48378d4cbf83ecd1f922b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 18:04:43 -0500 Subject: [PATCH 0999/1352] Remove symbol_table_name from object constructor Get from `self.vol.type_name` instead --- volatility3/framework/plugins/windows/mftscan.py | 1 - volatility3/framework/symbols/windows/extensions/mft.py | 8 +------- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index f50801c70..6aa0142c0 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -112,7 +112,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): mft_object_type_name, offset=offset, layer_name=layer.name, - symbol_table_name=symbol_table_name, ) yield mft_record diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 4c5be81ee..8f994752a 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -20,21 +20,15 @@ class MFTEntry(objects.StructType): object_info: interfaces.objects.ObjectInformation, size: int, members: Dict[str, Tuple[int, interfaces.objects.Template]], - **kwargs, ) -> None: super().__init__(context, type_name, object_info, size, members) - self._symbol_table_name = kwargs.get("symbol_table_name") self._attrs_loaded = False self._attrs: List[MFTAttribute] = [] @property def symbol_table_name(self) -> str: - if self._symbol_table_name is None: - raise ValueError( - "MFTEntry was instantiated without an MFT symbol table name" - ) - return self._symbol_table_name + return self.vol.type_name.split(constants.BANG)[0] def get_signature(self) -> objects.String: signature = self.Signature.cast("string", max_length=4, encoding="latin-1") From a5dfc6acb3264e4c13b9d20f1fe66917eb3e848b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 18:06:23 -0500 Subject: [PATCH 1000/1352] Bump required framework version on all three MFTScan plugins --- volatility3/framework/plugins/windows/mftscan.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 6aa0142c0..aab32593a 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -18,7 +18,7 @@ vollog = logging.getLogger(__name__) class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Scans for MFT FILE objects present in a particular windows memory image.""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 26, 0) _version = (3, 0, 0) @@ -269,7 +269,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): class ADS(interfaces.plugins.PluginInterface): """Scans for Alternate Data Stream""" - _required_framework_version = (2, 22, 0) + _required_framework_version = (2, 26, 0) _version = (2, 0, 0) @@ -373,7 +373,7 @@ class ADS(interfaces.plugins.PluginInterface): class ResidentData(interfaces.plugins.PluginInterface): """Scans for MFT Records with Resident Data""" - _required_framework_version = (2, 22, 0) + _required_framework_version = (2, 26, 0) _version = (2, 0, 0) From 8428e81f0318cc00ede336075ba7a8c7bb7416cb Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 4 Apr 2025 10:30:46 -0500 Subject: [PATCH 1001/1352] Fix up remaining type-hints Updates type hints on some fields of the result namedtuples to be their `objects.Primitive` types instead of Python primitives, and does any conversion to Python primitives in the generator methods. --- volatility3/framework/plugins/windows/mftscan.py | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index aab32593a..3f59f1aa6 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -25,8 +25,8 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): class MFTScanResult(NamedTuple): offset: format_hints.Hex record_type: str - record_number: int - link_count: int + record_number: objects.Integer + link_count: objects.Integer mft_type: str permissions: Union[str, interfaces.renderers.BaseAbsentValue] attribute_type: str @@ -275,8 +275,8 @@ class ADS(interfaces.plugins.PluginInterface): class ADSResult(NamedTuple): offset: format_hints.Hex - signature: str - record_number: int + signature: objects.String + record_number: objects.Integer attribute_type: str filename: Union[objects.String, interfaces.renderers.BaseAbsentValue] stream_name: Union[objects.String, interfaces.renderers.BaseAbsentValue] @@ -379,7 +379,7 @@ class ResidentData(interfaces.plugins.PluginInterface): class ResidentDataResult(NamedTuple): offset: format_hints.Hex - signature: str + signature: objects.String record_number: int attribute_type: str filename: Union[objects.String, interfaces.renderers.BaseAbsentValue] @@ -426,7 +426,7 @@ class ResidentData(interfaces.plugins.PluginInterface): return cls.ResidentDataResult( format_hints.Hex(attr.Attr_Data.vol.offset), - str(mft_record.get_signature()), + mft_record.get_signature(), mft_record.RecordNumber, attr.Attr_Header.AttrType.lookup(), filename, @@ -449,7 +449,7 @@ class ResidentData(interfaces.plugins.PluginInterface): # exposed through classmethods. yield 0, ( resident_data_entry.offset, - resident_data_entry.signature, + str(resident_data_entry.signature), int(resident_data_entry.record_number), resident_data_entry.attribute_type, str(resident_data_entry.filename), From b15e9104e8b3e581e904b1b58e2031f233044b21 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 4 Apr 2025 10:32:13 -0500 Subject: [PATCH 1002/1352] Rename methods, add docstrings Improves the naming of a couple of the new extension class methods to more accurately reflect the return type, and adds docstrings to extensions class methods. --- .../framework/plugins/windows/mftscan.py | 4 +- .../symbols/windows/extensions/mft.py | 41 ++++++++++++++++--- 2 files changed, 38 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index 3f59f1aa6..e7390d699 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -131,7 +131,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): try: # There should only be one STANDARD_INFORMATION attribute, but we # do this just in case. - for std_information in mft_record.standard_information_attributes(): + for std_information in mft_record.standard_information_entries(): yield 0, cls.MFTScanResult( format_hints.Hex(std_information.vol.offset), str(mft_record.get_signature()), @@ -162,7 +162,7 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # File Name Attribute try: - for filename_info in mft_record.filename_attributes(): + for filename_info in mft_record.filename_entries(): # If we don't have a valid enum, coerce to hex so we can keep the record try: diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 8f994752a..bf20c1ffc 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -47,7 +47,7 @@ class MFTEntry(objects.StructType): yield from self._attrs def longest_filename(self) -> Optional[objects.String]: - names = [name.get_full_name() for name in self.filename_attributes()] + names = [name.get_full_name() for name in self.filename_entries()] if not names: return None @@ -91,9 +91,17 @@ class MFTEntry(objects.StructType): ) return - def standard_information_attributes(self) -> Iterator[objects.StructType]: + def standard_information_entries( + self, + ) -> Iterator[objects.StructType]: + """ + Yields a STANDARD_INFORMATION struct for each of the + STANDARD_INFORMATION attributes in this MFT record (although there + should only be one per record). + """ for attr in self.attributes: - if attr.Attr_Header.AttrType.lookup() != "STANDARD_INFORMATION": + attr_type = attr.Attr_Header.AttrType.lookup() + if attr_type != "STANDARD_INFORMATION": continue si_object = ( @@ -102,10 +110,16 @@ class MFTEntry(objects.StructType): yield attr.Attr_Data.cast(si_object) - def filename_attributes(self) -> Iterator["MFTFileName"]: + def filename_entries(self) -> Iterator["MFTFileName"]: + """ + Yields an MFT Filename for each of the FILE_NAME attributes contained + in this MFT record. There are often two - one for the long filename, + and the other with the DOS 8.3 short name. + """ for attr in self.attributes: try: - if attr.Attr_Header.AttrType.lookup() != "FILE_NAME": + attr_type = attr.Attr_Header.AttrType.lookup() + if attr_type != "FILE_NAME": continue fn_object = self.symbol_table_name + constants.BANG + "FILE_NAME_ENTRY" @@ -128,11 +142,18 @@ class MFTEntry(objects.StructType): yield attr def resident_data_attributes(self) -> Iterator["MFTAttribute"]: + """ + Yields all MFT attributes that contain resident data for the primary + stream. + """ for attr in self._data_attributes(): if attr.Attr_Header.NameLength == 0: yield attr def alternate_data_streams(self) -> Iterator["MFTAttribute"]: + """ + Yields all MFT attributes that contain alternate data streams (ADS). + """ for attr in self._data_attributes(): if attr.Attr_Header.NameLength != 0: yield attr @@ -142,6 +163,9 @@ class MFTFileName(objects.StructType): """This represents an MFT $FILE_NAME Attribute""" def get_full_name(self) -> objects.String: + """ + Returns the UTF-16 decoded filename. + """ output = self.Name.cast( "string", encoding="utf16", max_length=self.NameLength * 2, errors="replace" ) @@ -152,6 +176,9 @@ class MFTAttribute(objects.StructType): """This represents an MFT ATTRIBUTE""" def get_resident_filename(self) -> Optional[objects.String]: + """ + Returns the resident filename (typically for an Alternate Data Stream (ADS)). + """ # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous if ( @@ -178,6 +205,10 @@ class MFTAttribute(objects.StructType): return None def get_resident_filecontent(self) -> Optional[objects.Bytes]: + """ + Returns the file content that is resident within this MFT attribute, + for either the primary or an alternate data stream. + """ # smear observed in mass testing of samples # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems if ( From a0ca33b284e41471b56dc6c0dc4e15f39f30383e Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 4 Apr 2025 11:29:48 -0500 Subject: [PATCH 1003/1352] Also yield STANDARD_INFORMATION timestamps in timeliner --- volatility3/framework/plugins/windows/mftscan.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index e7390d699..bce832d5e 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -238,9 +238,9 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _depth, row_data = row # Only Output FN Records - if row_data[6] == "FILE_NAME": + if row_data[6] in ("FILE_NAME", "STANDARD_INFORMATION"): filename = row_data[-1] - description = f"MFT FILE_NAME entry for {filename}" + description = f"MFT {row_data[6]} entry for {filename}" yield (description, timeliner.TimeLinerType.CREATED, row_data[7]) yield (description, timeliner.TimeLinerType.MODIFIED, row_data[8]) yield (description, timeliner.TimeLinerType.CHANGED, row_data[9]) From 39b3e76efc521bbdd314d8ed6db3d6cfd0fca6d5 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Fri, 4 Apr 2025 17:46:46 -0500 Subject: [PATCH 1004/1352] Add a filename to STANDARD_INFORMATION timeline entries --- .../framework/plugins/windows/mftscan.py | 27 ++++++++++++------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index bce832d5e..f0be3cf7f 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -234,17 +234,24 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) def generate_timeline(self): - for row in self._generator(): - _depth, row_data = row + for record in self.enumerate_mft_records( + self.context, self.config_path, self.config["primary"] + ): + fname = record.longest_filename() - # Only Output FN Records - if row_data[6] in ("FILE_NAME", "STANDARD_INFORMATION"): - filename = row_data[-1] - description = f"MFT {row_data[6]} entry for {filename}" - yield (description, timeliner.TimeLinerType.CREATED, row_data[7]) - yield (description, timeliner.TimeLinerType.MODIFIED, row_data[8]) - yield (description, timeliner.TimeLinerType.CHANGED, row_data[9]) - yield (description, timeliner.TimeLinerType.ACCESSED, row_data[10]) + for _, item in self.parse_standard_information_records(record): + description = f"MFT {item.attribute_type} entry for {fname}" + yield (description, timeliner.TimeLinerType.CREATED, item.created) + yield (description, timeliner.TimeLinerType.MODIFIED, item.modified) + yield (description, timeliner.TimeLinerType.CHANGED, item.updated) + yield (description, timeliner.TimeLinerType.ACCESSED, item.accessed) + + for _, item in self.parse_filename_records(record): + description = f"MFT {item.attribute_type} entry for {item.filename}" + yield (description, timeliner.TimeLinerType.CREATED, item.created) + yield (description, timeliner.TimeLinerType.MODIFIED, item.modified) + yield (description, timeliner.TimeLinerType.CHANGED, item.updated) + yield (description, timeliner.TimeLinerType.ACCESSED, item.accessed) def run(self): return renderers.TreeGrid( From 9dcb359e322bf040a2c706308872535a94ce02ea Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 7 Apr 2025 14:56:19 +0100 Subject: [PATCH 1005/1352] Ensure the release branch has the right version number --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index a299f15a2..64707b782 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 26 # Number of changes that only add to the interface -VERSION_PATCH = 1 # Number of changes that do not change the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From e9a4ea1a9c4f9fe18571ec9734406f60de2c0b99 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 7 Apr 2025 15:39:23 -0500 Subject: [PATCH 1006/1352] Fix traceback in volshell's `dt()` A `SymbolError` can occur when a type contains a pointer to an opaque type. For example, `_EPROCESS` can have a member that points to an `_EPROCESS_QUOTA_BLOCK`, but there is no definition for that type, so its size and readability can't be determined. This wraps the block in a try/except, and reports that the type has an unknown size in the suffix if a `SymbolError` occurs. --- volatility3/cli/volshell/generic.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 32a5bd933..7c85eec5f 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -621,12 +621,15 @@ class Volshell(interfaces.plugins.PluginInterface): if isinstance(value, objects.Pointer): # show pointers in hex to match output for struct addrs # highlight null or unreadable pointers - if value == 0: - suffix = " (null pointer)" - elif not value.is_readable(): - suffix = " (unreadable pointer)" - else: - suffix = "" + try: + if value == 0: + suffix = " (null pointer)" + elif not value.is_readable(): + suffix = " (unreadable pointer)" + else: + suffix = "" + except exceptions.SymbolError as exc: + suffix = f" (pointer to {exc.symbol_name} - unknown size)" return f"{hex(value)}{suffix}" elif isinstance(value, objects.PrimitiveObject): return repr(value) From 195f4154e97c5134ee390f0cbe81e0eef156225c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 7 Apr 2025 16:18:22 -0500 Subject: [PATCH 1007/1352] Shorten suffix --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 7c85eec5f..2ea722a37 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -629,7 +629,7 @@ class Volshell(interfaces.plugins.PluginInterface): else: suffix = "" except exceptions.SymbolError as exc: - suffix = f" (pointer to {exc.symbol_name} - unknown size)" + suffix = f" (unknown sized {exc.symbol_name})" return f"{hex(value)}{suffix}" elif isinstance(value, objects.PrimitiveObject): return repr(value) From 0882fd0b779f718981f92179ec9a99152b7e70a2 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 7 Apr 2025 15:39:23 -0500 Subject: [PATCH 1008/1352] Fix traceback in volshell's `dt()` A `SymbolError` can occur when a type contains a pointer to an opaque type. For example, `_EPROCESS` can have a member that points to an `_EPROCESS_QUOTA_BLOCK`, but there is no definition for that type, so its size and readability can't be determined. This wraps the block in a try/except, and reports that the type has an unknown size in the suffix if a `SymbolError` occurs. --- volatility3/cli/volshell/generic.py | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 32a5bd933..7c85eec5f 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -621,12 +621,15 @@ class Volshell(interfaces.plugins.PluginInterface): if isinstance(value, objects.Pointer): # show pointers in hex to match output for struct addrs # highlight null or unreadable pointers - if value == 0: - suffix = " (null pointer)" - elif not value.is_readable(): - suffix = " (unreadable pointer)" - else: - suffix = "" + try: + if value == 0: + suffix = " (null pointer)" + elif not value.is_readable(): + suffix = " (unreadable pointer)" + else: + suffix = "" + except exceptions.SymbolError as exc: + suffix = f" (pointer to {exc.symbol_name} - unknown size)" return f"{hex(value)}{suffix}" elif isinstance(value, objects.PrimitiveObject): return repr(value) From 4a528d55a57298c81efb63900e92f2c5f406f6b5 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 7 Apr 2025 16:18:22 -0500 Subject: [PATCH 1009/1352] Shorten suffix --- volatility3/cli/volshell/generic.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 7c85eec5f..2ea722a37 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -629,7 +629,7 @@ class Volshell(interfaces.plugins.PluginInterface): else: suffix = "" except exceptions.SymbolError as exc: - suffix = f" (pointer to {exc.symbol_name} - unknown size)" + suffix = f" (unknown sized {exc.symbol_name})" return f"{hex(value)}{suffix}" elif isinstance(value, objects.PrimitiveObject): return repr(value) From 4045b6cc8e99a9610d1b39370b3fb2a80f666741 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 8 Apr 2025 09:30:31 -0500 Subject: [PATCH 1010/1352] InodePages: Add output column and render when dumped Previously, the InodePages plugin wasn't rendering treegrid columns when the `--dump` flag was passed. This fixes that, and adds an additional `Output File` column that displays the name of the file containing the dumped data. --- volatility3/framework/plugins/linux/pagecache.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 0bb3b9263..60b8b066b 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -8,7 +8,7 @@ import datetime import time import tarfile from dataclasses import dataclass, astuple -from typing import IO, List, Set, Type, Iterable, Tuple +from typing import IO, List, Set, Type, Iterable, Tuple, Union from io import BytesIO from pathlib import PurePath @@ -541,6 +541,7 @@ class InodePages(plugins.PluginInterface): self, inode: interfaces.objects.ObjectInterface, vmlinux_layer: interfaces.layers.TranslationLayerInterface, + filename: Union[renderers.NotApplicableValue, str], ) -> Iterable[Tuple[int, int, int, int, bool, str]]: inode_size = inode.i_size try: @@ -569,6 +570,7 @@ class InodePages(plugins.PluginInterface): page_index, dump_safe, page_flags, + filename, ) yield 0, fields @@ -610,6 +612,7 @@ class InodePages(plugins.PluginInterface): vollog.error("The inode is not a regular file") return None + filename = renderers.NotApplicableValue() if self.config["dump"]: open_method = self.open inode_address = inode.vol.offset @@ -618,8 +621,7 @@ class InodePages(plugins.PluginInterface): self.write_inode_content_to_file( self.context, vmlinux_layer.name, inode, filename, open_method ) - else: - yield from self._generate_inode_fields(inode, vmlinux_layer) + yield from self._generate_inode_fields(inode, vmlinux_layer, filename) def run(self): headers = [ @@ -629,6 +631,7 @@ class InodePages(plugins.PluginInterface): ("Index", int), ("DumpSafe", bool), ("Flags", str), + ("Output File", str), ] return renderers.TreeGrid( From 5cc8e360731b27563290f4e40da73b0d00e02364 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 8 Apr 2025 16:04:25 +0100 Subject: [PATCH 1011/1352] Documentation: Improve the readme to make quickstart the first thing people see --- README.md | 58 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 31 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 4f5a0a37e..3c8698c12 100644 --- a/README.md +++ b/README.md @@ -14,10 +14,33 @@ technical and performance challenges associated with the original code base that became apparent over the previous 10 years. Another benefit of the rewrite is that Volatility 3 could be released under a custom license that was more aligned with the goals of the Volatility community, -the Volatility Software License (VSL). See the -[LICENSE](https://www.volatilityfoundation.org/license/vsl-v1.0) file for +the Volatility Software License (VSL). See the +[LICENSE](https://www.volatilityfoundation.org/license/vsl-v1.0) file for more details. +## Quick Start + +1. Install the required dependencies: + + ```shell + pip install --user -e. + ``` + +2. See available options: + + ```shell + vol -h + ``` + +3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `vol -f windows.info`: + + ```shell + vol -f /home/user/samples/stuxnet.vmem windows.info + ``` + +4. Run some other plugins. The `-f` or `--single-location` is not strictly required, but most plugins expect a single sample. +Some also require/accept other options. Run `vol -h` for more information on a particular command. + ## Installing Volatility 3 requires Python 3.8.0 or later and is published on the [PyPi registry](https://pypi.org/project/volatility3). @@ -38,38 +61,19 @@ python3 -m venv venv && . venv/bin/activate pip install -e ".[dev]" ``` -## Quick Start - -1. Install Volatility 3 as documented in the Installing section of the readme. - -2. See available options: - - ```shell - vol -h - ``` - -3. To get more information on a Windows memory sample and to make sure Volatility supports that sample type, run `vol -f windows.info`: - - ```shell - vol -f /home/user/samples/stuxnet.vmem windows.info - ``` - -4. Run some other plugins. The `-f` or `--single-location` is not strictly required, but most plugins expect a single sample. -Some also require/accept other options. Run `vol -h` for more information on a particular command. - ## Symbol Tables Symbol table packs for the various operating systems are available for download at: - - - + + + The hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at: - - - + + + Symbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file). From 54f64fcab897672ba6a5a66f8ae1449b38fa1804 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 8 Apr 2025 19:48:15 +0200 Subject: [PATCH 1012/1352] comparison harness: module alignment --- volatility3/framework/symbols/linux/utilities/modules.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 62ebeef03..16ce93441 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -474,10 +474,9 @@ class Modules(interfaces.configuration.VersionableInterface): Returns: The struct module alignment """ - # FIXME: When dwarf2json/ISF supports type alignments. Read it directly from the type metadata - # Additionally, while 'context' and 'vmlinux_module_name' are currently unused, they will be - # essential for retrieving type metadata in the future. - return 64 + # Not L1 cache aligned, but compiler should naturally + # align to the referenced type as a minimum. + return context.modules[vmlinux_module_name].get_type("pointer").size @classmethod def list_modules( From f9bd9fb94e1599a11df56cd8bfbf4f115b176fcf Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 8 Apr 2025 20:08:15 +0200 Subject: [PATCH 1013/1352] comment wasn't really applicable here --- volatility3/framework/symbols/linux/utilities/modules.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 16ce93441..1c675a283 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -474,8 +474,6 @@ class Modules(interfaces.configuration.VersionableInterface): Returns: The struct module alignment """ - # Not L1 cache aligned, but compiler should naturally - # align to the referenced type as a minimum. return context.modules[vmlinux_module_name].get_type("pointer").size @classmethod From ac8a1101ce317a8724d8c68f45b3b090493ce981 Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 8 Apr 2025 20:18:10 +0100 Subject: [PATCH 1014/1352] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 3c8698c12..cf735fc8d 100644 --- a/README.md +++ b/README.md @@ -23,7 +23,7 @@ more details. 1. Install the required dependencies: ```shell - pip install --user -e. + pip install --user -e ".[full]" ``` 2. See available options: From 64ecd65d2c8ccb5e9284182104266e97d8fabce4 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 8 Apr 2025 14:37:29 -0500 Subject: [PATCH 1015/1352] Windows: Improve type-hints in thrdscan, extensions This improves type-hinting in the `ThrdScan` class and in the `ETHREAD` extension class through narrowing the return type of some methods from `interfaces.objects.ObjectInterface` to their actual return type, `extensions.ETHREAD`. Also creates a `NamedTuple` for holding thread info, which cleans up the type signature and makes the returned value easier for consumers to use. --- .../framework/plugins/windows/thrdscan.py | 77 ++++++++----------- .../symbols/windows/extensions/__init__.py | 10 ++- 2 files changed, 41 insertions(+), 46 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 0ac3d0c33..49103cc7e 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -1,15 +1,16 @@ ## ## plugin for testing addition of threads scan support to poolscanner.py ## -import logging import datetime -from typing import Callable, Iterable, Tuple, Optional, Dict +import logging +from typing import Callable, Dict, NamedTuple, Optional, Union, Tuple, Iterator -from volatility3.framework import renderers, interfaces, exceptions +from volatility3.framework import exceptions, interfaces, objects, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import poolscanner, pe_symbols +from volatility3.framework.symbols.windows import extensions as win_extensions from volatility3.plugins import timeliner +from volatility3.plugins.windows import pe_symbols, poolscanner vollog = logging.getLogger(__name__) @@ -21,6 +22,17 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) _required_framework_version = (2, 6, 0) _version = (2, 0, 0) + class ThreadInfo(NamedTuple): + offset: int + pid: objects.Pointer + tid: objects.Pointer + start_addr: objects.Pointer + start_path: Optional[str] + win32_start_addr: objects.Pointer + win32_start_path: Optional[str] + create_time: Union[datetime.datetime, interfaces.renderers.BaseAbsentValue] + exit_time: Union[datetime.datetime, interfaces.renderers.BaseAbsentValue] + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.implementation = self.scan_threads @@ -51,7 +63,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) cls, context: interfaces.context.ContextInterface, module_name: str, - ) -> Iterable[interfaces.objects.ObjectInterface]: + ) -> Iterator[win_extensions.ETHREAD]: """Scans for threads using the poolscanner module and constraints. Args: @@ -77,19 +89,9 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) @classmethod def gather_thread_info( cls, - ethread: interfaces.objects.ObjectInterface, - vads_cache: Dict[int, pe_symbols.ranges_type] = None, - ) -> Tuple[ - int, - int, - int, - int, - Optional[str], - int, - Optional[str], - Optional[datetime.datetime], - Optional[datetime.datetime], - ]: + ethread: win_extensions.ETHREAD, + vads_cache: Optional[Dict[int, pe_symbols.ranges_type]] = None, + ) -> Optional[ThreadInfo]: try: thread_offset = ethread.vol.offset owner_proc_pid = ethread.Cid.UniqueProcess @@ -135,19 +137,19 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) start_path = None win32start_path = None - return ( - format_hints.Hex(thread_offset), + return cls.ThreadInfo( + thread_offset, owner_proc_pid, thread_tid, - format_hints.Hex(thread_start_addr), + thread_start_addr, start_path, - format_hints.Hex(thread_win32start_addr), + thread_win32start_addr, win32start_path, thread_create_time, thread_exit_time, ) - def _generator(self, filter_func: Callable): + def _generator(self, filter_func: Callable) -> Iterator[Tuple[int, Tuple]]: kernel_name = self.config["kernel"] vads_cache: Dict[int, pe_symbols.ranges_type] = {} @@ -156,27 +158,16 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) info = self.gather_thread_info(ethread, vads_cache) if info: - ( - offset, - pid, - tid, - start_addr, - start_path, - win32start_addr, - win32start_path, - create_time, - exit_time, - ) = info yield 0, ( - offset, - pid, - tid, - start_addr, - start_path or renderers.NotAvailableValue(), - win32start_addr, - win32start_path or renderers.NotAvailableValue(), - create_time, - exit_time, + format_hints.Hex(info.offset), + info.pid, + info.tid, + format_hints.Hex(info.start_addr), + info.start_path or renderers.NotAvailableValue(), + format_hints.Hex(info.win32_start_addr), + info.win32_start_path or renderers.NotAvailableValue(), + info.create_time, + info.exit_time, ) def generate_timeline(self): diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 9fe250ba5..1972d6a50 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -568,16 +568,20 @@ class ETHREAD(objects.StructType, pool.ExecutiveObject): # passed all validations return True - def get_create_time(self): + def get_create_time( + self, + ) -> Union[datetime.datetime, interfaces.renderers.BaseAbsentValue]: # For Windows XPs if self.has_member("ThreadsProcess"): return conversion.wintime_to_datetime(self.CreateTime.QuadPart >> 3) return conversion.wintime_to_datetime(self.CreateTime.QuadPart) - def get_exit_time(self): + def get_exit_time( + self, + ) -> Union[datetime.datetime, interfaces.renderers.BaseAbsentValue]: return conversion.wintime_to_datetime(self.ExitTime.QuadPart) - def owning_process(self) -> interfaces.objects.ObjectInterface: + def owning_process(self) -> "EPROCESS": """Return the EPROCESS that owns this thread.""" # For Windows XPs From aba3b04e8da6c82b142b0e38011b6c50613d6823 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 8 Apr 2025 14:53:20 -0500 Subject: [PATCH 1016/1352] Windows Thrdscan: Fix thread filtering + tracebacks Tracebacks were occurring across a number of samples when running the threads/threadscan plugins due to uncaught `InvalidAddressExceptions`. Further investigations led to the discovery of some incorrect thread filtering that was missing valid threads. --- .../framework/constants/windows/__init__.py | 2 ++ .../framework/plugins/windows/thrdscan.py | 16 +++++++++++++--- .../symbols/windows/extensions/__init__.py | 6 +++++- 3 files changed, 20 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/constants/windows/__init__.py b/volatility3/framework/constants/windows/__init__.py index 6f37acd2d..b08713cc9 100644 --- a/volatility3/framework/constants/windows/__init__.py +++ b/volatility3/framework/constants/windows/__init__.py @@ -28,3 +28,5 @@ PROCESSOR_START_BLOCK_LM_TARGET_OFFSET = ( # CR3 register within structures describing initial processor state to be started PROCESSOR_START_BLOCK_CR3_OFFSET = 0xA0 # PROCESSOR_START_BLOCK->ProcessorState->SpecialRegisters->Cr3, ULONG64 8 bytes + +MAX_PID = 0xFFFFFFFC diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 49103cc7e..162e41929 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -7,6 +7,7 @@ from typing import Callable, Dict, NamedTuple, Optional, Union, Tuple, Iterator from volatility3.framework import exceptions, interfaces, objects, renderers from volatility3.framework.configuration import requirements +from volatility3.framework.constants import windows as windows_constants from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.windows import extensions as win_extensions from volatility3.plugins import timeliner @@ -112,10 +113,19 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vollog.debug(f"Thread invalid address {ethread.vol.offset:#x}") return None - # don't look for VADs in kernel threads, just let them get reported with empty paths + # Filter junk PIDs if ( - owner_proc_pid != 4 - and owner_proc.InheritedFromUniqueProcessId != 4 + ethread.Cid.UniqueProcess > windows_constants.MAX_PID + or ethread.Cid.UniqueProcess == 0 + or ethread.Cid.UniqueProcess % 4 != 0 + ): + return None + + # Get VAD mappings for valid non-system (PID 4) processes + if ( + owner_proc + and owner_proc.is_valid() + and owner_proc.UniqueProcessId != 4 and vads_cache is not None ): vads = pe_symbols.PESymbols.get_vads_for_process_cache( diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 1972d6a50..e6850dde5 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -709,7 +709,11 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): return False # NT pids are divisible by 4 - if self.UniqueProcessId % 4 != 0: + if ( + self.UniqueProcessId % 4 != 0 + or self.UniqueProcessId == 0 + or self.UniqueProcessId > constants.windows.MAX_PID + ): return False # check for all 0s besides the PCID entries From b35f0a29bc8eab919602acbcf5626f11c7638afd Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 8 Apr 2025 16:26:48 -0500 Subject: [PATCH 1017/1352] Windows: Remove VAD length check in thread enumeration This exclusion of threads where there are < 5 vads seems to filter valid threads (at least, threads where the start address or Win32 start address values are readable and valid disassembly, and the start time makes sense in the context of the parent process). --- .../framework/plugins/windows/thrdscan.py | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 162e41929..a3024fe58 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -131,17 +131,16 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc ) - if not vads or len(vads) < 5: - vollog.debug( - f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" - ) - return None - start_path = pe_symbols.PESymbols.filepath_for_address( - vads, thread_start_addr + start_path = ( + pe_symbols.PESymbols.filepath_for_address(vads, thread_start_addr) + if vads + else None ) - win32start_path = pe_symbols.PESymbols.filepath_for_address( - vads, thread_win32start_addr + win32start_path = ( + pe_symbols.PESymbols.filepath_for_address(vads, thread_win32start_addr) + if vads + else None ) else: start_path = None From 1ab8ddcb7faee4b4a28976e86397f8d9df1a862a Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 9 Apr 2025 20:35:19 +0100 Subject: [PATCH 1018/1352] Merge pull request #1765 from Abyss-W4tcher/minimum_alignment_adjustment [Parity/modules] Adjust module alignment for scanners --- volatility3/framework/symbols/linux/utilities/modules.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 62ebeef03..1c675a283 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -474,10 +474,7 @@ class Modules(interfaces.configuration.VersionableInterface): Returns: The struct module alignment """ - # FIXME: When dwarf2json/ISF supports type alignments. Read it directly from the type metadata - # Additionally, while 'context' and 'vmlinux_module_name' are currently unused, they will be - # essential for retrieving type metadata in the future. - return 64 + return context.modules[vmlinux_module_name].get_type("pointer").size @classmethod def list_modules( From da73a506620c73ac0642132428b5c06bd76613c3 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 9 Apr 2025 21:41:01 -0500 Subject: [PATCH 1019/1352] Windows ThrdScan: Bump patch version number Bumping patch version due to bug fixes. --- volatility3/framework/plugins/windows/debugregisters.py | 4 ++-- .../framework/plugins/windows/orphan_kernel_threads.py | 4 ++-- volatility3/framework/plugins/windows/psxview.py | 4 ++-- volatility3/framework/plugins/windows/suspended_threads.py | 4 ++-- volatility3/framework/plugins/windows/suspicious_threads.py | 6 +++--- volatility3/framework/plugins/windows/thrdscan.py | 2 +- volatility3/framework/plugins/windows/threads.py | 4 ++-- 7 files changed, 14 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 74434a3cc..40a5e31aa 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -24,7 +24,7 @@ vollog = logging.getLogger(__name__) class DebugRegisters(interfaces.plugins.PluginInterface): # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (1, 0, 1) + _version = (1, 0, 2) @classmethod def get_requirements(cls) -> List: @@ -38,7 +38,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 1) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index b4dec0fc5..300d6069f 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -18,7 +18,7 @@ class Threads(thrdscan.ThrdScan): _required_framework_version = (2, 4, 0) # 2.0.0 - changed the signature of `list_orphan_kernel_threads` - _version = (2, 0, 0) + _version = (2, 0, 1) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -34,7 +34,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) ), requirements.VersionRequirement( name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 142987c3e..c4f4b340f 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -34,7 +34,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter # code I do have from it, and will happily share it if anyone else wants to add it. _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) valid_proc_name_chars = set( string.ascii_lowercase + string.ascii_uppercase + "." + " " @@ -55,7 +55,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) ), requirements.VersionRequirement( name="handles", component=handles.Handles, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 82d44a6d7..1cde0429b 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -19,7 +19,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): """Enumerates suspended threads.""" _required_framework_version = (2, 13, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): @@ -36,7 +36,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 1) ), ] diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index eabc637c8..16da74c00 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -17,7 +17,7 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): """Lists suspicious userland process threads""" _required_framework_version = (2, 4, 0) - _version = (2, 0, 1) + _version = (2, 0, 2) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -35,13 +35,13 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 0) + name="threads", component=threads.Threads, version=(3, 0, 1) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index a3024fe58..1402e7bd2 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -21,7 +21,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (2, 0, 0) + _version = (2, 0, 1) class ThreadInfo(NamedTuple): offset: int diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index d040fa990..5531b4b24 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (3, 0, 0) + _version = (3, 0, 1) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -32,7 +32,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) From f091641920cda3a285ae2b633a8412e38f9501cc Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 9 Apr 2025 21:50:36 -0500 Subject: [PATCH 1020/1352] Framework: Bump patch version number Bumping the framework patch version number due to bugfix in windows' `EPROCESS` extension class' `is_valid()` method. --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index a299f15a2..07b9e45ec 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 26 # Number of changes that only add to the interface -VERSION_PATCH = 1 # Number of changes that do not change the interface +VERSION_PATCH = 2 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From 7192730deacfd2e17531215a597d93bc7e015f19 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 9 Apr 2025 22:53:49 -0500 Subject: [PATCH 1021/1352] Layers: Fix exception message Updates the exception message to report the correct dependency instead of the layer name itself. Instead of reporting the actual dependency, it was reporting, for example 'Layer layer_name is depended upon by layer_name'. --- volatility3/framework/interfaces/layers.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py index a90a78667..6c4e4b419 100644 --- a/volatility3/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -678,7 +678,7 @@ class LayerContainer(collections.abc.Mapping): if name in self._layers[layer].dependencies: raise exceptions.LayerException( self._layers[layer].name, - f"Layer {self._layers[layer].name} is depended upon by {layer}", + f"Layer {name} is depended upon by {layer}", ) # Otherwise, wipe out the layer self._layers[name].destroy() From 6237950991e7d78718bd6931c1598afac325043f Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 10 Apr 2025 09:50:49 -0500 Subject: [PATCH 1022/1352] Windows: Revert unneeded version bumps --- volatility3/framework/plugins/windows/debugregisters.py | 4 ++-- .../framework/plugins/windows/orphan_kernel_threads.py | 4 ++-- volatility3/framework/plugins/windows/psxview.py | 4 ++-- volatility3/framework/plugins/windows/suspended_threads.py | 4 ++-- volatility3/framework/plugins/windows/suspicious_threads.py | 6 +++--- volatility3/framework/plugins/windows/threads.py | 4 ++-- 6 files changed, 13 insertions(+), 13 deletions(-) diff --git a/volatility3/framework/plugins/windows/debugregisters.py b/volatility3/framework/plugins/windows/debugregisters.py index 40a5e31aa..74434a3cc 100644 --- a/volatility3/framework/plugins/windows/debugregisters.py +++ b/volatility3/framework/plugins/windows/debugregisters.py @@ -24,7 +24,7 @@ vollog = logging.getLogger(__name__) class DebugRegisters(interfaces.plugins.PluginInterface): # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (1, 0, 2) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List: @@ -38,7 +38,7 @@ class DebugRegisters(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 1) + name="threads", component=threads.Threads, version=(3, 0, 0) ), requirements.VersionRequirement( name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index 300d6069f..b4dec0fc5 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -18,7 +18,7 @@ class Threads(thrdscan.ThrdScan): _required_framework_version = (2, 4, 0) # 2.0.0 - changed the signature of `list_orphan_kernel_threads` - _version = (2, 0, 1) + _version = (2, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -34,7 +34,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index c4f4b340f..142987c3e 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -34,7 +34,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter # code I do have from it, and will happily share it if anyone else wants to add it. _required_framework_version = (2, 0, 0) - _version = (1, 0, 1) + _version = (1, 0, 0) valid_proc_name_chars = set( string.ascii_lowercase + string.ascii_uppercase + "." + " " @@ -55,7 +55,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="psscan", component=psscan.PsScan, version=(2, 0, 0) ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="handles", component=handles.Handles, version=(3, 0, 0) diff --git a/volatility3/framework/plugins/windows/suspended_threads.py b/volatility3/framework/plugins/windows/suspended_threads.py index 1cde0429b..82d44a6d7 100644 --- a/volatility3/framework/plugins/windows/suspended_threads.py +++ b/volatility3/framework/plugins/windows/suspended_threads.py @@ -19,7 +19,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): """Enumerates suspended threads.""" _required_framework_version = (2, 13, 0) - _version = (1, 0, 1) + _version = (1, 0, 0) @classmethod def get_requirements(cls): @@ -36,7 +36,7 @@ class SuspendedThreads(interfaces.plugins.PluginInterface): name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 1) + name="threads", component=threads.Threads, version=(3, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index 16da74c00..eabc637c8 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -17,7 +17,7 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): """Lists suspicious userland process threads""" _required_framework_version = (2, 4, 0) - _version = (2, 0, 2) + _version = (2, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -35,13 +35,13 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): optional=True, ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 1) + name="threads", component=threads.Threads, version=(3, 0, 0) ), requirements.VersionRequirement( name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) diff --git a/volatility3/framework/plugins/windows/threads.py b/volatility3/framework/plugins/windows/threads.py index 5531b4b24..d040fa990 100644 --- a/volatility3/framework/plugins/windows/threads.py +++ b/volatility3/framework/plugins/windows/threads.py @@ -16,7 +16,7 @@ class Threads(thrdscan.ThrdScan): """Lists process threads""" _required_framework_version = (2, 4, 0) - _version = (3, 0, 1) + _version = (3, 0, 0) def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) @@ -32,7 +32,7 @@ class Threads(thrdscan.ThrdScan): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 1) + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) From b82458e365149ee9255235be1751b6559fa8199c Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 10 Apr 2025 09:51:32 -0500 Subject: [PATCH 1023/1352] Windows Thrdscan: Convert from PATCH to MINOR version bump --- volatility3/framework/plugins/windows/thrdscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 1402e7bd2..d5a1a0b07 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -21,7 +21,7 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) # version 2.6.0 adds support for scanning for 'Ethread' structures by pool tags _required_framework_version = (2, 6, 0) - _version = (2, 0, 1) + _version = (2, 1, 0) class ThreadInfo(NamedTuple): offset: int From c48ad901b03c72e7c1ceffe3712dc8322c19de38 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 10 Apr 2025 14:49:50 -0500 Subject: [PATCH 1024/1352] Extensions: Add cache decorators as appropriate I noticed that many plugins were creating duplicate per-process translation layers - for instance, `windows.envars.Envars` was ending up with > 30 process layers per process due to repeated calls to `get_peb()`, which calls `add_process_space()` internally. This adds `@functools.lru_cache` to the `get_peb()` and `get_peb32()` methods on the `EPROCESS` extension, since these should only need to be created once. Also adds `@functools.lru_cache` to `add_process_space` to enable reusing the same process address space, provided the same arguments are passed to the `add_process_space()` method. --- volatility3/framework/symbols/linux/extensions/__init__.py | 1 + volatility3/framework/symbols/mac/extensions/__init__.py | 2 ++ volatility3/framework/symbols/windows/extensions/__init__.py | 5 ++++- 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index b4bde1aba..d281e2b9b 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -471,6 +471,7 @@ class task_struct(generic.GenericIntelProcess): return True + @functools.lru_cache def add_process_layer( self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None ) -> Optional[str]: diff --git a/volatility3/framework/symbols/mac/extensions/__init__.py b/volatility3/framework/symbols/mac/extensions/__init__.py index cc700f209..08ec63afa 100644 --- a/volatility3/framework/symbols/mac/extensions/__init__.py +++ b/volatility3/framework/symbols/mac/extensions/__init__.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import contextlib +import functools import logging from typing import Generator, Iterable, Optional, Set, Tuple @@ -17,6 +18,7 @@ class proc(generic.GenericIntelProcess): def get_task(self): return self.task.dereference().cast("task") + @functools.lru_cache def add_process_layer( self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None ) -> Optional[str]: diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 9fe250ba5..b90391af3 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -732,9 +732,10 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): return True + @functools.lru_cache def add_process_layer( self, config_prefix: Optional[str] = None, preferred_name: Optional[str] = None - ): + ) -> str: """Constructs a new layer based on the process's DirectoryTableBase.""" parent_layer = self._context.layers[self.vol.layer_name] @@ -761,6 +762,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): self._context, dtb, config_prefix, preferred_name ) + @functools.lru_cache def get_peb(self) -> interfaces.objects.ObjectInterface: """Constructs a PEB object""" if constants.BANG not in self.vol.type_name: @@ -786,6 +788,7 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) return peb + @functools.lru_cache def get_peb32(self) -> Optional[interfaces.objects.ObjectInterface]: """Constructs a PEB32 object""" if constants.BANG not in self.vol.type_name: From 03e750648f6068955cbed9e4dcf2fd2729b8c3ef Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 09:20:32 -0500 Subject: [PATCH 1025/1352] Windows Extensions: remove lru_cache decorators These don't offer enough upside to be worthwhile compared to the decorators applied to the `add_process_layer` methods. --- volatility3/framework/symbols/windows/extensions/__init__.py | 2 -- 1 file changed, 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index b90391af3..40f4e75e3 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -762,7 +762,6 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): self._context, dtb, config_prefix, preferred_name ) - @functools.lru_cache def get_peb(self) -> interfaces.objects.ObjectInterface: """Constructs a PEB object""" if constants.BANG not in self.vol.type_name: @@ -788,7 +787,6 @@ class EPROCESS(generic.GenericIntelProcess, pool.ExecutiveObject): ) return peb - @functools.lru_cache def get_peb32(self) -> Optional[interfaces.objects.ObjectInterface]: """Constructs a PEB32 object""" if constants.BANG not in self.vol.type_name: From 87cc571fbba8d6d04aecda758f36729fba44b0ec Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 10:18:17 -0500 Subject: [PATCH 1026/1352] ShimcacheMem: Fix symbol table These SHIM_CACHE_ENTRY offsets aren't correct - should be identical to those in the other XP symbol tables. --- .../windows/shimcache/shimcache-xp-sp2-x86.json | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json b/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json index 6114e6c85..6c990f9f5 100644 --- a/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json +++ b/volatility3/framework/symbols/windows/shimcache/shimcache-xp-sp2-x86.json @@ -331,23 +331,23 @@ "LastModified": { "type": { "kind": "union", - "name": "LARGE_INTEGER" + "name": "_LARGE_INTEGER" }, - "offset": 4 + "offset": 528 }, "FileSize": { "type": { "kind": "base", "name": "long long" }, - "offset": 8 + "offset": 536 }, "LastUpdate": { "type": { "kind": "union", - "name": "LARGE_INTEGER" + "name": "_LARGE_INTEGER" }, - "offset": 12 + "offset": 544 } }, "kind": "struct", From b80c52873b62a325453b9b443446e7f2ef4ad575 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 10:19:01 -0500 Subject: [PATCH 1027/1352] ShimcacheMem: Use `address_to_string` Uses the new `address_to_string` utility function to read filepaths, in case a filepath crosses a boundary to a swapped page. --- .../framework/symbols/windows/extensions/shimcache.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index b84a7df6f..279a1995c 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -8,6 +8,7 @@ from datetime import datetime from typing import Dict, Optional, Tuple, Union from volatility3.framework import constants, exceptions, interfaces, objects, renderers +from volatility3.framework.objects.utility import address_to_string from volatility3.framework.symbols.windows.extensions import conversion vollog = logging.getLogger(__name__) @@ -126,8 +127,12 @@ class SHIM_CACHE_ENTRY(objects.StructType): return self._file_path if not hasattr(self.Path, "Buffer"): - return self.Path.cast( - "string", max_length=self.Path.vol.count, encoding="utf-16le" + return address_to_string( + self._context, + self.Path.vol.layer_name, + self.Path.vol.offset, + 520, + encoding="utf-16le", ) try: From 079d2801f51f4191996ec9d2a1ace4edb9d956a9 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 10:19:55 -0500 Subject: [PATCH 1028/1352] ShimcacheMem: Fix offset tracking This fixes a bug in the plugin logic that causes valid entries to be excluded in the following scenario: - An entry is discovered but deemed invalid due to unreadable size/timestamps. - The offset gets placed into the `seen` tracking set anyway - Another entry (this time, with valid filesize/timestamps) with the same physical offset is encountered, but is skipped because this offset is already in the `seen` tracking set. This updates the logic to only add the offset to the tracker if the shimcache entry is valid. --- volatility3/framework/plugins/windows/shimcachemem.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 7883dfba3..f60e5c5cf 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -174,6 +174,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf vad.get_start() + SHIM_NUM_ENTRIES_OFFSET, ) + vollog.debug(f"Found {num_entries} shimcache entries") + if num_entries > SHIM_MAX_ENTRIES: continue @@ -204,7 +206,6 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf if physical_addr in seen: continue - seen.add(physical_addr) shim_entry = proc_layer.context.object( shimcache_symbol_table + constants.BANG + "SHIM_CACHE_ENTRY", @@ -216,6 +217,8 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf if not shim_entry.is_valid(): continue + seen.add(physical_addr) + yield shim_entry @classmethod From 1d4893156e04b0feb94249f1dc5536cb39ea2a75 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 11:13:03 -0500 Subject: [PATCH 1029/1352] Shimcache Extension: Fix logic error in `exec_flag` Adds needed return statements in `exec_flag` method in order to avoid `InvalidAddressException` when reading from invalid memory after an `is_valid` check has already been performed. --- .../framework/symbols/windows/extensions/shimcache.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index 279a1995c..a80ecc0ea 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -57,12 +57,14 @@ class SHIM_CACHE_ENTRY(objects.StructType): blob_offset, blob_size ): self._exec_flag = renderers.UnparsableValue() + return self._exec_flag raw_flag = self._context.layers[self.vol.native_layer_name].read( blob_offset, blob_size ) if not raw_flag: self._exec_flag = renderers.UnparsableValue() + return self._exec_flag try: self._exec_flag = bool(struct.unpack(" Date: Mon, 14 Apr 2025 11:41:00 -0500 Subject: [PATCH 1030/1352] Shimcache: Use `self.Path.vol.count` instead of hardcoded value --- volatility3/framework/symbols/windows/extensions/shimcache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index a80ecc0ea..2e7c68fa9 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -136,7 +136,7 @@ class SHIM_CACHE_ENTRY(objects.StructType): self._context, self.Path.vol.layer_name, self.Path.vol.offset, - 520, + self.Path.vol.count, encoding="utf-16le", ) From 17f9d218c93fd47ea491e0a7ce0ae746a46ca092 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 16:17:20 -0500 Subject: [PATCH 1031/1352] Windows PsList: Fix list traversal logic The traversal of `ActiveProcessLinks` from `PsActiveProcessHead` was only being done in the forward direction; if for some reason `PsActiveProcessHead` hasn't been updated to point at the 'current' list head, entries in the backwards traversal direction will be missed. --- volatility3/framework/plugins/windows/pslist.py | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index b92fdf66c..fb28b1843 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -6,13 +6,13 @@ import datetime import logging from typing import Callable, Iterator, List, Optional, Type -from volatility3.framework import renderers, interfaces, layers, exceptions, constants +from volatility3.framework import constants, exceptions, interfaces, layers, renderers from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols import intermed -from volatility3.framework.symbols.windows.extensions import pe from volatility3.framework.symbols.windows import extensions +from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins import timeliner vollog = logging.getLogger(__name__) @@ -261,9 +261,16 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): absolute=True, ) - for proc in eproc.ActiveProcessLinks: - if not filter_func(proc): - yield proc + seen = set() + for forward in (True, False): + for proc in eproc.ActiveProcessLinks.to_list( + eproc.vol.type_name, "ActiveProcessLinks", forward=forward + ): + if proc.vol.offset in seen: + continue + seen.add(proc.vol.offset) + if not filter_func(proc): + yield proc def _generator(self): kernel = self.context.modules[self.config["kernel"]] From 8f9bebdc86af17b02c3efa8b07ed0ec96d5cc442 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 17:10:22 -0500 Subject: [PATCH 1032/1352] Linux PsList: Fix process list traversal Fixes linux process listing by traversing the list backwards as well as forwards while tracking seen process offsets to avoid duplicates. --- volatility3/framework/plugins/linux/pslist.py | 26 +++++++++++++------ 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 2f0cc00b7..28009ec06 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -262,17 +262,27 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): init_task = vmlinux.object_from_symbol(symbol_name="init_task") # Note that the init_task itself is not yielded, since "ps" also never shows it. - for task in init_task.tasks: - if not task.is_valid(): - continue + seen = set() + for forward in (True, False): + for task in init_task.tasks.to_list( + symbol_type=init_task.vol.type_name, + member="tasks", + forward=forward, + ): + if task.vol.offset in seen: + continue + seen.add(task.vol.offset) - if filter_func(task): - continue + if not task.is_valid(): + continue - yield task + if filter_func(task): + continue - if include_threads: - yield from task.get_threads() + yield task + + if include_threads: + yield from task.get_threads() def run(self): pids = self.config.get("pid") From 91e23e0c71d0471fcc1f8bd6a359925386a5c6be Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 17:15:28 -0500 Subject: [PATCH 1033/1352] Bumps patch version for pslist plugins --- volatility3/framework/plugins/linux/pslist.py | 2 +- volatility3/framework/plugins/windows/pslist.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 28009ec06..9b31976ec 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -34,7 +34,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the processes present in a particular linux memory image.""" _required_framework_version = (2, 13, 0) - _version = (4, 1, 0) + _version = (4, 1, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index fb28b1843..0048730ea 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -24,7 +24,7 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): _required_framework_version = (2, 0, 0) # 3.0.0 - changed signature for `list_processes` - _version = (3, 0, 0) + _version = (3, 0, 1) PHYSICAL_DEFAULT = False @classmethod From 2e206fe698a7cdf7f5fd938930df148dae8711ce Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 17:17:02 -0500 Subject: [PATCH 1034/1352] Add keywords to parameters --- volatility3/framework/plugins/windows/pslist.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/pslist.py b/volatility3/framework/plugins/windows/pslist.py index 0048730ea..1043f8b42 100644 --- a/volatility3/framework/plugins/windows/pslist.py +++ b/volatility3/framework/plugins/windows/pslist.py @@ -264,7 +264,9 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): seen = set() for forward in (True, False): for proc in eproc.ActiveProcessLinks.to_list( - eproc.vol.type_name, "ActiveProcessLinks", forward=forward + symbol_type=eproc.vol.type_name, + member="ActiveProcessLinks", + forward=forward, ): if proc.vol.offset in seen: continue From 3b723f8be38596623b5a50fd5d8139960c7c5598 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 10 Apr 2025 15:43:21 -0500 Subject: [PATCH 1035/1352] Linux pagecache.Files: Memory Usage Converts `objects.Pointer` to `int` before storing them in the set. This should have a substantial impact on memory, similar to those in #1758 --- volatility3/framework/plugins/linux/mountinfo.py | 4 ++-- volatility3/framework/plugins/linux/pagecache.py | 13 +++++++------ 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index 668b039db..9790c4b57 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -279,9 +279,9 @@ class MountInfo(plugins.PluginInterface): if not (sb_ptr and sb_ptr.is_readable()): continue - if sb_ptr in seen_sb_ptr: + if int(sb_ptr) in seen_sb_ptr: continue - seen_sb_ptr.add(sb_ptr) + seen_sb_ptr.add(int(sb_ptr)) superblock = sb_ptr.dereference() diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 60b8b066b..6c27c94b2 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -204,10 +204,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): if dentry_addr == root_dentry.vol.offset: continue - if dentry_addr in seen_dentries: + if int(dentry_addr) in seen_dentries: continue - seen_dentries.add(dentry_addr) + seen_dentries.add(int(dentry_addr)) inode_ptr = dentry.d_inode if not (inode_ptr and inode_ptr.is_readable()): @@ -283,9 +283,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? - if root_inode_ptr in seen_inodes: + if int(root_inode_ptr) in seen_inodes: continue - seen_inodes.add(root_inode_ptr) + + seen_inodes.add(int(root_inode_ptr)) root_path = mountpoint @@ -318,9 +319,9 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? - if file_inode_ptr in seen_inodes: + if int(file_inode_ptr) in seen_inodes: continue - seen_inodes.add(file_inode_ptr) + seen_inodes.add(int(file_inode_ptr)) if follow_symlinks: file_path = cls._follow_symlink(file_inode_ptr, file_path) From c641690c5366bd0c65864438e87157b6dc9218ce Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 09:10:38 -0500 Subject: [PATCH 1036/1352] Pagecache: revert cast to int `dentry.vol.offset` is already a basic Python `int`. --- volatility3/framework/plugins/linux/pagecache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 6c27c94b2..7da42255d 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -204,10 +204,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): if dentry_addr == root_dentry.vol.offset: continue - if int(dentry_addr) in seen_dentries: + if dentry_addr in seen_dentries: continue - seen_dentries.add(int(dentry_addr)) + seen_dentries.add(dentry_addr) inode_ptr = dentry.d_inode if not (inode_ptr and inode_ptr.is_readable()): From 9ceec51b76711419d89ccf5ff1ae0b25a5b36f68 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 09:11:24 -0500 Subject: [PATCH 1037/1352] Pagecache: Add comments explaining cast Adds a couple of comments explaining why we're doing a lossy conversion to Python `int` (saving memory). --- volatility3/framework/plugins/linux/pagecache.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 7da42255d..87bd20b68 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -283,6 +283,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? + # Store a primitive int (instead of the pointer value) to track + # addresses we've already seen. Storing the full `objects.Pointer` + # uses too much memory, and we don't need all of the information + # that it contains. if int(root_inode_ptr) in seen_inodes: continue @@ -319,6 +323,10 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): continue # Inode already processed? + # Store a primitive int (instead of the pointer value) to track + # addresses we've already seen. Storing the full `objects.Pointer` + # uses too much memory, and we don't need all of the information + # that it contains. if int(file_inode_ptr) in seen_inodes: continue seen_inodes.add(int(file_inode_ptr)) From a236c0dd40a640850e6e9408c1dfbce502c4346b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 18:30:19 -0500 Subject: [PATCH 1038/1352] linux.pagecache.Files: Trim unneeded cast Removes casts to `int` performed before checking set membership, since the computed `__hash__` value will be the same for both the Python primitive and the volatility `objects.Pointer`. --- volatility3/framework/plugins/linux/pagecache.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 87bd20b68..1fd96d5d2 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -287,7 +287,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): # addresses we've already seen. Storing the full `objects.Pointer` # uses too much memory, and we don't need all of the information # that it contains. - if int(root_inode_ptr) in seen_inodes: + if root_inode_ptr in seen_inodes: continue seen_inodes.add(int(root_inode_ptr)) @@ -327,7 +327,7 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): # addresses we've already seen. Storing the full `objects.Pointer` # uses too much memory, and we don't need all of the information # that it contains. - if int(file_inode_ptr) in seen_inodes: + if file_inode_ptr in seen_inodes: continue seen_inodes.add(int(file_inode_ptr)) From d29be5cbdea0ac75d4895588f98e92198408d5e0 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 14 Apr 2025 18:38:47 -0500 Subject: [PATCH 1039/1352] Linux MountInfo: Remove unneeded cast --- volatility3/framework/plugins/linux/mountinfo.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/mountinfo.py b/volatility3/framework/plugins/linux/mountinfo.py index 9790c4b57..f00733a54 100644 --- a/volatility3/framework/plugins/linux/mountinfo.py +++ b/volatility3/framework/plugins/linux/mountinfo.py @@ -279,7 +279,7 @@ class MountInfo(plugins.PluginInterface): if not (sb_ptr and sb_ptr.is_readable()): continue - if int(sb_ptr) in seen_sb_ptr: + if sb_ptr in seen_sb_ptr: continue seen_sb_ptr.add(int(sb_ptr)) From 02fbb3ce4933349edd90e170515268c23e610bc5 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 10:14:58 -0500 Subject: [PATCH 1040/1352] Poolscanners: Fix symlink pool types Fixes regression introduced in #1632 Symbolic links are allocated in the paged pools, not non-paged. This was causing us to miss symlinks across both pre and post win8 samples. --- volatility3/framework/plugins/windows/poolscanner.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 7929b70e4..f62a34962 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -343,7 +343,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK", object_type="SymbolicLink", size=(72, None), - page_type=PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.PAGED | PoolType.FREE, ), # symlinks on windows starting with windows 8 PoolConstraint( @@ -351,7 +351,7 @@ class PoolScanner(plugins.PluginInterface): type_name=symbol_table + constants.BANG + "_OBJECT_SYMBOLIC_LINK", object_type="SymbolicLink", size=(72, None), - page_type=PoolType.NONPAGED | PoolType.FREE, + page_type=PoolType.PAGED | PoolType.FREE, ), # registry hives PoolConstraint( From d745a62d7faa7cb91f2b77ca96b031d09a044b2b Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 10:21:52 -0500 Subject: [PATCH 1041/1352] PoolScanner: Patch version bump Bumping the patch version due to bugfix. --- volatility3/framework/plugins/windows/poolscanner.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index f62a34962..7030b4c9a 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -131,7 +131,7 @@ class PoolScanner(plugins.PluginInterface): """A generic pool scanner plugin.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) + _version = (3, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 32e9cee6dd64f41145d723f0a864548d995d5fc7 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 10:43:12 -0500 Subject: [PATCH 1042/1352] Tests: Add Symlinkscan generic test This should be enough to prevent serious regressions that break all output. --- test/plugins/windows/windows.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 6733d543e..0db3aa35b 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -746,6 +746,19 @@ class TestWindowsKPCRs: assert test_volatility.count_entries_flat(json.loads(out)) > 0 +class TestWindowsSymlinkScan: + def test_windows_generic_symlinkscan(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.symlinkscan.SymlinkScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + assert test_volatility.count_entries_flat(json.loads(out)) > 0 + + class TestWindowsLdrModules: def test_windows_specific_ldrmodules(self, volatility, python): image = WindowsSamples.WINDOWSXP_GENERIC.value.path From 2199375dd52af3913eb4abf7fe5e05ac6c625941 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 10:48:49 -0500 Subject: [PATCH 1043/1352] Tests: Add symlinkscan specific test --- test/plugins/windows/windows.py | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 0db3aa35b..4272b64d2 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -758,6 +758,38 @@ class TestWindowsSymlinkScan: assert rc == 0 assert test_volatility.count_entries_flat(json.loads(out)) > 0 + def test_windows_specific_symlinkscan(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "windows.symlinkscan.SymlinkScan", + image, + volatility, + python, + globalargs=("-r", "json"), + ) + assert rc == 0 + json_out = json.loads(out) + assert test_volatility.count_entries_flat(json_out) > 5 + expected_rows = [ + { + "CreateTime": "2005-06-25T16:47:28+00:00", + "From Name": "AUX", + "Offset": 453082584, + "To Name": "\\DosDevices\\COM1", + "__children": [] + }, + { + "CreateTime": "2005-06-25T16:47:28+00:00", + "From Name": "UNC", + "Offset": 453176664, + "To Name": "\\Device\\Mup", + "__children": [] + } + ] + + for expected_row in expected_rows: + assert test_volatility.match_output_row(expected_row, json_out) + class TestWindowsLdrModules: def test_windows_specific_ldrmodules(self, volatility, python): From 537efa60e28d0a9ad23c5b0017618c853f338441 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 13:24:59 -0500 Subject: [PATCH 1044/1352] Thrdscan: Remove filtering based on VAD count This was preventing enumeration of valid processes (confirmed by disassembly of the start address/Win32 start address). Heuristic-based filtering should probably be left to consumers of the APIs. --- volatility3/framework/plugins/windows/thrdscan.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 0ac3d0c33..8fe13ba64 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -119,11 +119,6 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc ) - if not vads or len(vads) < 5: - vollog.debug( - f"Not enough vads for process at {owner_proc.vol.offset:#x}. Skipping thread at {ethread.vol.offset:#x}" - ) - return None start_path = pe_symbols.PESymbols.filepath_for_address( vads, thread_start_addr From b04a498cd755ad511e85c923a00943551b991b41 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 13:23:41 -0500 Subject: [PATCH 1045/1352] ThrdScan: Fix process filtering This check was both causing an `InvalidAddressException` due to the member access, while at the same time not being a useful check, since it prevents VADs from being mapped in children of the `System` process. --- .../framework/plugins/windows/thrdscan.py | 27 +++++++++---------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 8fe13ba64..1e7466dc5 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -111,24 +111,23 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) return None # don't look for VADs in kernel threads, just let them get reported with empty paths - if ( - owner_proc_pid != 4 - and owner_proc.InheritedFromUniqueProcessId != 4 - and vads_cache is not None - ): + if owner_proc_pid != 4 and vads_cache is not None: vads = pe_symbols.PESymbols.get_vads_for_process_cache( vads_cache, owner_proc ) - - start_path = pe_symbols.PESymbols.filepath_for_address( - vads, thread_start_addr - ) - win32start_path = pe_symbols.PESymbols.filepath_for_address( - vads, thread_win32start_addr - ) else: - start_path = None - win32start_path = None + vads = None + + start_path = ( + pe_symbols.PESymbols.filepath_for_address(vads, thread_start_addr) + if vads + else None + ) + win32start_path = ( + pe_symbols.PESymbols.filepath_for_address(vads, thread_win32start_addr) + if vads + else None + ) return ( format_hints.Hex(thread_offset), From 4ce173e87a868054f9ad3823f0f4a0c84e757731 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 15 Apr 2025 15:52:54 -0500 Subject: [PATCH 1046/1352] ShimcacheMem: Fix traceback in extension method When performing the attribute checks for ListFlags.BlobBuffer, a pointer dereference occurs implicitly that can trigger an `exceptions.InvalidAddressException`. This wraps the checks in a try/except block, and sets the value of `_exec_flag` to `renderers.UnreadableValue` if one occurs. --- .../symbols/windows/extensions/shimcache.py | 63 ++++++++++--------- 1 file changed, 35 insertions(+), 28 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index 2e7c68fa9..9e75e7579 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -39,37 +39,44 @@ class SHIM_CACHE_ENTRY(objects.StructType): if self._exec_flag is not None: return self._exec_flag - if hasattr(self, "ListEntryDetail") and hasattr( - self.ListEntryDetail, "InsertFlags" - ): - self._exec_flag = self.ListEntryDetail.InsertFlags & 0x2 == 2 - - elif hasattr(self, "InsertFlags"): - self._exec_flag = self.InsertFlags & 0x2 == 2 - - elif hasattr(self, "ListEntryDetail") and hasattr( - self.ListEntryDetail, "BlobBuffer" - ): - blob_offset = self.ListEntryDetail.BlobBuffer - blob_size = self.ListEntryDetail.BlobSize - - if not self._context.layers[self.vol.native_layer_name].is_valid( - blob_offset, blob_size + try: + if hasattr(self, "ListEntryDetail") and hasattr( + self.ListEntryDetail, "InsertFlags" ): - self._exec_flag = renderers.UnparsableValue() - return self._exec_flag + self._exec_flag = self.ListEntryDetail.InsertFlags & 0x2 == 2 - raw_flag = self._context.layers[self.vol.native_layer_name].read( - blob_offset, blob_size + elif hasattr(self, "InsertFlags"): + self._exec_flag = self.InsertFlags & 0x2 == 2 + + elif hasattr(self, "ListEntryDetail") and hasattr( + self.ListEntryDetail, "BlobBuffer" + ): + blob_offset = self.ListEntryDetail.BlobBuffer + blob_size = self.ListEntryDetail.BlobSize + + if not self._context.layers[self.vol.native_layer_name].is_valid( + blob_offset, blob_size + ): + self._exec_flag = renderers.UnparsableValue() + return self._exec_flag + + raw_flag = self._context.layers[self.vol.native_layer_name].read( + blob_offset, blob_size + ) + if not raw_flag: + self._exec_flag = renderers.UnparsableValue() + return self._exec_flag + + try: + self._exec_flag = bool(struct.unpack(" Date: Tue, 15 Apr 2025 15:55:52 -0500 Subject: [PATCH 1047/1352] Shimcachemem: Changes absent value return type This is more appropriately set to `renderers.UnreadableValue` since it is set when an `exceptions.InvalidAddressException` occurs. --- volatility3/framework/symbols/windows/extensions/shimcache.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index 9e75e7579..3b32d30c7 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -57,7 +57,7 @@ class SHIM_CACHE_ENTRY(objects.StructType): if not self._context.layers[self.vol.native_layer_name].is_valid( blob_offset, blob_size ): - self._exec_flag = renderers.UnparsableValue() + self._exec_flag = renderers.UnreadableValue() return self._exec_flag raw_flag = self._context.layers[self.vol.native_layer_name].read( From 330e19f1594a70437be1290e9c71829461942fed Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 15 Apr 2025 23:04:49 +0200 Subject: [PATCH 1048/1352] call parent get_requirements() --- volatility3/framework/layers/qemu.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py index eb44de347..0ab359559 100644 --- a/volatility3/framework/layers/qemu.py +++ b/volatility3/framework/layers/qemu.py @@ -102,7 +102,7 @@ class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ + return super().get_requirements() + [ requirements.VersionRequirement( name="regex_scanner", component=scanners.RegExScanner, From 4c6188766c5b453734b909d0c3b4fcab40931059 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 15 Apr 2025 23:05:00 +0200 Subject: [PATCH 1049/1352] black --- volatility3/framework/layers/qemu.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/layers/qemu.py b/volatility3/framework/layers/qemu.py index 0ab359559..5190027c4 100644 --- a/volatility3/framework/layers/qemu.py +++ b/volatility3/framework/layers/qemu.py @@ -115,7 +115,7 @@ class QemuSuspendLayer(segmented.NonLinearlySegmentedLayer): cls, base_layer: interfaces.layers.DataLayerInterface, name: str = "" ): header = base_layer.read(0, 8) - if header[:4] != b"\x51\x45\x56\x4D": + if header[:4] != b"\x51\x45\x56\x4d": raise exceptions.LayerException(name, "No QEMU magic bytes") if header[4:] != b"\x00\x00\x00\x03": raise exceptions.LayerException(name, "Unsupported QEMU version found") From ff5d736f94071aa3de9677f124ffb9fe79bcd367 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 17 Apr 2025 20:35:38 +0100 Subject: [PATCH 1050/1352] Amend SvcDiff comments at top of file Previously contained information about Skeleton_Key_Check, change this to be about SvcDiff. --- volatility3/framework/plugins/windows/svcdiff.py | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py index d2c3da3d3..78b61eb67 100644 --- a/volatility3/framework/plugins/windows/svcdiff.py +++ b/volatility3/framework/plugins/windows/svcdiff.py @@ -1,15 +1,13 @@ # This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - -# This module attempts to locate skeleton-key like function hooks. -# It does this by locating the CSystems array through a variety of methods, -# and then validating the entry for RC4 HMAC (0x17 / 23) +# This module compares services found through list walking versus scanning, +# with the aim of finding hidden services. # -# For a thorough walkthrough on how the R&D was performed to develop this plugin, -# please see our blogpost here: +# For background of hidden services and a real-world example of the use of this plugin, +# please see our blogpost: # -# https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html +# https://volatilityfoundation.org/memory-forensics-rd-illustrated-detecting-hidden-windows-services/ import logging From 4d19181848d4728f3e94bc03b200721c9399e62d Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 17 Apr 2025 16:42:17 -0500 Subject: [PATCH 1051/1352] #1780 - add LoadCount to dlllist output --- volatility3/framework/plugins/windows/dlllist.py | 6 ++++++ volatility3/framework/symbols/windows/__init__.py | 1 + .../symbols/windows/extensions/__init__.py | 14 ++++++++++++++ 3 files changed, 21 insertions(+) diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index b851cf7fd..1e8ecd414 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -173,6 +173,10 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): except exceptions.InvalidAddressException: size_of_image = renderers.NotAvailableValue() + LoadCount = entry.get_load_count() + if LoadCount is None: + LoadCount = renderers.NotAvailableValue() + yield ( 0, ( @@ -186,6 +190,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): size_of_image, BaseDllName, FullDllName, + LoadCount, DllLoadTime, file_output, ), @@ -232,6 +237,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ("Size", format_hints.Hex), ("Name", str), ("Path", str), + ("LoadCount", int), ("LoadTime", datetime.datetime), ("File output", str), ], diff --git a/volatility3/framework/symbols/windows/__init__.py b/volatility3/framework/symbols/windows/__init__.py index f9541579e..3296d7d2c 100755 --- a/volatility3/framework/symbols/windows/__init__.py +++ b/volatility3/framework/symbols/windows/__init__.py @@ -41,6 +41,7 @@ class WindowsKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class("_POOL_TRACKER_BIG_PAGES", pool.POOL_TRACKER_BIG_PAGES) self.set_type_class("_IMAGE_DOS_HEADER", pe.IMAGE_DOS_HEADER) self.set_type_class("_KTIMER", extensions.KTIMER) + self.set_type_class("_LDR_DATA_TABLE_ENTRY", extensions.LDR_DATA_TABLE_ENTRY) # Might not necessarily defined in every version of windows self.optional_set_type_class("_IMAGE_NT_HEADERS", pe.IMAGE_NT_HEADERS) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 4fc65564e..a814fd12c 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -1710,3 +1710,17 @@ class SHARED_CACHE_MAP(objects.StructType): ) return vacb_list + +class LDR_DATA_TABLE_ENTRY(objects.StructType): + def get_load_count(self) -> Optional[int]: + try: + LoadCount = self.LoadCount + except: + try: + LoadCount = self.ObsoleteLoadCount + except: + LoadCount = None + if LoadCount == 65535: + LoadCount = -1 + + return LoadCount From 094ba8e269d5a212e13bae4e7642da86cffec0a6 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 17 Apr 2025 16:44:22 -0500 Subject: [PATCH 1052/1352] #1780 - black and ruff fixes --- volatility3/framework/symbols/windows/extensions/__init__.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index a814fd12c..61138a78c 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -1711,14 +1711,15 @@ class SHARED_CACHE_MAP(objects.StructType): return vacb_list + class LDR_DATA_TABLE_ENTRY(objects.StructType): def get_load_count(self) -> Optional[int]: try: LoadCount = self.LoadCount - except: + except Exception: try: LoadCount = self.ObsoleteLoadCount - except: + except Exception: LoadCount = None if LoadCount == 65535: LoadCount = -1 From 2641e5fc41b986b63f3772c90d79765c0b812574 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Mon, 21 Apr 2025 15:50:57 -0500 Subject: [PATCH 1053/1352] ShimcacheMem: Fix exc getting module name `module.BaseDll.String` can raise an `InvalidAddressException`, this catches it and continues through the loop. --- .../framework/plugins/windows/shimcachemem.py | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index f60e5c5cf..5c0af7766 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -582,13 +582,19 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf :return: The offset and size of the module, if found; Otherwise, returns `None` """ - try: - krnl_mod = next( - module - for module in modules.Modules.list_modules(context, kernel_module_name) - if module.BaseDllName.String in module_list - ) - except StopIteration: + krnl_mod = None + for module in modules.Modules.list_modules(context, kernel_module_name): + try: + if module.BaseDllName.String in module_list: + krnl_mod = module + break + except exceptions.InvalidAddressException as exc: + vollog.warning( + f"Failed to get kernel module due to {exc.__class__.__name__}: {exc.invalid_address:#x}" + ) + + if krnl_mod is None: + vollog.warning("Failed to find kernel module") return None kernel = context.modules[kernel_module_name] From bb91d688cb03db5afdf1cb72d76a972473896f05 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 23 Apr 2025 10:57:22 -0500 Subject: [PATCH 1054/1352] Windows Handles: Convert to classmethods A lot of functionality in this plugin class was using instance methods instead of classmethods; this refactors the plugin to use classmethods instead of instance methods for consistency with the rest of the framework, and bumps the plugin major version to 4.0.0. --- .../framework/plugins/windows/handles.py | 90 +++++++++++++------ 1 file changed, 62 insertions(+), 28 deletions(-) diff --git a/volatility3/framework/plugins/windows/handles.py b/volatility3/framework/plugins/windows/handles.py index 2f257772f..64043d51d 100644 --- a/volatility3/framework/plugins/windows/handles.py +++ b/volatility3/framework/plugins/windows/handles.py @@ -3,7 +3,7 @@ # import logging -from typing import Dict, List, Optional +from typing import Dict, Iterator, List, Optional from volatility3.framework import constants, exceptions, interfaces, renderers, symbols from volatility3.framework.configuration import requirements @@ -18,13 +18,9 @@ class Handles(interfaces.plugins.PluginInterface): """Lists process open handles.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) + _version = (4, 0, 0) - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - self._type_map = None - self._cookie = None - self._level_mask = 7 + LEVEL_MASK = 7 @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -54,18 +50,27 @@ class Handles(interfaces.plugins.PluginInterface): ), ] - def _get_item(self, handle_table_entry, handle_value): - """Given a handle table entry (_HANDLE_TABLE_ENTRY) structure from a + @classmethod + def _get_item( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + handle_table_entry: interfaces.objects.ObjectInterface, + handle_value: int, + ) -> Optional[interfaces.objects.ObjectInterface]: + """ + Given a handle table entry (_HANDLE_TABLE_ENTRY) structure from a process' handle table, determine where the corresponding object's - _OBJECT_HEADER can be found.""" + _OBJECT_HEADER can be found, and construct and return the _OBJECT_HEADER + """ - kernel = self.context.modules[self.config["kernel"]] + kernel = context.modules[kernel_module_name] virtual = kernel.layer_name try: # before windows 7 - if not self.context.layers[virtual].is_valid(handle_table_entry.Object): + if not context.layers[virtual].is_valid(handle_table_entry.Object): return None fast_ref = handle_table_entry.Object.cast("_EX_FAST_REF") @@ -78,7 +83,7 @@ class Handles(interfaces.plugins.PluginInterface): except AttributeError: # starting with windows 8 is_64bit = symbols.symbol_table_is_64bit( - context=self.context, symbol_table_name=kernel.symbol_table_name + context=context, symbol_table_name=kernel.symbol_table_name ) if is_64bit: @@ -104,7 +109,7 @@ class Handles(interfaces.plugins.PluginInterface): offset = info_table & ~7 # print("LowValue: {0:#x} Magic: {1:#x} Offset: {2:#x}".format(handle_table_entry.InfoTable, magic, offset)) - object_header = self.context.object( + object_header = context.object( kernel.symbol_table_name + constants.BANG + "_OBJECT_HEADER", virtual, offset=offset, @@ -205,11 +210,23 @@ class Handles(interfaces.plugins.PluginInterface): offset=symbol_offset, ) - def _make_handle_array(self, offset, level, depth=0): - """Parse a process' handle table and yield valid handle table entries, - going as deep into the table "levels" as necessary.""" + @classmethod + def _make_handle_array( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + offset: int, + level: int, + depth: int = 0, + ) -> Iterator[interfaces.objects.ObjectInterface]: + """ + Parses a process' handle table by constructing an array of + `_HANDLE_TABLE_ENTRY` structures at the given offset, and yields valid + handle table entries, going as deep into the table "levels" as + necessary. + """ - kernel = self.context.modules[self.config["kernel"]] + kernel = context.modules[kernel_module_name] if level > 0: subtype = kernel.get_type("pointer") @@ -218,7 +235,7 @@ class Handles(interfaces.plugins.PluginInterface): subtype = kernel.get_type("_HANDLE_TABLE_ENTRY") count = 0x1000 / subtype.size - if not self.context.layers[kernel.layer_name].is_valid(offset): + if not context.layers[kernel.layer_name].is_valid(offset): return None table = kernel.object( @@ -229,7 +246,7 @@ class Handles(interfaces.plugins.PluginInterface): absolute=True, ) - layer_object = self.context.layers[kernel.layer_name] + layer_object = context.layers[kernel.layer_name] masked_offset = offset & layer_object.maximum_address for i in range(len(table)): @@ -243,11 +260,13 @@ class Handles(interfaces.plugins.PluginInterface): # The code above this calls `is_valid` on the `offset` # It is sent but then does not validate `entry` before # sending it to `_get_item` - if not self.context.layers[kernel.layer_name].is_valid(entry.vol.offset): + if not context.layers[kernel.layer_name].is_valid(entry.vol.offset): continue if level > 0: - yield from self._make_handle_array(entry, level - 1, depth) + yield from cls._make_handle_array( + context, kernel_module_name, entry, level - 1, depth + ) depth += 1 else: handle_multiplier = 4 @@ -258,7 +277,7 @@ class Handles(interfaces.plugins.PluginInterface): / (subtype.size / handle_multiplier) ) + handle_level_base - item = self._get_item(entry, handle_value) + item = cls._get_item(context, kernel_module_name, entry, handle_value) if item is None: continue @@ -272,10 +291,21 @@ class Handles(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: continue - def handles(self, handle_table): + @classmethod + def handles( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + handle_table: interfaces.objects.ObjectInterface, + ) -> Iterator[interfaces.objects.ObjectInterface]: + """ + Takes a context, kernel module name, and handle table structure + (_HANDLE_TABLE), and yields _HANDLE_TABLE_ENTRY structures from the + handle table. + """ try: - TableCode = handle_table.TableCode & ~self._level_mask - table_levels = handle_table.TableCode & self._level_mask + TableCode = handle_table.TableCode & ~cls.LEVEL_MASK + table_levels = handle_table.TableCode & cls.LEVEL_MASK except exceptions.InvalidAddressException: vollog.log( constants.LOGLEVEL_VVV, @@ -283,7 +313,9 @@ class Handles(interfaces.plugins.PluginInterface): ) return None - yield from self._make_handle_array(TableCode, table_levels) + yield from cls._make_handle_array( + context, kernel_module_name, TableCode, table_levels + ) def _generator(self, procs): type_map = self.get_type_map( @@ -306,7 +338,9 @@ class Handles(interfaces.plugins.PluginInterface): process_name = utility.array_to_string(proc.ImageFileName) - for entry in self.handles(object_table): + for entry in self.handles( + self.context, self.config["kernel"], object_table + ): try: obj_type = entry.get_object_type(type_map, cookie) if obj_type is None: From bceae67d439e24422531ffc8a3ea151e9e22f911 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Wed, 23 Apr 2025 11:18:38 -0500 Subject: [PATCH 1055/1352] Windows Handles: Update dependents This updates the plugins that depend on `Handles` with the correct required version number, as well as calls to the new handles classmethods where needed. --- .../framework/plugins/windows/callbacks.py | 2 +- .../framework/plugins/windows/dumpfiles.py | 27 ++++++++----------- .../framework/plugins/windows/poolscanner.py | 2 +- .../framework/plugins/windows/psxview.py | 23 +++++++--------- 4 files changed, 22 insertions(+), 32 deletions(-) diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index bcdd37869..b8c9fe751 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -48,7 +48,7 @@ class Callbacks(interfaces.plugins.PluginInterface): name="driverirp", component=driverirp.DriverIrp, version=(1, 0, 0) ), requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(3, 0, 0) + name="handles", component=handles.Handles, version=(4, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/dumpfiles.py b/volatility3/framework/plugins/windows/dumpfiles.py index e23b8ec3a..d069bc9f1 100755 --- a/volatility3/framework/plugins/windows/dumpfiles.py +++ b/volatility3/framework/plugins/windows/dumpfiles.py @@ -5,18 +5,12 @@ import logging import ntpath import re -from typing import List, Tuple, Type, Optional, Generator +from typing import Generator, List, Optional, Tuple, Type -from volatility3.framework import ( - interfaces, - exceptions, - constants, - renderers, -) +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import handles -from volatility3.plugins.windows import pslist +from volatility3.plugins.windows import handles, pslist vollog = logging.getLogger(__name__) @@ -76,7 +70,7 @@ class DumpFiles(interfaces.plugins.PluginInterface): name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(3, 0, 0) + name="handles", component=handles.Handles, version=(4, 0, 0) ), ] @@ -231,14 +225,11 @@ class DumpFiles(interfaces.plugins.PluginInterface): # private variables, so we need an instance (for now, anyway). We _could_ call Handles._generator() # to do some of the other work that is duplicated here, but then we'd need to parse the TreeGrid # results instead of just dealing with them as direct objects here. - handles_plugin = handles.Handles( - context=self.context, config_path=self._config_path - ) - type_map = handles_plugin.get_type_map( + type_map = handles.Handles.get_type_map( context=self.context, kernel_module_name=self.config["kernel"], ) - cookie = handles_plugin.find_cookie( + cookie = handles.Handles.find_cookie( context=self.context, kernel_module_name=self.config["kernel"], ) @@ -255,7 +246,11 @@ class DumpFiles(interfaces.plugins.PluginInterface): ) continue - for entry in handles_plugin.handles(object_table): + for entry in handles.Handles.handles( + context=self.context, + kernel_module_name=self.config["kernel"], + handle_table=object_table, + ): try: obj_type = entry.get_object_type(type_map, cookie) if obj_type == "File": diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 7030b4c9a..157282ce1 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -142,7 +142,7 @@ class PoolScanner(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(3, 0, 0) + name="handles", component=handles.Handles, version=(4, 0, 0) ), requirements.VersionRequirement( name="pool_header_scanner", diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 142987c3e..51616a22c 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -9,12 +9,7 @@ from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.windows import extensions -from volatility3.plugins.windows import ( - handles, - pslist, - psscan, - thrdscan, -) +from volatility3.plugins.windows import handles, pslist, psscan, thrdscan vollog = logging.getLogger(__name__) @@ -58,7 +53,7 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) ), requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(3, 0, 0) + name="handles", component=handles.Handles, version=(4, 0, 0) ), requirements.BooleanRequirement( name="physical-offsets", @@ -144,15 +139,11 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter ) -> Dict[int, extensions.EPROCESS]: ret: List[extensions.EPROCESS] = [] - handles_plugin = handles.Handles( - context=self.context, config_path=self.config_path - ) - - type_map = handles_plugin.get_type_map( + type_map = handles.Handles.get_type_map( context=self.context, kernel_module_name=self.config["kernel"] ) - cookie = handles_plugin.find_cookie( + cookie = handles.Handles.find_cookie( context=self.context, kernel_module_name=self.config["kernel"] ) @@ -164,7 +155,11 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter try: ret += [ handle.Body.cast("_EPROCESS") - for handle in handles_plugin.handles(p.ObjectTable) + for handle in handles.Handles.handles( + context=self.context, + kernel_module_name=self.config["kernel"], + handle_table=p.ObjectTable, + ) if handle.get_object_type(type_map, cookie) == "Process" ] except exceptions.InvalidAddressException: From dcded3a1fc2688c6cba8bf4e1065f12cbe645db3 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Thu, 24 Apr 2025 09:00:50 +0100 Subject: [PATCH 1056/1352] Update test/test_volatility.py Co-authored-by: ikelos --- test/test_volatility.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test_volatility.py b/test/test_volatility.py index 3d88eeab1..5491a8836 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -196,7 +196,7 @@ def test_windows_thrdscan(image, volatility, python): assert out.find(b"\t4\t8") != -1 assert out.find(b"\t4\t12") != -1 assert out.find(b"\t4\t16") != -1 - # assert out.find(b"this raieses AssertionError") != -1 + # assert out.find(b"this raises AssertionError") != -1 assert rc == 0 From 0fbe03912e20e40ce64090a007038b00554ec2e0 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Thu, 24 Apr 2025 09:01:42 +0100 Subject: [PATCH 1057/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 57b4daf31..0ac424481 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -296,6 +296,7 @@ class Sockscan(plugins.PluginInterface): constants.LOGLEVEL_VVVV, f"Unable create results for socket at {hex(sock_physical_addr)} due to invalid address: {error}", ) + return None def _generator(self, symbol_table_name: str): """Scans for sockets. Each row represents a kernel socket. From 95c54351f09de38c0cf4bf0439547f66a33f0b3d Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Thu, 24 Apr 2025 09:01:53 +0100 Subject: [PATCH 1058/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 0ac424481..9f756ecc9 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -225,6 +225,7 @@ class Sockscan(plugins.PluginInterface): constants.LOGLEVEL_VVVV, f"Unable to follow file at {hex(needle_addr)} to socket due to invalid address: {error}", ) + return None def _extract_sock_fields(self, psock, sock_handler): try: From 5e549b2d9204b106c5acdf3248ceba3ef5503cb9 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 24 Apr 2025 09:10:51 +0100 Subject: [PATCH 1059/1352] Linux: update sockstat requirements --- .../framework/plugins/linux/sockscan.py | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 9f756ecc9..11ba8c5fb 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -11,9 +11,10 @@ from volatility3.framework.renderers import TreeGrid, NotAvailableValue, format_ from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.symbols import linux -from volatility3.plugins.linux import sockstat -from volatility3.framework import symbols, constants +from volatility3.framework import symbols +from volatility3.plugins.linux import lsof, pslist, sockstat from volatility3.framework.layers import scanners +from volatility3.framework.symbols.linux import network vollog = logging.getLogger(__name__) @@ -33,10 +34,19 @@ class Sockscan(plugins.PluginInterface): architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( - name="SockHandlers", component=sockstat.SockHandlers, version=(1, 0, 0) + name="SockHandlers", component=sockstat.SockHandlers, version=(4, 0, 0) ), requirements.VersionRequirement( - name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) + name="lsof", component=lsof.Lsof, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) + ), + requirements.VersionRequirement( + name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="linux_net", component=network.NetSymbols, version=(1, 0, 0) ), ] From 1a57a66ce60533bdc9e33e6ed16f8e536189ff95 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 24 Apr 2025 09:11:36 +0100 Subject: [PATCH 1060/1352] Linux: update sockstat ruff issue with f-string using no placeholders --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 11ba8c5fb..27fb5f020 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -134,7 +134,7 @@ class Sockscan(plugins.PluginInterface): ) elif len(kernel_layer.dependencies) == 0: vollog.error( - f"Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan." + "Kernel layer has no dependencies, meaning there is no memory layer for this plugin to scan." ) raise exceptions.LayerException( vmlinux.layer_name, f"Layer {vmlinux.layer_name} has no dependencies" From e55ab3313f9119a7f455a2066f6f953ea92e9e4c Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 24 Apr 2025 09:16:23 +0100 Subject: [PATCH 1061/1352] Linux: update tests for sockscan --- test/plugins/linux/linux.py | 34 ++++++++++++++++++++++++++++++++++ test/test_volatility.py | 29 ----------------------------- 2 files changed, 34 insertions(+), 29 deletions(-) diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index e39c1d15d..fc01c0c92 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -615,3 +615,37 @@ class TestLinuxPscallstack: rb"1\s+init\s+39\s+0x88001f999a40.*?0xffff81109039\s+do_select\s+T\s+kernel", out, ) + + +class TestLinuxSockscan: + def test_linux_sockscan(image, volatility, python): + # designed for linux-sample-1.dmp SHA1:1C3A4627EDCA94A7ADE3414592BEF0E62D7D3BB6 + image = LinuxSamples.LINUX_GENERIC.value.path + rc, out, err = test_volatility.runvol_plugin( + "linux.sockscan.Sockscan", image, volatility, python + ) + + # ensure that multiple unix paths for sockets have been found + assert ( + len( + re.findall( + rb"(/[ -~]+?){1,8}", + out, + ) + ) + >= 10 + ) + + # ensure that multiple IPv4 addresses have been found + assert ( + len( + re.findall( + rb"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}", + out, + ) + ) + >= 10 + ) + + assert out.count(b"\n") >= 50 + assert rc == 0 diff --git a/test/test_volatility.py b/test/test_volatility.py index 195b51357..9b7aff4be 100644 --- a/test/test_volatility.py +++ b/test/test_volatility.py @@ -381,32 +381,3 @@ def test_mac_trustedbsd(image, volatility, python): assert out.count(b"\n") > 10 assert rc == 0 - -def test_linux_sockscan(image, volatility, python): - # designed for linux-sample-1.dmp SHA1:1C3A4627EDCA94A7ADE3414592BEF0E62D7D3BB6 - rc, out, err = runvol_plugin("linux.sockscan.Sockscan", image, volatility, python) - - # ensure that multiple unix paths for sockets have been found - assert ( - len( - re.findall( - rb"(/[ -~]+?){1,8}", - out, - ) - ) - >= 10 - ) - - # ensure that multiple IPv4 addresses have been found - assert ( - len( - re.findall( - rb"((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}", - out, - ) - ) - >= 10 - ) - - assert out.count(b"\n") >= 50 - assert rc == 0 From ca584cce7403dec5367e5fb2b51064277fb12864 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 24 Apr 2025 09:23:21 +0100 Subject: [PATCH 1062/1352] Linux: Update linux sockscan to work with SockHandlers v4.0.0 --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 27fb5f020..915a8e834 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -338,7 +338,7 @@ class Sockscan(plugins.PluginInterface): # TODO: look into options so that sockstat.SockHandlers so that process_sock can # be used without a task object. init_task = vmlinux.object_from_symbol(symbol_name="init_task") - sock_handler = sockstat.SockHandlers(vmlinux, init_task) + sock_handler = sockstat.SockHandlers(self.context, symbol_table_name, init_task) # get progress_callback in order to use this in the scanners. # TODO: perhaps add more detail to progress, showing method in progress and number of hits found From 704f0f023d7507b18a64608935c729f474f57d82 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 24 Apr 2025 09:35:04 +0100 Subject: [PATCH 1063/1352] Linux: Fix incorrect first parameter name in test_linux_sockscan --- test/plugins/linux/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index fc01c0c92..868b439fb 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -618,7 +618,7 @@ class TestLinuxPscallstack: class TestLinuxSockscan: - def test_linux_sockscan(image, volatility, python): + def test_linux_sockscan(self, volatility, python): # designed for linux-sample-1.dmp SHA1:1C3A4627EDCA94A7ADE3414592BEF0E62D7D3BB6 image = LinuxSamples.LINUX_GENERIC.value.path rc, out, err = test_volatility.runvol_plugin( From d532f3745438907aa654a5436bfcd04846763bf6 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 24 Apr 2025 09:37:39 +0100 Subject: [PATCH 1064/1352] Linux: sockstat contiuned work to breakdown large generator function --- .../framework/plugins/linux/sockscan.py | 128 +++++++++--------- 1 file changed, 65 insertions(+), 63 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 915a8e834..530b36c04 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -309,84 +309,86 @@ class Sockscan(plugins.PluginInterface): ) return None - def _generator(self, symbol_table_name: str): - """Scans for sockets. Each row represents a kernel socket. - - Args: - symbol_table_name: The name of the kernel module on which to operate - - Yields: - addr: Physical offset - family: Socket family string (AF_UNIX, AF_INET, etc) - sock_type: Socket type string (STREAM, DGRAM, etc) - protocol: Protocol string (UDP, TCP, etc) - source addr: Source address string - source port: Source port string (not all of them are int) - destination addr: Destination address string - destination port: Destination port (not all of them are int) - state: State strings (LISTEN, CONNECTED, etc) - """ - - # get vmlinux module from context in order to build objects and read symbols + def _build_sock_handler(self, symbol_table_name: str): vmlinux = self.context.modules[symbol_table_name] + init_task = vmlinux.object_from_symbol(symbol_name="init_task") + return sockstat.SockHandlers(self.context, symbol_table_name, init_task) - # get the memory layer that is to be scanned. + def _scan_for_sockets( + self, memory_layer, file_ops_needles, socket_destructor_needles + ): + return memory_layer.scan( + self.context, + scanners.MultiStringScanner(socket_destructor_needles | file_ops_needles), + self._progress_callback, + ) + + def _parse_scanner_result( + self, + match, + needle_addr, + file_ops_needles, + socket_destructor_needles, + symbol_table_name, + memory_layer_name, + f_op_offset, + sk_destruct_offset, + ): + + if match in socket_destructor_needles: + sock_physical_addr = needle_addr - sk_destruct_offset + psock = self._get_socket_from_sk_destruct( + sock_physical_addr, symbol_table_name, memory_layer_name + ) + elif match in file_ops_needles: + psock = self._walk_file_ops_needles( + symbol_table_name, memory_layer_name, needle_addr, f_op_offset + ) + sock_physical_addr = psock.vol.offset if psock else None + else: + psock = sock_physical_addr = None + + return psock, sock_physical_addr + + def _get_socket_from_sk_destruct( + self, sock_physical_addr, symbol_table_name, memory_layer_name + ): + vmlinux = self.context.modules[symbol_table_name] + return self.context.object( + vmlinux.symbol_table_name + constants.BANG + "sock", + offset=sock_physical_addr, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, + ) + + def _generator(self, symbol_table_name: str): memory_layer_name = self._find_memory_layer_name(symbol_table_name) memory_layer = self.context.layers[memory_layer_name] + sock_handler = self._build_sock_handler(symbol_table_name) - # use the init process to build a sock handler - # TODO: look into options so that sockstat.SockHandlers so that process_sock can - # be used without a task object. - init_task = vmlinux.object_from_symbol(symbol_name="init_task") - sock_handler = sockstat.SockHandlers(self.context, symbol_table_name, init_task) - - # get progress_callback in order to use this in the scanners. - # TODO: perhaps add more detail to progress, showing method in progress and number of hits found - progress_callback = self._progress_callback - - # Method 1 - find sockets by file operations, then follow pointers to sockets file_ops_needles, f_op_offset = self._find_file_ops_needles(symbol_table_name) - - # Method 2 - find sockets by socket destructor directly inside sock objects socket_destructor_needles, sk_destruct_offset = self._find_sk_destruct_needles( symbol_table_name ) - # TODO Method 3 - find sock by sk_error_report symbols - # sk_error_report_symbol_names = ['sock_def_error_report', 'inet_sk_rebuild_header', 'inet_listen'] - # this would be similar to Method 2, but using a different pointer within sock. - - # add a set of seen addresses to stop possible duplication of results. seen_sock_physical_addr = set() - # Using the calculated needles, scan the memory layer and attempt to parse the sockets located. - for needle_addr, match in memory_layer.scan( - self.context, - scanners.MultiStringScanner(socket_destructor_needles | file_ops_needles), - progress_callback, + for needle_addr, match in self._scan_for_sockets( + memory_layer, file_ops_needles, socket_destructor_needles ): - psock = None - sock_physical_addr = None + psock, sock_physical_addr = self._parse_scanner_result( + match, + needle_addr, + file_ops_needles, + socket_destructor_needles, + symbol_table_name, + memory_layer_name, + f_op_offset, + sk_destruct_offset, + ) - # if match is from socket_destructor_needles simply calculate the offset to the sock - if match in socket_destructor_needles: - sock_physical_addr = needle_addr - sk_destruct_offset - psock = self.context.object( - vmlinux.symbol_table_name + constants.BANG + "sock", - offset=sock_physical_addr, - layer_name=memory_layer_name, - native_layer_name=vmlinux.layer_name, - ) - - # if match is from file_ops_needles attempt to walk from file object to the sock - if match in file_ops_needles: - psock = self._walk_file_ops_needles( - symbol_table_name, memory_layer_name, needle_addr, f_op_offset - ) - - if psock is not None and sock_physical_addr not in seen_sock_physical_addr: + if psock and sock_physical_addr not in seen_sock_physical_addr: seen_sock_physical_addr.add(sock_physical_addr) - fields = self._extract_sock_fields(psock, sock_handler) if fields: yield (0, fields) From e25e23d8cf509054bfbe6d5fe3a193b76caeb58f Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Thu, 24 Apr 2025 20:46:19 +0300 Subject: [PATCH 1065/1352] Create etwpatch.py --- .../framework/plugins/windows/etwpatch.py | 142 ++++++++++++++++++ 1 file changed, 142 insertions(+) create mode 100644 volatility3/framework/plugins/windows/etwpatch.py diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py new file mode 100644 index 000000000..800f94623 --- /dev/null +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -0,0 +1,142 @@ +# etwpatch.py +# Plugin name: windows.etwpatch +# Volatility 3 plugin to detect ETW patching via EtwEventWrite prologue + +import contextlib +import logging + +from volatility3.framework import exceptions, interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, pe_symbols + +vollog = logging.getLogger(__name__) + +class EtwPatch(interfaces.plugins.PluginInterface): + """Detects ETW patching by examining the first opcode of EtwEventWrite in ntdll.dll.""" + + # Plugin metadata for auto-discovery + _version = (1, 0, 0) + _required_framework_version = (2, 26, 0) + + @classmethod + def get_requirements(cls): + return [ + requirements.ModuleRequirement( + name='kernel', + description='Windows kernel', + architectures=["Intel32", "Intel64"] + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="pe_symbols", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.ListRequirement( + name='pid', + description='Filter on specific process IDs', + element_type=int, + optional=True + ) + ] + + def _generator(self): + pid_filter = self.config.get('pid', None) + + for proc in pslist.PsList.list_processes( + context=self.context, + kernel_module_name=self.config['kernel']): + + # If the user passed --pid, only process those IDs + if pid_filter and proc.UniqueProcessId not in pid_filter: + continue + + pid = int(proc.UniqueProcessId) + proc_name = proc.ImageFileName.cast( + "string", + max_length = proc.ImageFileName.vol.count, + errors = 'replace' + ) + + # Build a per-process memory layer + try: + proc_layer_name = proc.add_process_layer() + except Exception: + continue + + proc_layer = self.context.layers[proc_layer_name] + + # Find ntdll.dll module + for module in proc.load_order_modules(): + BaseDllName = FullDllName = renderers.UnreadableValue() + with contextlib.suppress(exceptions.InvalidAddressException): + BaseDllName = module.BaseDllName.get_string() + FullDllName = module.FullDllName.get_string() + + if BaseDllName != 'ntdll.dll': + continue + + base = module.DllBase + size = module.SizeOfImage + + pe_table_name = intermed.IntermediateSymbolTable.create( + self.context, self.config_path, "windows", "pe", class_types=pe.class_types + ) + + pe_obj = pe_symbols.PESymbols.get_pefile_obj( + self.context, pe_table_name, proc_layer_name, base + ) + + try: + pe_obj.parse_data_directories( + directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_EXPORT"]] + ) + except Exception as e: + vollog.debug(f"Error parsing IMAGE_DIRECTORY_ENTRY_EXPORT with {e}") + continue + + if not hasattr(pe_obj, "DIRECTORY_ENTRY_EXPORT"): + return None + + for export in pe_obj.DIRECTORY_ENTRY_EXPORT.symbols: + if export.name not in [b"EtwEventWrite", b"EtwEventWriteFull", b"NtTraceEvent"]: + continue + + function_start = base + export.address + try: + with contextlib.suppress(exceptions.InvalidAddressException): + opcode = self.context.layers[proc_layer_name].read( + function_start, 1 + ).hex() + + # 0xC3 = RET, 0xE9 = JMP (common ETW patches) + if opcode in ('c3', 'e9'): + yield (0, ( + pid, + proc_name, + BaseDllName, + export.name.decode(), + format_hints.Hex(function_start), + opcode + )) + except Exception as e: + vollog.debug(f"Error parsing IMAGE_DIRECTORY_ENTRY_EXPORT with {e}") + continue + finally: + break + + def run(self): + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("DLL", str), + ("Function", str), + ("Offset", format_hints.Hex), + ("Opcode", str) + ], + self._generator() + ) From 6ac76b27ff1dd4e402f1d26a3d174e3e436eee68 Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Thu, 24 Apr 2025 20:47:08 +0300 Subject: [PATCH 1066/1352] Update etwpatch.py --- volatility3/framework/plugins/windows/etwpatch.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 800f94623..76d769731 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -1,7 +1,6 @@ -# etwpatch.py -# Plugin name: windows.etwpatch -# Volatility 3 plugin to detect ETW patching via EtwEventWrite prologue - +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# import contextlib import logging From 31184afe858e37106dfd6364e7e622fe6088967e Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Thu, 24 Apr 2025 20:48:59 +0300 Subject: [PATCH 1067/1352] Update etwpatch.py --- volatility3/framework/plugins/windows/etwpatch.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 76d769731..656e8a8ac 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -3,6 +3,7 @@ # import contextlib import logging +import pefile from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements From a167ddc04dc5a6fd2bf77157bf41699218d3140e Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Thu, 24 Apr 2025 20:51:02 +0300 Subject: [PATCH 1068/1352] Update etwpatch.py --- volatility3/framework/plugins/windows/etwpatch.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 656e8a8ac..281f85172 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -17,7 +17,6 @@ vollog = logging.getLogger(__name__) class EtwPatch(interfaces.plugins.PluginInterface): """Detects ETW patching by examining the first opcode of EtwEventWrite in ntdll.dll.""" - # Plugin metadata for auto-discovery _version = (1, 0, 0) _required_framework_version = (2, 26, 0) From 787f3b629ae14427576406d5d36b9d234f839eae Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 11:10:05 +0100 Subject: [PATCH 1069/1352] Revert "Linux: sockstat contiuned work to breakdown large generator function" This reverts commit d532f3745438907aa654a5436bfcd04846763bf6. --- .../framework/plugins/linux/sockscan.py | 130 +++++++++--------- 1 file changed, 64 insertions(+), 66 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 530b36c04..915a8e834 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -309,86 +309,84 @@ class Sockscan(plugins.PluginInterface): ) return None - def _build_sock_handler(self, symbol_table_name: str): - vmlinux = self.context.modules[symbol_table_name] - init_task = vmlinux.object_from_symbol(symbol_name="init_task") - return sockstat.SockHandlers(self.context, symbol_table_name, init_task) - - def _scan_for_sockets( - self, memory_layer, file_ops_needles, socket_destructor_needles - ): - return memory_layer.scan( - self.context, - scanners.MultiStringScanner(socket_destructor_needles | file_ops_needles), - self._progress_callback, - ) - - def _parse_scanner_result( - self, - match, - needle_addr, - file_ops_needles, - socket_destructor_needles, - symbol_table_name, - memory_layer_name, - f_op_offset, - sk_destruct_offset, - ): - - if match in socket_destructor_needles: - sock_physical_addr = needle_addr - sk_destruct_offset - psock = self._get_socket_from_sk_destruct( - sock_physical_addr, symbol_table_name, memory_layer_name - ) - elif match in file_ops_needles: - psock = self._walk_file_ops_needles( - symbol_table_name, memory_layer_name, needle_addr, f_op_offset - ) - sock_physical_addr = psock.vol.offset if psock else None - else: - psock = sock_physical_addr = None - - return psock, sock_physical_addr - - def _get_socket_from_sk_destruct( - self, sock_physical_addr, symbol_table_name, memory_layer_name - ): - vmlinux = self.context.modules[symbol_table_name] - return self.context.object( - vmlinux.symbol_table_name + constants.BANG + "sock", - offset=sock_physical_addr, - layer_name=memory_layer_name, - native_layer_name=vmlinux.layer_name, - ) - def _generator(self, symbol_table_name: str): + """Scans for sockets. Each row represents a kernel socket. + + Args: + symbol_table_name: The name of the kernel module on which to operate + + Yields: + addr: Physical offset + family: Socket family string (AF_UNIX, AF_INET, etc) + sock_type: Socket type string (STREAM, DGRAM, etc) + protocol: Protocol string (UDP, TCP, etc) + source addr: Source address string + source port: Source port string (not all of them are int) + destination addr: Destination address string + destination port: Destination port (not all of them are int) + state: State strings (LISTEN, CONNECTED, etc) + """ + + # get vmlinux module from context in order to build objects and read symbols + vmlinux = self.context.modules[symbol_table_name] + + # get the memory layer that is to be scanned. memory_layer_name = self._find_memory_layer_name(symbol_table_name) memory_layer = self.context.layers[memory_layer_name] - sock_handler = self._build_sock_handler(symbol_table_name) + # use the init process to build a sock handler + # TODO: look into options so that sockstat.SockHandlers so that process_sock can + # be used without a task object. + init_task = vmlinux.object_from_symbol(symbol_name="init_task") + sock_handler = sockstat.SockHandlers(self.context, symbol_table_name, init_task) + + # get progress_callback in order to use this in the scanners. + # TODO: perhaps add more detail to progress, showing method in progress and number of hits found + progress_callback = self._progress_callback + + # Method 1 - find sockets by file operations, then follow pointers to sockets file_ops_needles, f_op_offset = self._find_file_ops_needles(symbol_table_name) + + # Method 2 - find sockets by socket destructor directly inside sock objects socket_destructor_needles, sk_destruct_offset = self._find_sk_destruct_needles( symbol_table_name ) + # TODO Method 3 - find sock by sk_error_report symbols + # sk_error_report_symbol_names = ['sock_def_error_report', 'inet_sk_rebuild_header', 'inet_listen'] + # this would be similar to Method 2, but using a different pointer within sock. + + # add a set of seen addresses to stop possible duplication of results. seen_sock_physical_addr = set() - for needle_addr, match in self._scan_for_sockets( - memory_layer, file_ops_needles, socket_destructor_needles + # Using the calculated needles, scan the memory layer and attempt to parse the sockets located. + for needle_addr, match in memory_layer.scan( + self.context, + scanners.MultiStringScanner(socket_destructor_needles | file_ops_needles), + progress_callback, ): - psock, sock_physical_addr = self._parse_scanner_result( - match, - needle_addr, - file_ops_needles, - socket_destructor_needles, - symbol_table_name, - memory_layer_name, - f_op_offset, - sk_destruct_offset, - ) + psock = None + sock_physical_addr = None - if psock and sock_physical_addr not in seen_sock_physical_addr: + # if match is from socket_destructor_needles simply calculate the offset to the sock + if match in socket_destructor_needles: + sock_physical_addr = needle_addr - sk_destruct_offset + psock = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "sock", + offset=sock_physical_addr, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, + ) + + # if match is from file_ops_needles attempt to walk from file object to the sock + if match in file_ops_needles: + psock = self._walk_file_ops_needles( + symbol_table_name, memory_layer_name, needle_addr, f_op_offset + ) + + if psock is not None and sock_physical_addr not in seen_sock_physical_addr: seen_sock_physical_addr.add(sock_physical_addr) + fields = self._extract_sock_fields(psock, sock_handler) if fields: yield (0, fields) From b5c98a080a5a7823a69457af93436d2f3cdb169e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Fri, 25 Apr 2025 11:31:45 +0100 Subject: [PATCH 1070/1352] Fix a default value being mutable --- volatility3/cli/volshell/generic.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 2ea722a37..b9811e7d5 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -85,7 +85,7 @@ class Volshell(interfaces.plugins.PluginInterface): return reqs def run( - self, additional_locals: Dict[str, Any] = {} + self, additional_locals: Dict[str, Any] = None ) -> interfaces.renderers.TreeGrid: """Runs the interactive volshell plugin. @@ -93,6 +93,9 @@ class Volshell(interfaces.plugins.PluginInterface): Return a TreeGrid but this is always empty since the point of this plugin is to run interactively """ + if additional_locals is None: + additional_locals = {} + # Try to enable tab completion if not has_ipython: try: From ab5dac10d936c5b668a9c69e6acbada06abcd662 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 11:54:55 +0100 Subject: [PATCH 1071/1352] Linux: fix virtual to physical offsets for sockscan file_ops method --- .../framework/plugins/linux/sockscan.py | 22 +++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 915a8e834..a123e74cd 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -227,7 +227,25 @@ class Sockscan(plugins.PluginInterface): # sucessfully trversed from file to sock, this will exist in the # kernel layer, and need to be translated to the memory layer. - psock = socket.sk.dereference() + vsock = socket.sk.dereference() + + # get virtual offset + virtual_sock_offset = vsock.vol.offset + + # translate this offset to physical + native_layer = self.context.layers[vmlinux.layer_name] + physical_sock_offset, _physical_layer_name = native_layer.translate( + virtual_sock_offset + ) + + # build sock on the memory_layer using the physical_sock_offset + psock = self.context.object( + vmlinux.symbol_table_name + constants.BANG + "sock", + offset=physical_sock_offset, + layer_name=memory_layer_name, + native_layer_name=vmlinux.layer_name, + ) + return psock except exceptions.InvalidAddressException as error: @@ -336,7 +354,7 @@ class Sockscan(plugins.PluginInterface): # use the init process to build a sock handler # TODO: look into options so that sockstat.SockHandlers so that process_sock can - # be used without a task object. + # be used without a task object. init_task = vmlinux.object_from_symbol(symbol_name="init_task") sock_handler = sockstat.SockHandlers(self.context, symbol_table_name, init_task) From 0d32cac06786eb0b6e449ca65057072278213296 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 11:58:29 +0100 Subject: [PATCH 1072/1352] Linux: fix sockscan use of direct imports of TreeGrid and NotAvailableValue --- .../framework/plugins/linux/sockscan.py | 29 ++++++++++++------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index a123e74cd..b9a0d854d 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -7,7 +7,8 @@ import struct from typing import List, Set from volatility3.framework import exceptions, constants -from volatility3.framework.renderers import TreeGrid, NotAvailableValue, format_hints +from volatility3.framework import renderers +from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.symbols import linux @@ -285,23 +286,29 @@ class Sockscan(plugins.PluginInterface): protocol = sock.get_protocol() # format results - src = NotAvailableValue() if src is None else str(src) - src_port = NotAvailableValue() if src_port is None else str(src_port) - dst = NotAvailableValue() if dst is None else str(dst) - dst_port = NotAvailableValue() if dst_port is None else str(dst_port) - state = NotAvailableValue() if state is None else str(state) - protocol = NotAvailableValue() if protocol is None else str(protocol) + src = renderers.NotAvailableValue() if src is None else str(src) + src_port = ( + renderers.NotAvailableValue() if src_port is None else str(src_port) + ) + dst = renderers.NotAvailableValue() if dst is None else str(dst) + dst_port = ( + renderers.NotAvailableValue() if dst_port is None else str(dst_port) + ) + state = renderers.NotAvailableValue() if state is None else str(state) + protocol = ( + renderers.NotAvailableValue() if protocol is None else str(protocol) + ) # extended attributes is a dict, so this is formated to string show each # key and value pair, seperated with a comma. socket_filter_str = ( ",".join(f"{k}={v}" for k, v in extended.items()) if extended - else NotAvailableValue() + else renderers.NotAvailableValue() ) # remove empty results - if (src == "0.0.0.0" or isinstance(src, NotAvailableValue)) and ( - dst == "0.0.0.0" or isinstance(src, NotAvailableValue) + if (src == "0.0.0.0" or isinstance(src, renderers.NotAvailableValue)) and ( + dst == "0.0.0.0" or isinstance(src, renderers.NotAvailableValue) ): if state == "UNCONNECTED": return None @@ -424,7 +431,7 @@ class Sockscan(plugins.PluginInterface): ("Filter", str), ] - return TreeGrid( + return renderers.TreeGrid( tree_grid_args, self._generator(self.config["kernel"]), ) From 6f11161bd5388f3bf5ed3b97ff8841e11b65810f Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 11:59:43 +0100 Subject: [PATCH 1073/1352] Linux: add MultiStringScanner requirement for sockscan --- volatility3/framework/plugins/linux/sockscan.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index b9a0d854d..943e7447b 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -49,6 +49,11 @@ class Sockscan(plugins.PluginInterface): requirements.VersionRequirement( name="linux_net", component=network.NetSymbols, version=(1, 0, 0) ), + requirements.VersionRequirement( + name="multi_string_scanner", + component=scanners.MultiStringScanner, + version=(1, 0, 0), + ), ] def _canonicalize_symbol_addrs( From 7cfc03da5dff89d608a97e08e4313ce88597a20c Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 12:13:16 +0100 Subject: [PATCH 1074/1352] Linux: update sockscan to use minor version for the requirements this has been tested with --- volatility3/framework/plugins/linux/sockscan.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 943e7447b..4f16920cf 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -41,10 +41,10 @@ class Sockscan(plugins.PluginInterface): name="lsof", component=lsof.Lsof, version=(2, 0, 0) ), requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(4, 0, 0) + name="pslist", component=pslist.PsList, version=(4, 1, 0) ), requirements.VersionRequirement( - name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) + name="linuxutils", component=linux.LinuxUtilities, version=(2, 1, 0) ), requirements.VersionRequirement( name="linux_net", component=network.NetSymbols, version=(1, 0, 0) From 2d1acaca51ce70a1582e99d87a394aee8711418b Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 16:40:06 +0100 Subject: [PATCH 1075/1352] Linux: update extensions used by kallsyms plugin to use utility.pointer_to_string --- .../symbols/linux/extensions/__init__.py | 20 ++++--------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index d281e2b9b..bd57b726a 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3065,14 +3065,7 @@ class kernel_symbol(objects.StructType): else: raise AttributeError("Unsupported kernel_symbol type implementation") - layer = self._context.layers[self.vol.layer_name] - name_bytes = layer.read(name_offset, linux_constants.KSYM_NAME_LEN) - - idx = name_bytes.find(b"\x00") - if idx != -1: - name_bytes = name_bytes[:idx] - - return name_bytes.decode("utf-8", errors="ignore") + return utility.pointer_to_string(name_offset, linux_constants.KSYM_NAME_LEN) def get_name(self) -> Optional[str]: try: @@ -3108,14 +3101,9 @@ class kernel_symbol(objects.StructType): else: raise AttributeError("Unsupported kernel_symbol type implementation") - layer = self._context.layers[self.vol.layer_name] - namespace_bytes = layer.read(namespace_offset, linux_constants.KSYM_NAME_LEN) - - idx = namespace_bytes.find(b"\x00") - if idx != -1: - namespace_bytes = namespace_bytes[:idx] - - return namespace_bytes.decode("utf-8", errors="ignore") + return utility.pointer_to_string( + namespace_offset, linux_constants.KSYM_NAME_LEN + ) def get_namespace(self) -> Optional[str]: try: From 2d80f4680e41c373872386f7feef628e2ce8b7a4 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 25 Apr 2025 16:52:48 +0100 Subject: [PATCH 1076/1352] Linux: update kernel_symbol extensions _do_get_name and _do_get_namespace to use errors='ignore' to match previous implimentation --- volatility3/framework/symbols/linux/extensions/__init__.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index bd57b726a..c980ee6b1 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3065,7 +3065,9 @@ class kernel_symbol(objects.StructType): else: raise AttributeError("Unsupported kernel_symbol type implementation") - return utility.pointer_to_string(name_offset, linux_constants.KSYM_NAME_LEN) + return utility.pointer_to_string( + name_offset, linux_constants.KSYM_NAME_LEN, errors="ignore" + ) def get_name(self) -> Optional[str]: try: @@ -3102,7 +3104,7 @@ class kernel_symbol(objects.StructType): raise AttributeError("Unsupported kernel_symbol type implementation") return utility.pointer_to_string( - namespace_offset, linux_constants.KSYM_NAME_LEN + namespace_offset, linux_constants.KSYM_NAME_LEN, errors="ignore" ) def get_namespace(self) -> Optional[str]: From 9c7655a63586d5dce32989fac7c5ea15261e27e4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 27 Apr 2025 14:56:17 +0100 Subject: [PATCH 1077/1352] Add in coverage recording to the test process --- .github/workflows/test.yaml | 101 +++++++++++++++++++----------------- .gitignore | 3 ++ pyproject.toml | 1 + 3 files changed, 58 insertions(+), 47 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 56d671102..266e8bcc3 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -1,63 +1,70 @@ name: Test Volatility3 on: [push, pull_request] jobs: - build: runs-on: ubuntu-22.04 strategy: matrix: python-version: ["3.8"] steps: - - uses: actions/checkout@v4 - - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v5 - with: - python-version: ${{ matrix.python-version }} + - uses: actions/checkout@v4 + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v5 + with: + python-version: ${{ matrix.python-version }} - - name: Install dependencies - run: | - python -m pip install --upgrade pip Cmake build - pip install .[test] + - name: Install dependencies + run: | + python -m pip install --upgrade pip Cmake build + pip install .[test] - - name: Build PyPi packages - run: | - python -m build + - name: Build PyPi packages + run: | + python -m build - - name: Download images - run: | - mkdir test_images - cd test_images - curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/linux-sample-1.bin.gz" - gunzip linux-sample-1.bin.gz - curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz" - gunzip win-xp-laptop-2005-06-25.img.gz - curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-10_19041-2025_03.dmp.gz" - gunzip win-10_19041-2025_03.dmp.gz - cd - + - name: Download images + run: | + mkdir test_images + cd test_images + curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/linux-sample-1.bin.gz" + gunzip linux-sample-1.bin.gz + curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-xp-laptop-2005-06-25.img.gz" + gunzip win-xp-laptop-2005-06-25.img.gz + curl -sLO "https://downloads.volatilityfoundation.org/volatility3/images/win-10_19041-2025_03.dmp.gz" + gunzip win-10_19041-2025_03.dmp.gz + cd - - - name: Download and Extract symbols - run: | - cd ./volatility3/symbols - curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip - curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/symbols_win-10_19041-2025_03.zip - unzip linux.zip - unzip symbols_win-10_19041-2025_03.zip - cd - + - name: Download and Extract symbols + run: | + cd ./volatility3/symbols + curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/linux.zip + curl -sLO https://downloads.volatilityfoundation.org/volatility3/symbols/symbols_win-10_19041-2025_03.zip + unzip linux.zip + unzip symbols_win-10_19041-2025_03.zip + cd - - - name: Testing... - run: | - # VolShell - pytest ./test/plugins/windows/windows.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v - pytest ./test/plugins/linux/linux.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v + - name: Testing... + run: | + # VolShell + pytest --cov-append --cov-report=html --cov= ./test/plugins/windows/windows.py --volatility=volshell.py --image-dir=./test_images -k test_windows_volshell -v + pytest --cov-append --cov-report=html --cov= ./test/plugins/linux/linux.py --volatility=volshell.py --image-dir=./test_images -k test_linux_volshell -v - # Volatility - pytest ./test/plugins/windows/windows.py --volatility=vol.py --image=./test_images/win-10_19041-2025_03.dmp -k "test_windows and not test_windows_volshell" -v --durations=0 - pytest ./test/plugins/linux/linux.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v --durations=0 + # Volatility + pytest --cov-append --cov-report=html --cov= ./test/plugins/windows/windows.py --volatility=vol.py --image=./test_images/win-10_19041-2025_03.dmp -k "test_windows and not test_windows_volshell" -v --durations=0 + pytest --cov-append --cov-report=html --cov= ./test/plugins/linux/linux.py --volatility=vol.py --image-dir=./test_images -k "test_linux and not test_linux_volshell" -v --durations=0 - - name: Clean up post-test - run: | - rm -rf test_images - cd volatility3/symbols - rm -rf linux - rm -rf linux.zip - cd - + - name: Create coverage artifacts + uses: actions/upload-artifact@v4 + with: + name: code-coverage-report + path: htmlcov + overwrite: true + retention-days: 7 + + - name: Clean up post-test + run: | + rm -rf test_images + cd volatility3/symbols + rm -rf linux + rm -rf linux.zip + cd - diff --git a/.gitignore b/.gitignore index c132736a9..c550db705 100644 --- a/.gitignore +++ b/.gitignore @@ -43,3 +43,6 @@ ENV/ # PyTest cache files .pytest_cache/ + +# Coverage cache +.coverage diff --git a/pyproject.toml b/pyproject.toml index abd2e79f7..a70f2c633 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -45,6 +45,7 @@ dev = [ test = [ "volatility3[dev]", "pytest>=8.3.3,<9", + "pytest-cov>=6.1.1,<7", "yara-x>=0.10.0,<1", ] From bc265edcdc5b6f07dad5e139bed647f1cf070458 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 27 Apr 2025 15:00:03 +0100 Subject: [PATCH 1078/1352] Try to slightly loosen the pytest-cov requirement --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index a70f2c633..006f92a08 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -45,7 +45,7 @@ dev = [ test = [ "volatility3[dev]", "pytest>=8.3.3,<9", - "pytest-cov>=6.1.1,<7", + "pytest-cov>=6,<7", "yara-x>=0.10.0,<1", ] From f4a2c7aec23b3c613e7af6fe59b528ee57c78517 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 27 Apr 2025 15:02:12 +0100 Subject: [PATCH 1079/1352] Drop pycov requirement by 1 since github can't seem to find the most recent version --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 006f92a08..b88ac7752 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -45,7 +45,7 @@ dev = [ test = [ "volatility3[dev]", "pytest>=8.3.3,<9", - "pytest-cov>=6,<7", + "pytest-cov>=5,<7", "yara-x>=0.10.0,<1", ] From d3da34ce10b6c0dbf56ad54b50498a43a4fcfeef Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 27 Apr 2025 16:18:47 +0100 Subject: [PATCH 1080/1352] Update codeql action from v2 to v3 --- .github/workflows/codeql.yml | 61 ++++++++++++++++++------------------ 1 file changed, 30 insertions(+), 31 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index e2e741a9f..324390e43 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -13,10 +13,10 @@ name: "CodeQL" on: push: - branches: [ "develop" ] + branches: ["develop"] pull_request: # The branches below must be a subset of the branches above - branches: [ "develop" ] + branches: ["develop"] # schedule: # - cron: '16 8 * * 0' @@ -32,43 +32,42 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'python' ] + language: ["python"] # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support steps: - - name: Checkout repository - uses: actions/checkout@v3 + - name: Checkout repository + uses: actions/checkout@v3 - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@v2 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. - # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - queries: security-and-quality # ,security-extended + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + queries: security-and-quality # ,security-extended + # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v3 - # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@v2 + # ℹ️ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun - # ℹ️ Command-line programs to run using the OS shell. - # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. - # If the Autobuild fails above, remove it and uncomment the following three lines. - # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh - # - run: | - # echo "Run, Build Application using script" - # ./location_of_script_within_repo/buildscript.sh - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v2 - with: - category: "/language:${{matrix.language}}" + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{matrix.language}}" From 41142ef621cff7550bb14fba758349325bc21ddc Mon Sep 17 00:00:00 2001 From: eve Date: Mon, 28 Apr 2025 07:18:47 +0100 Subject: [PATCH 1081/1352] cli: add debug log of plugin version when the plugin is successfully constructed --- volatility3/cli/__init__.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index a41cf95a3..cc97c4fcb 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -505,6 +505,9 @@ class CommandLine: try: # Construct and run the plugin if constructed: + vollog.debug( + f"Successfully constructed {args.plugin} {constructed.version}" + ) grid = constructed.run() renderer = renderers[args.renderer]() renderer.filter = text_filter.CLIFilter(grid, args.filters) From 533f96ec03dd800f0c664b9c627999b2b07c2d74 Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 28 Apr 2025 12:53:46 +0000 Subject: [PATCH 1082/1352] Added extended usage of pe_symbols --- .../framework/plugins/windows/etwpatch.py | 114 ++++++++---------- 1 file changed, 52 insertions(+), 62 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 281f85172..36cb4b9a9 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -42,90 +42,80 @@ class EtwPatch(interfaces.plugins.PluginInterface): ) ] + def _get_dll_vads(self, proc, dll_name): + """Retrieve VADs for a specific DLL in the process.""" + collected_modules = pe_symbols.PESymbols.get_proc_vads_with_file_paths(proc) + return [ + (vad_start, vad_size, proc.add_process_layer()) + for vad_start, vad_size, filepath in collected_modules + if pe_symbols.PESymbols.filename_for_path(filepath) == dll_name + ] + + def _find_symbols(self, dll_name, symbols, proc_layer_name, dll_vads): + """Find symbols for a specific DLL.""" + filter_module = {dll_name: {"names": symbols}} + process_modules = {dll_name: [(proc_layer_name, vad_start, vad_size) for vad_start, vad_size, _ in dll_vads]} + return pe_symbols.PESymbols.find_symbols(self.context, self.config_path, filter_module, process_modules) + + def _get_first_opcode(self, proc_layer_name, function_start): + """Check the first opcode of a function.""" + try: + return self.context.layers[proc_layer_name].read(function_start, 1).hex() + except exceptions.InvalidAddressException: + return None + def _generator(self): pid_filter = self.config.get('pid', None) for proc in pslist.PsList.list_processes( context=self.context, kernel_module_name=self.config['kernel']): - - # If the user passed --pid, only process those IDs + # Skip processes not in the PID filter if pid_filter and proc.UniqueProcessId not in pid_filter: continue pid = int(proc.UniqueProcessId) proc_name = proc.ImageFileName.cast( "string", - max_length = proc.ImageFileName.vol.count, - errors = 'replace' + max_length=proc.ImageFileName.vol.count, + errors='replace' ) - # Build a per-process memory layer try: proc_layer_name = proc.add_process_layer() - except Exception: + except exceptions.InvalidAddressException: continue - proc_layer = self.context.layers[proc_layer_name] + dlls_to_check = { + "ntdll.dll": [ + "EtwEventWrite", + "EtwEventWriteFull", + "NtTraceEvent" + ], + "advapi32.dll": [ + "EventWrite" + ] + } - # Find ntdll.dll module - for module in proc.load_order_modules(): - BaseDllName = FullDllName = renderers.UnreadableValue() - with contextlib.suppress(exceptions.InvalidAddressException): - BaseDllName = module.BaseDllName.get_string() - FullDllName = module.FullDllName.get_string() - - if BaseDllName != 'ntdll.dll': + for dll_name, symbols in dlls_to_check.items(): + dll_vads = self._get_dll_vads(proc, dll_name) + if not dll_vads: continue - base = module.DllBase - size = module.SizeOfImage - - pe_table_name = intermed.IntermediateSymbolTable.create( - self.context, self.config_path, "windows", "pe", class_types=pe.class_types - ) - - pe_obj = pe_symbols.PESymbols.get_pefile_obj( - self.context, pe_table_name, proc_layer_name, base - ) - - try: - pe_obj.parse_data_directories( - directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_EXPORT"]] - ) - except Exception as e: - vollog.debug(f"Error parsing IMAGE_DIRECTORY_ENTRY_EXPORT with {e}") + found_symbols, _ = self._find_symbols(dll_name, symbols, proc_layer_name, dll_vads) + if dll_name not in found_symbols: continue - - if not hasattr(pe_obj, "DIRECTORY_ENTRY_EXPORT"): - return None - - for export in pe_obj.DIRECTORY_ENTRY_EXPORT.symbols: - if export.name not in [b"EtwEventWrite", b"EtwEventWriteFull", b"NtTraceEvent"]: - continue - - function_start = base + export.address - try: - with contextlib.suppress(exceptions.InvalidAddressException): - opcode = self.context.layers[proc_layer_name].read( - function_start, 1 - ).hex() - - # 0xC3 = RET, 0xE9 = JMP (common ETW patches) - if opcode in ('c3', 'e9'): - yield (0, ( - pid, - proc_name, - BaseDllName, - export.name.decode(), - format_hints.Hex(function_start), - opcode - )) - except Exception as e: - vollog.debug(f"Error parsing IMAGE_DIRECTORY_ENTRY_EXPORT with {e}") - continue - finally: - break + + for symbol_name, function_start in found_symbols[dll_name]: + opcode = self._get_first_opcode(proc_layer_name, function_start) + if opcode in ('c3', 'e9'): # RET or JMP + yield (0, ( + pid, + proc_name, + dll_name, + symbol_name, + format_hints.Hex(function_start), opcode + )) def run(self): return renderers.TreeGrid( From 02634d0e30edd2cabfb966c54595b892f245194c Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 28 Apr 2025 12:54:46 +0000 Subject: [PATCH 1083/1352] oops --- volatility3/framework/plugins/windows/etwpatch.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 36cb4b9a9..316af4dab 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -114,7 +114,8 @@ class EtwPatch(interfaces.plugins.PluginInterface): proc_name, dll_name, symbol_name, - format_hints.Hex(function_start), opcode + format_hints.Hex(function_start), + opcode )) def run(self): From d449104d8ba1e1459a58fdd6cdf4a6070703a723 Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 28 Apr 2025 13:26:14 +0000 Subject: [PATCH 1084/1352] removed unnecessary imports --- volatility3/framework/plugins/windows/etwpatch.py | 4 ---- 1 file changed, 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 316af4dab..d6632617a 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -1,15 +1,11 @@ # This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -import contextlib import logging -import pefile from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols import intermed -from volatility3.framework.symbols.windows.extensions import pe from volatility3.plugins.windows import pslist, pe_symbols vollog = logging.getLogger(__name__) From c9386782724311f2b1f8c373dc4af414dc4f875f Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 28 Apr 2025 14:21:24 +0000 Subject: [PATCH 1085/1352] Fixed according to atcuno comments --- .../framework/plugins/windows/etwpatch.py | 122 ++++++++---------- 1 file changed, 55 insertions(+), 67 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index d6632617a..79ddf2e1a 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -1,10 +1,11 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.plugins.windows import pslist, pe_symbols @@ -16,6 +17,11 @@ class EtwPatch(interfaces.plugins.PluginInterface): _version = (1, 0, 0) _required_framework_version = (2, 26, 0) + etw_functions = { + "ntdll.dll": ["EtwEventWrite", "EtwEventWriteFull", "NtTraceEvent"], + "advapi32.dll": ["EventWrite"], + } + @classmethod def get_requirements(cls): return [ @@ -38,81 +44,63 @@ class EtwPatch(interfaces.plugins.PluginInterface): ) ] - def _get_dll_vads(self, proc, dll_name): - """Retrieve VADs for a specific DLL in the process.""" - collected_modules = pe_symbols.PESymbols.get_proc_vads_with_file_paths(proc) - return [ - (vad_start, vad_size, proc.add_process_layer()) - for vad_start, vad_size, filepath in collected_modules - if pe_symbols.PESymbols.filename_for_path(filepath) == dll_name - ] - - def _find_symbols(self, dll_name, symbols, proc_layer_name, dll_vads): - """Find symbols for a specific DLL.""" - filter_module = {dll_name: {"names": symbols}} - process_modules = {dll_name: [(proc_layer_name, vad_start, vad_size) for vad_start, vad_size, _ in dll_vads]} - return pe_symbols.PESymbols.find_symbols(self.context, self.config_path, filter_module, process_modules) - - def _get_first_opcode(self, proc_layer_name, function_start): - """Check the first opcode of a function.""" - try: - return self.context.layers[proc_layer_name].read(function_start, 1).hex() - except exceptions.InvalidAddressException: - return None - def _generator(self): - pid_filter = self.config.get('pid', None) + # Get all ETW function addresses before looping through processes + found_symbols = pe_symbols.PESymbols.addresses_for_process_symbols( + context=self.context, + config_path=self.config_path, + kernel_module_name=self.config["kernel"], + symbols=self.etw_functions, + ) + + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for proc in pslist.PsList.list_processes( context=self.context, - kernel_module_name=self.config['kernel']): - # Skip processes not in the PID filter - if pid_filter and proc.UniqueProcessId not in pid_filter: - continue - - pid = int(proc.UniqueProcessId) - proc_name = proc.ImageFileName.cast( - "string", - max_length=proc.ImageFileName.vol.count, - errors='replace' - ) - + kernel_module_name=self.config['kernel'], + filter_func=filter_func, + ): + try: + proc_id = proc.UniqueProcessId + proc_name = utility.array_to_string(proc.ImageFileName) proc_layer_name = proc.add_process_layer() except exceptions.InvalidAddressException: + vollog.debug(f"Unable to create process layer for PID {proc_id}") continue - dlls_to_check = { - "ntdll.dll": [ - "EtwEventWrite", - "EtwEventWriteFull", - "NtTraceEvent" - ], - "advapi32.dll": [ - "EventWrite" - ] + # Map of opcodes to their instruction names + opcode_map = { + 'c3': 'RET', + 'e9': 'JMP', } - for dll_name, symbols in dlls_to_check.items(): - dll_vads = self._get_dll_vads(proc, dll_name) - if not dll_vads: - continue - - found_symbols, _ = self._find_symbols(dll_name, symbols, proc_layer_name, dll_vads) - if dll_name not in found_symbols: - continue - - for symbol_name, function_start in found_symbols[dll_name]: - opcode = self._get_first_opcode(proc_layer_name, function_start) - if opcode in ('c3', 'e9'): # RET or JMP - yield (0, ( - pid, - proc_name, - dll_name, - symbol_name, - format_hints.Hex(function_start), - opcode - )) + for dll_name, functions in found_symbols.items(): + for func_name, func_addr in functions: + try: + opcode = self.context.layers[proc_layer_name].read( + func_addr, 1 + ).hex() + if opcode in opcode_map: + instruction = opcode_map[opcode] + yield ( + 0, + ( + proc_id, + proc_name, + dll_name, + func_name, + format_hints.Hex(func_addr), + f"{opcode} ({instruction})" + ), + ) + except exceptions.InvalidAddressException: + vollog.debug(f"Invalid address when reading function {func_name} at {func_addr:#x} in process {proc_id}") + continue + except KeyError: + # Layer may no longer exist + vollog.debug(f"Layer {proc_layer_name} no longer exists for process {proc_id}") + continue def run(self): return renderers.TreeGrid( @@ -122,7 +110,7 @@ class EtwPatch(interfaces.plugins.PluginInterface): ("DLL", str), ("Function", str), ("Offset", format_hints.Hex), - ("Opcode", str) + ("Opcode", str), ], - self._generator() + self._generator(), ) From 817bd5ce7fb26984cfb0ab5860d00c24fd3bc3f8 Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 28 Apr 2025 15:07:03 +0000 Subject: [PATCH 1086/1352] additional fixes --- .../framework/plugins/windows/etwpatch.py | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 79ddf2e1a..1ecedea3f 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -18,8 +18,18 @@ class EtwPatch(interfaces.plugins.PluginInterface): _required_framework_version = (2, 26, 0) etw_functions = { - "ntdll.dll": ["EtwEventWrite", "EtwEventWriteFull", "NtTraceEvent"], - "advapi32.dll": ["EventWrite"], + "ntdll.dll": { + pe_symbols.wanted_names_identifier: [ + "EtwEventWrite", + "EtwEventWriteFull", + "NtTraceEvent" + ], + }, + "advapi32.dll": { + pe_symbols.wanted_names_identifier:[ + "EventWrite" + ], + }, } @classmethod @@ -96,11 +106,6 @@ class EtwPatch(interfaces.plugins.PluginInterface): ) except exceptions.InvalidAddressException: vollog.debug(f"Invalid address when reading function {func_name} at {func_addr:#x} in process {proc_id}") - continue - except KeyError: - # Layer may no longer exist - vollog.debug(f"Layer {proc_layer_name} no longer exists for process {proc_id}") - continue def run(self): return renderers.TreeGrid( From c5a4b34bfa5f1466b61551768ea0ad61becbc200 Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 28 Apr 2025 15:18:53 +0000 Subject: [PATCH 1087/1352] Fixed plugin docs --- volatility3/framework/plugins/windows/etwpatch.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 1ecedea3f..3605dfccb 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -12,7 +12,13 @@ from volatility3.plugins.windows import pslist, pe_symbols vollog = logging.getLogger(__name__) class EtwPatch(interfaces.plugins.PluginInterface): - """Detects ETW patching by examining the first opcode of EtwEventWrite in ntdll.dll.""" + """Identifies ETW (Event Tracing for Windows) patching techniques used by malware to evade detection. + + This plugin examines the first opcode of key ETW functions in ntdll.dll and advapi32.dll + to detect common ETW bypass techniques such as return pointer manipulation (RET) or function + redirection (JMP). Attackers often patch these functions to prevent security tools from + receiving telemetry about process execution, API calls, and other system events. + """ _version = (1, 0, 0) _required_framework_version = (2, 26, 0) From 281a237e03296ff38c7d0353157fa068c32a8c39 Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 28 Apr 2025 16:03:45 +0000 Subject: [PATCH 1088/1352] black and ruff fixes --- .../framework/plugins/windows/etwpatch.py | 63 ++++++++++--------- 1 file changed, 33 insertions(+), 30 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 3605dfccb..e79735213 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -7,16 +7,17 @@ from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import pslist, pe_symbols +from volatility3.plugins.windows import pslist, pe_symbols vollog = logging.getLogger(__name__) + class EtwPatch(interfaces.plugins.PluginInterface): """Identifies ETW (Event Tracing for Windows) patching techniques used by malware to evade detection. - - This plugin examines the first opcode of key ETW functions in ntdll.dll and advapi32.dll - to detect common ETW bypass techniques such as return pointer manipulation (RET) or function - redirection (JMP). Attackers often patch these functions to prevent security tools from + + This plugin examines the first opcode of key ETW functions in ntdll.dll and advapi32.dll + to detect common ETW bypass techniques such as return pointer manipulation (RET) or function + redirection (JMP). Attackers often patch these functions to prevent security tools from receiving telemetry about process execution, API calls, and other system events. """ @@ -28,13 +29,11 @@ class EtwPatch(interfaces.plugins.PluginInterface): pe_symbols.wanted_names_identifier: [ "EtwEventWrite", "EtwEventWriteFull", - "NtTraceEvent" + "NtTraceEvent", ], }, "advapi32.dll": { - pe_symbols.wanted_names_identifier:[ - "EventWrite" - ], + pe_symbols.wanted_names_identifier: ["EventWrite"], }, } @@ -42,22 +41,22 @@ class EtwPatch(interfaces.plugins.PluginInterface): def get_requirements(cls): return [ requirements.ModuleRequirement( - name='kernel', - description='Windows kernel', - architectures=["Intel32", "Intel64"] + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], ), requirements.VersionRequirement( name="pslist", component=pslist.PsList, version=(3, 0, 0) ), requirements.VersionRequirement( - name="pe_symbols", component=pslist.PsList, version=(3, 0, 0) + name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) ), requirements.ListRequirement( - name='pid', - description='Filter on specific process IDs', + name="pid", + description="Filter on specific process IDs", element_type=int, - optional=True - ) + optional=True, + ), ] def _generator(self): @@ -68,15 +67,15 @@ class EtwPatch(interfaces.plugins.PluginInterface): kernel_module_name=self.config["kernel"], symbols=self.etw_functions, ) - + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) for proc in pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config['kernel'], - filter_func=filter_func, - ): - + context=self.context, + kernel_module_name=self.config["kernel"], + filter_func=filter_func, + ): + try: proc_id = proc.UniqueProcessId proc_name = utility.array_to_string(proc.ImageFileName) @@ -87,16 +86,18 @@ class EtwPatch(interfaces.plugins.PluginInterface): # Map of opcodes to their instruction names opcode_map = { - 'c3': 'RET', - 'e9': 'JMP', + "c3": "RET", + "e9": "JMP", } for dll_name, functions in found_symbols.items(): for func_name, func_addr in functions: try: - opcode = self.context.layers[proc_layer_name].read( - func_addr, 1 - ).hex() + opcode = ( + self.context.layers[proc_layer_name] + .read(func_addr, 1) + .hex() + ) if opcode in opcode_map: instruction = opcode_map[opcode] yield ( @@ -107,11 +108,13 @@ class EtwPatch(interfaces.plugins.PluginInterface): dll_name, func_name, format_hints.Hex(func_addr), - f"{opcode} ({instruction})" + f"{opcode} ({instruction})", ), ) except exceptions.InvalidAddressException: - vollog.debug(f"Invalid address when reading function {func_name} at {func_addr:#x} in process {proc_id}") + vollog.debug( + f"Invalid address when reading function {func_name} at {func_addr:#x} in process {proc_id}" + ) def run(self): return renderers.TreeGrid( From 39b35a3a8070854fa3a9238a1190e5978288df3f Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Tue, 29 Apr 2025 13:11:35 +0300 Subject: [PATCH 1089/1352] Update volatility3/framework/plugins/windows/etwpatch.py Co-authored-by: ikelos --- volatility3/framework/plugins/windows/etwpatch.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index e79735213..7aee06e43 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -86,8 +86,8 @@ class EtwPatch(interfaces.plugins.PluginInterface): # Map of opcodes to their instruction names opcode_map = { - "c3": "RET", - "e9": "JMP", + 0xc3: "RET", + 0xe9: "JMP", } for dll_name, functions in found_symbols.items(): From cc1df7b4617be694ec22aac3ca49d7c5175058d1 Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Tue, 29 Apr 2025 13:11:47 +0300 Subject: [PATCH 1090/1352] Update volatility3/framework/plugins/windows/etwpatch.py Co-authored-by: ikelos --- volatility3/framework/plugins/windows/etwpatch.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 7aee06e43..30e8b2947 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -95,8 +95,7 @@ class EtwPatch(interfaces.plugins.PluginInterface): try: opcode = ( self.context.layers[proc_layer_name] - .read(func_addr, 1) - .hex() + .read(func_addr, 1)[0] ) if opcode in opcode_map: instruction = opcode_map[opcode] From 4738efefa3cdc4a4405df57551ffcc653bff9b9e Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Tue, 29 Apr 2025 13:11:58 +0300 Subject: [PATCH 1091/1352] Update volatility3/framework/plugins/windows/etwpatch.py Co-authored-by: ikelos --- volatility3/framework/plugins/windows/etwpatch.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 30e8b2947..a21cab030 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -107,7 +107,7 @@ class EtwPatch(interfaces.plugins.PluginInterface): dll_name, func_name, format_hints.Hex(func_addr), - f"{opcode} ({instruction})", + f"{opcode:02x} ({instruction})", ), ) except exceptions.InvalidAddressException: From 19b094acf686f3a0a093a1ac6b62b2b0d1391c5f Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Tue, 29 Apr 2025 14:20:42 +0300 Subject: [PATCH 1092/1352] Fix lint errors --- volatility3/framework/plugins/windows/etwpatch.py | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index a21cab030..14fbacc28 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -86,17 +86,16 @@ class EtwPatch(interfaces.plugins.PluginInterface): # Map of opcodes to their instruction names opcode_map = { - 0xc3: "RET", - 0xe9: "JMP", + 0xC3: "RET", + 0xE9: "JMP", } for dll_name, functions in found_symbols.items(): for func_name, func_addr in functions: try: - opcode = ( - self.context.layers[proc_layer_name] - .read(func_addr, 1)[0] - ) + opcode = self.context.layers[proc_layer_name].read( + func_addr, 1 + )[0] if opcode in opcode_map: instruction = opcode_map[opcode] yield ( From f5ec6dc7dd5fbf4785007365fd89e1d09304afd5 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 5 May 2025 12:55:48 +0100 Subject: [PATCH 1093/1352] Add in initial version of breakpointing --- volatility3/cli/volshell/generic.py | 32 +++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index b9811e7d5..7ff30909f 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -3,6 +3,7 @@ # import binascii import code +import functools import io import random import string @@ -187,6 +188,7 @@ class Volshell(interfaces.plugins.PluginInterface): def construct_locals(self) -> List[Tuple[List[str], Any]]: """Returns a listing of the functions to be added to the environment.""" return [ + (["bp", "breakpoint"], self.breakpoint), (["dt", "display_type"], self.display_type), (["db", "display_bytes"], self.display_bytes), (["dw", "display_words"], self.display_words), @@ -797,6 +799,36 @@ class Volshell(interfaces.plugins.PluginInterface): return constructed + def breakpoint(self, address: int, layer_name: Optional[str] = None) -> None: + """Sets a breakpoint on a particular address (within a specific layer)""" + if layer_name is None: + if self.current_layer is None: + raise ValueError("Current layer must be set") + layer_name = self.current_layer + + layer: interfaces.layers.DataLayerInterface = self.context.layers[layer_name] + # Check if the read value is already overloaded + if not hasattr(layer.read, "breakpoints"): + # Layer read is not yet wrapped + def wrapped_read(offset: int, length: int, pad: bool = False) -> bytes: + original_read = getattr(wrapped_read, "original_read") + for breakpoint in getattr(wrapped_read, "breakpoints"): + if (offset <= breakpoint) and (breakpoint < offset + length): + import pdb + + pdb.set_trace() + print("Hit breakpoint") + return original_read(offset, length, pad) + + setattr(wrapped_read, "breakpoints", set()) + setattr(wrapped_read, "original_read", layer.read) + setattr(layer, "read", wrapped_read) + + # Add the new breakpoint + breakpoints = getattr(layer.read, "breakpoints") + breakpoints.add(address) + setattr(layer.read, "breakpoints", breakpoints) + class NullFileHandler(io.BytesIO, interfaces.plugins.FileHandlerInterface): """Null FileHandler that swallows files whole without consuming memory""" From ae08c8ecfc8dd85f3c33af3a4307dd1cd86df243 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 5 May 2025 13:14:19 +0100 Subject: [PATCH 1094/1352] Support setting the breakpoint on the lowest layer --- volatility3/cli/volshell/generic.py | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 7ff30909f..20fbae417 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -799,7 +799,9 @@ class Volshell(interfaces.plugins.PluginInterface): return constructed - def breakpoint(self, address: int, layer_name: Optional[str] = None) -> None: + def breakpoint( + self, address: int, layer_name: Optional[str] = None, lowest: bool = False + ) -> None: """Sets a breakpoint on a particular address (within a specific layer)""" if layer_name is None: if self.current_layer is None: @@ -807,6 +809,18 @@ class Volshell(interfaces.plugins.PluginInterface): layer_name = self.current_layer layer: interfaces.layers.DataLayerInterface = self.context.layers[layer_name] + + if lowest: + while isinstance(layer, interfaces.layers.TranslationLayerInterface): + mapping = layer.mapping(address, 1) + if not mapping: + raise ValueError( + "Offset cannot be mapped lower, cannot break at lowest layer" + ) + _, _, mapped_offset, _, mapped_layer_name = next(mapping) + layer = self.context.layers[mapped_layer_name] + address = mapped_offset + # Check if the read value is already overloaded if not hasattr(layer.read, "breakpoints"): # Layer read is not yet wrapped @@ -825,6 +839,7 @@ class Volshell(interfaces.plugins.PluginInterface): setattr(layer, "read", wrapped_read) # Add the new breakpoint + print(f"Setting breakpoint {address:x} on {layer.name}") breakpoints = getattr(layer.read, "breakpoints") breakpoints.add(address) setattr(layer.read, "breakpoints", breakpoints) From 5bb4cd90c16da4b2248a97ad80a04f0b852ecf51 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 5 May 2025 13:16:29 +0100 Subject: [PATCH 1095/1352] Remove no longer needed functools import --- volatility3/cli/volshell/generic.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 20fbae417..4c90c39c9 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -3,7 +3,6 @@ # import binascii import code -import functools import io import random import string From 140a16d1dd263e4985413d166fb6e40111fa1051 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 5 May 2025 21:44:05 +0200 Subject: [PATCH 1096/1352] prevent forward slashes only dentry names --- volatility3/framework/symbols/linux/__init__.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 9d3930087..fbe0fdad3 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -190,9 +190,13 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): parent = dentry.d_parent dname = dentry.d_name.name_as_str() - path_reversed.append(dname.strip("/")) + dname_stripped = dname.strip("/") + if dname_stripped: + path_reversed.append(dname_stripped) dentry = parent + if path_reversed == []: + return "" path = "/" + "/".join(reversed(path_reversed)) return path From 2759df89dbf38ba3bd515624642db527b16b03e6 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 6 May 2025 00:31:09 +0200 Subject: [PATCH 1097/1352] tag potentially smeared dentry names --- volatility3/framework/symbols/linux/__init__.py | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index fbe0fdad3..65f20d88d 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -169,6 +169,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return "" path_reversed = [] + smeared = False while ( dentry and dentry.is_readable() @@ -190,14 +191,16 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): parent = dentry.d_parent dname = dentry.d_name.name_as_str() - dname_stripped = dname.strip("/") - if dname_stripped: - path_reversed.append(dname_stripped) + # empty dentry names are most likely + # the result of smearing + if not dname: + smeared = True + path_reversed.append(dname.strip("/")) dentry = parent - if path_reversed == []: - return "" path = "/" + "/".join(reversed(path_reversed)) + if smeared: + return f" {path}" return path @classmethod From 92673be42c761051561c3894050b6a0fb06c17f1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 6 May 2025 22:15:38 +0100 Subject: [PATCH 1098/1352] Reformat and install volatility package deps before build --- .github/workflows/build-pyinstaller.yml | 60 ++++++++++++------------- 1 file changed, 30 insertions(+), 30 deletions(-) diff --git a/.github/workflows/build-pyinstaller.yml b/.github/workflows/build-pyinstaller.yml index bcba95403..21c2d8acf 100644 --- a/.github/workflows/build-pyinstaller.yml +++ b/.github/workflows/build-pyinstaller.yml @@ -4,47 +4,47 @@ on: branches: - stable - develop - - 'release/**' + - "release/**" pull_request: branches: - stable - - 'release/**' + - "release/**" jobs: - exe: runs-on: windows-latest strategy: matrix: python-version: ["3.11"] steps: - - uses: actions/checkout@v3 - - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v4 - with: - python-version: ${{ matrix.python-version }} + - uses: actions/checkout@v3 + - name: Set up Python ${{ matrix.python-version }} + uses: actions/setup-python@v4 + with: + python-version: ${{ matrix.python-version }} - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install pyinstaller - - - name: Pyinstall executable - run: | - pyinstaller --clean -y vol.spec - pyinstaller --clean -y volshell.spec + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install pyinstaller + pip install -e .[full,cloud] - - name: Move files - run: | - mv dist/vol.exe vol.exe - mv dist/volshell.exe volshell.exe + - name: Pyinstall executable + run: | + pyinstaller --clean -y vol.spec + pyinstaller --clean -y volshell.spec - - name: Archive - uses: actions/upload-artifact@v4 - with: - name: volatility3-pyinstaller - path: | - vol.exe - volshell.exe - README.md - LICENSE.txt + - name: Move files + run: | + mv dist/vol.exe vol.exe + mv dist/volshell.exe volshell.exe + + - name: Archive + uses: actions/upload-artifact@v4 + with: + name: volatility3-pyinstaller + path: | + vol.exe + volshell.exe + README.md + LICENSE.txt From ee445d974692f3061dd6cb7eaae7c653381c740f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 6 May 2025 22:27:03 +0100 Subject: [PATCH 1099/1352] Add in workflow_dispatch for pyinstaller action --- .github/workflows/build-pyinstaller.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build-pyinstaller.yml b/.github/workflows/build-pyinstaller.yml index 21c2d8acf..b1d15eb10 100644 --- a/.github/workflows/build-pyinstaller.yml +++ b/.github/workflows/build-pyinstaller.yml @@ -9,6 +9,7 @@ on: branches: - stable - "release/**" + workflow_dispatch: jobs: exe: From 718f8ca2b583d8fa8626502566f31fe1d5b92b3e Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 6 May 2025 22:41:21 +0100 Subject: [PATCH 1100/1352] Update volatility3/framework/plugins/linux/vmayarascan.py --- volatility3/framework/plugins/linux/vmayarascan.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 9a413dd9d..64f5827c1 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -39,9 +39,6 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) ), - requirements.VersionRequirement( - name="yarascanner", component=yarascan.YaraScanner, version=(2, 0, 0) - ), requirements.ModuleRequirement( name="kernel", description="Linux kernel", From c0c7119c38e18ed92349d2ee7affe837bcba3aa0 Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 6 May 2025 22:41:27 +0100 Subject: [PATCH 1101/1352] Update volatility3/framework/plugins/windows/thrdscan.py --- volatility3/framework/plugins/windows/thrdscan.py | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 81ed9976f..d5a1a0b07 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -143,18 +143,8 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) else None ) else: - vads = None - - start_path = ( - pe_symbols.PESymbols.filepath_for_address(vads, thread_start_addr) - if vads - else None - ) - win32start_path = ( - pe_symbols.PESymbols.filepath_for_address(vads, thread_win32start_addr) - if vads - else None - ) + start_path = None + win32start_path = None return cls.ThreadInfo( thread_offset, From 606fecf5f81b5adcc5fee1ea82b870ceafb826d1 Mon Sep 17 00:00:00 2001 From: ikelos Date: Tue, 6 May 2025 22:41:33 +0100 Subject: [PATCH 1102/1352] Update volatility3/framework/plugins/windows/vadyarascan.py --- volatility3/framework/plugins/windows/vadyarascan.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 62d3f8862..04b9aadd9 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -99,7 +99,6 @@ class VadYaraScan(interfaces.plugins.PluginInterface): layer_name=layer.name, length=len(value), ) - yield 0, ( format_hints.Hex(offset), task.UniqueProcessId, From 94a029232848f34e0c8366ef145509a436d41c27 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 7 May 2025 19:05:05 +0300 Subject: [PATCH 1103/1352] add functions to etwpatch --- volatility3/framework/plugins/windows/etwpatch.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 14fbacc28..2388bdcc7 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -30,10 +30,17 @@ class EtwPatch(interfaces.plugins.PluginInterface): "EtwEventWrite", "EtwEventWriteFull", "NtTraceEvent", + "NtTraceEvent", + "ZwTraceEvent", + "NtTraceControl", + "ZwTraceControl", + "EtwpEventWriteFull" ], }, "advapi32.dll": { - pe_symbols.wanted_names_identifier: ["EventWrite"], + pe_symbols.wanted_names_identifier: [ + "EventWrite", + "TraceEvent"], }, } From fc7e13f6f881f59a11ce428e9880608f2517b677 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 7 May 2025 19:30:58 +0300 Subject: [PATCH 1104/1352] black --- volatility3/framework/plugins/windows/etwpatch.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index 2388bdcc7..fb6375fd4 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -34,13 +34,11 @@ class EtwPatch(interfaces.plugins.PluginInterface): "ZwTraceEvent", "NtTraceControl", "ZwTraceControl", - "EtwpEventWriteFull" + "EtwpEventWriteFull", ], }, "advapi32.dll": { - pe_symbols.wanted_names_identifier: [ - "EventWrite", - "TraceEvent"], + pe_symbols.wanted_names_identifier: ["EventWrite", "TraceEvent"], }, } From 9ddf2d9abb5bb4bf820633e5345a033d6e70560f Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 7 May 2025 19:55:30 +0300 Subject: [PATCH 1105/1352] refs --- volatility3/framework/plugins/windows/etwpatch.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index fb6375fd4..b392f07ca 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -12,6 +12,8 @@ from volatility3.plugins.windows import pslist, pe_symbols vollog = logging.getLogger(__name__) +# EtwpEventWriteFull -> https://github.com/SolitudePy/Stealthy-ETW-Patch +# CAPA rule -> https://github.com/mandiant/capa-rules/blob/master/anti-analysis/anti-av/patch-event-tracing-for-windows-function.yml class EtwPatch(interfaces.plugins.PluginInterface): """Identifies ETW (Event Tracing for Windows) patching techniques used by malware to evade detection. @@ -80,7 +82,6 @@ class EtwPatch(interfaces.plugins.PluginInterface): kernel_module_name=self.config["kernel"], filter_func=filter_func, ): - try: proc_id = proc.UniqueProcessId proc_name = utility.array_to_string(proc.ImageFileName) From f719efb9ec88317ae5af87586d1351673bb858a4 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 7 May 2025 20:39:46 +0300 Subject: [PATCH 1106/1352] dupe --- volatility3/framework/plugins/windows/etwpatch.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/etwpatch.py b/volatility3/framework/plugins/windows/etwpatch.py index b392f07ca..476d0eea7 100644 --- a/volatility3/framework/plugins/windows/etwpatch.py +++ b/volatility3/framework/plugins/windows/etwpatch.py @@ -32,7 +32,6 @@ class EtwPatch(interfaces.plugins.PluginInterface): "EtwEventWrite", "EtwEventWriteFull", "NtTraceEvent", - "NtTraceEvent", "ZwTraceEvent", "NtTraceControl", "ZwTraceControl", From 92eae9c50f56a486f0d62d57a68135d2b7375001 Mon Sep 17 00:00:00 2001 From: eve Date: Fri, 9 May 2025 09:06:43 +0100 Subject: [PATCH 1107/1352] Linux: Add comment for explaining the behaviour with smear --- volatility3/framework/symbols/linux/__init__.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 65f20d88d..327c6dd37 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -99,7 +99,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" - _version = (2, 3, 0) + _version = (2, 3, 1) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) @@ -200,6 +200,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): path = "/" + "/".join(reversed(path_reversed)) if smeared: + # if there is smear the missing dname will be empty. e.g. if the normal + # path would be /foo/bar/baz, but bar is missing due to smear the results + # returned here will show /foo//baz. Note the // for the missing dname. return f" {path}" return path From e0abdd92f2889e3841197573393d87c8c31d2a68 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Tue, 13 May 2025 17:52:12 -0500 Subject: [PATCH 1108/1352] Windows Thrdscan: Fix broken tuple unpacking Timeliner fails due to an incorrect unpacking of this tuple, which needs 3 additional dictionary items for start path, win32 start path, and win32 start address. --- volatility3/framework/plugins/windows/thrdscan.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index d5a1a0b07..082b82284 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -190,6 +190,9 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) row_dict["PID"], row_dict["TID"], row_dict["StartAddress"], + row_dict["StartPath"], + row_dict["Win32StartAddress"], + row_dict["Win32StartPath"], row_dict["CreateTime"], row_dict["ExitTime"], ) = row_data From 90a3829ee766f3ef5530ef061389e7f343ba96b8 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 15 May 2025 17:28:26 -0500 Subject: [PATCH 1109/1352] Windows Timeliner: Add basic test This is enough to ensure that the return code is nonzero and there was some valid output. --- test/plugins/windows/windows.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 4272b64d2..0f44ba533 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -58,6 +58,14 @@ class TestWindowsPslist: } assert test_volatility.match_output_row(expected_row, json.loads(out)) +class TestWindowsTimeliner: + def test_windows_specific_timeliner(self, volatility, python): + image = WindowsSamples.WINDOWSXP_GENERIC.value.path + rc, out, _err = test_volatility.runvol_plugin( + "timeliner.Timeliner", image, volatility, python + ) + assert rc == 0 + assert out.count(b"\n") > 10 class TestWindowsPsscan: def test_windows_specific_psscan(self, volatility, python): From f79d0cb5ef02c6e88174bdf341f38e6d3e9e8286 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Fri, 16 May 2025 20:10:50 +0100 Subject: [PATCH 1110/1352] Align SeCreateTokenPrivilege with the other privileges --- .../framework/plugins/windows/sids_and_privileges.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/sids_and_privileges.json b/volatility3/framework/plugins/windows/sids_and_privileges.json index 0378699ac..4333617d0 100644 --- a/volatility3/framework/plugins/windows/sids_and_privileges.json +++ b/volatility3/framework/plugins/windows/sids_and_privileges.json @@ -573,7 +573,7 @@ ["S-1-5-21-[0-9-]+-553$", "Remote Access Services (RAS)"] ], "privileges":{ - "2": ["SeCreateTokenPrivilege", "Create a token object"], + "2": ["SeCreateTokenPrivilege", "Create a token object"], "3": ["SeAssignPrimaryTokenPrivilege", "Replace a process-level token"], "4": ["SeLockMemoryPrivilege", "Lock pages in memory"], "5": ["SeIncreaseQuotaPrivilege", "Increase quotas"], @@ -609,4 +609,4 @@ "35": ["SeCreateSymbolicLinkPrivilege", "Required to create a symbolic link"], "36": ["SeDelegateSessionUserImpersonatePrivilege", "Obtain an impersonation token for another user in the same session."] } -} \ No newline at end of file +} From c1d1c66daf333f465fc780a3018f71acbedffa7c Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 17 May 2025 09:28:49 +0100 Subject: [PATCH 1111/1352] Remove extra word in comment --- volatility3/framework/plugins/mac/pslist.py | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index 8c5e5c1a5..19f4516ac 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -135,7 +135,7 @@ class PsList(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - kernel_module_name: The name of the the kernel module on which to operate + kernel_module_name: The name of the kernel module on which to operate filter_func: A function which takes a process object and returns True if the process should be ignored/filtered Returns: @@ -180,7 +180,7 @@ class PsList(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - kernel_module_name: The name of the the kernel module on which to operate + kernel_module_name: The name of the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: @@ -224,7 +224,7 @@ class PsList(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - kernel_module_name: The name of the the kernel module on which to operate + kernel_module_name: The name of the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: @@ -259,7 +259,7 @@ class PsList(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - kernel_module_name: The name of the the kernel module on which to operate + kernel_module_name: The name of the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: @@ -297,7 +297,7 @@ class PsList(interfaces.plugins.PluginInterface): Args: context: The context to retrieve required elements (layers, symbol tables) from - kernel_module_name: The name of the the kernel module on which to operate + kernel_module_name: The name of the kernel module on which to operate filter_func: A function which takes a task object and returns True if the task should be ignored/filtered Returns: From 4eef4c00843a02b1cd64ad71a92d082ad58be5d2 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 17 May 2025 09:30:15 +0100 Subject: [PATCH 1112/1352] Remove extra word in comment --- doc/source/getting-started-windows-tutorial.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/source/getting-started-windows-tutorial.rst b/doc/source/getting-started-windows-tutorial.rst index 979cf1d96..3896000a2 100644 --- a/doc/source/getting-started-windows-tutorial.rst +++ b/doc/source/getting-started-windows-tutorial.rst @@ -27,7 +27,7 @@ For plugin requests, please create an issue with a description of the requested windows.crashinfo.Crashinfo windows.dlllist.DllList -.. note:: Here the the command is piped to grep and head to provide the start of a list of the available windows plugins. +.. note:: Here the command is piped to grep and head to provide the start of a list of the available windows plugins. Using plugins ------------- @@ -97,7 +97,7 @@ windows.pstree ``windows.pstree`` helps to display the parent-child relationships between processes. -.. note:: Here the the command is piped to head to provide smaller output, here listing only the first 20. +.. note:: Here the command is piped to head to provide smaller output, here listing only the first 20. windows.hashdump ~~~~~~~~~~~~~~~~ From c93d2248d10db7c2b5af603b1050ab9685c31a14 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 17 May 2025 09:30:52 +0100 Subject: [PATCH 1113/1352] Remove extra word in comment --- doc/source/getting-started-mac-tutorial.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/getting-started-mac-tutorial.rst b/doc/source/getting-started-mac-tutorial.rst index 61af7089b..f4889d689 100644 --- a/doc/source/getting-started-mac-tutorial.rst +++ b/doc/source/getting-started-mac-tutorial.rst @@ -37,7 +37,7 @@ For plugin requests, please create an issue with a description of the requested mac.check_sysctl.Check_sysctl mac.check_trap_table.Check_trap_table -.. note:: Here the the command is piped to grep and head to provide the start of the list of macOS plugins. +.. note:: Here the command is piped to grep and head to provide the start of the list of macOS plugins. Using plugins From 8bc2271e6f3c892b65f012717cadd22ef3b2a7fd Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 17 May 2025 09:31:19 +0100 Subject: [PATCH 1114/1352] Remove extra word in comment --- doc/source/getting-started-linux-tutorial.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index a1aad235d..031b49636 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -40,7 +40,7 @@ For plugin requests, please create an issue with a description of the requested linux.check_creds.Check_creds linux.check_idt.Check_idt -.. note:: Here the the command is piped to grep and head to provide the start of the list of linux plugins. +.. note:: Here the command is piped to grep and head to provide the start of the list of linux plugins. Using plugins From 6269091be761e3906ab184665d33cd3a85cdf1f5 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 18 May 2025 20:08:25 +0100 Subject: [PATCH 1115/1352] CLI: Support listing/clearing breakpoints in volshell --- volatility3/cli/volshell/generic.py | 44 +++++++++++++++++++++++++++-- 1 file changed, 42 insertions(+), 2 deletions(-) diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index 4c90c39c9..e68b0334e 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -187,6 +187,8 @@ class Volshell(interfaces.plugins.PluginInterface): def construct_locals(self) -> List[Tuple[List[str], Any]]: """Returns a listing of the functions to be added to the environment.""" return [ + (["bc", "breakpoint_clear"], self.breakpoint_clear), + (["bl", "breakpoint_list"], self.breakpoint_list), (["bp", "breakpoint"], self.breakpoint), (["dt", "display_type"], self.display_type), (["db", "display_bytes"], self.display_bytes), @@ -827,10 +829,13 @@ class Volshell(interfaces.plugins.PluginInterface): original_read = getattr(wrapped_read, "original_read") for breakpoint in getattr(wrapped_read, "breakpoints"): if (offset <= breakpoint) and (breakpoint < offset + length): + print( + "Hit breakpoint, entering python debugger. To continue running without the debugger use the command continue" + ) import pdb pdb.set_trace() - print("Hit breakpoint") + _ = "First statement after the breakpoint, use u(p), d(own) and list to navigate through the execution frames" return original_read(offset, length, pad) setattr(wrapped_read, "breakpoints", set()) @@ -838,11 +843,46 @@ class Volshell(interfaces.plugins.PluginInterface): setattr(layer, "read", wrapped_read) # Add the new breakpoint - print(f"Setting breakpoint {address:x} on {layer.name}") + print(f"Setting breakpoint {address:#x} on {layer.name}") breakpoints = getattr(layer.read, "breakpoints") breakpoints.add(address) setattr(layer.read, "breakpoints", breakpoints) + def breakpoint_list(self, layer_names: Optional[List[str]] = None): + """List available breakpoints for a set of layers""" + if not layer_names: + layer_names = [layer_name for layer_name in self.context.layers] + + print("Listing breakpoints:") + for layer_name in layer_names: + print(f" {layer_name}") + layer = self.context.layers.get(layer_name, None) + if layer and hasattr(layer.read, "breakpoints"): + for breakpoint in layer.read.breakpoints: + print(f" {breakpoint:#x}") + + def breakpoint_clear( + self, offset: Optional[int] = None, layer_name: Optional[str] = None + ): + """Clears a offset breakpoint on a layer (or all breakpoints if offset or layer not specified) + + Args: + offset: Address of the breakpoint to clear (or all if None) + layer_name: Layer to clear breakpoints from (or all if None) + """ + print("Clearing breakpoints:") + for candidate_layer_name in self.context.layers: + candidate_layer = self.context.layers[candidate_layer_name] + if layer_name is None or layer_name == candidate_layer_name: + print(f" {candidate_layer_name}") + if hasattr(candidate_layer.read, "breakpoints"): + breakpoints_to_remove = set() + for breakpoint in candidate_layer.read.breakpoints: + if offset is None or offset == breakpoint: + print(f" clearing {breakpoint:#x}") + breakpoints_to_remove.add(breakpoint) + candidate_layer.read.breakpoints -= breakpoints_to_remove + class NullFileHandler(io.BytesIO, interfaces.plugins.FileHandlerInterface): """Null FileHandler that swallows files whole without consuming memory""" From cb3e18ec9e354843cd4cff2f0fe6ba9befda6efd Mon Sep 17 00:00:00 2001 From: Elad Levi <99.elad.levi@gmail.com> Date: Mon, 19 May 2025 13:24:58 +0300 Subject: [PATCH 1116/1352] Update hashdump.py calling `.Name` returns array, changed to `.get_name()` which returns a string (the if statement in the code didn't work before this change) --- volatility3/framework/plugins/windows/registry/hashdump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/registry/hashdump.py b/volatility3/framework/plugins/windows/registry/hashdump.py index 1883d4530..256f15d61 100644 --- a/volatility3/framework/plugins/windows/registry/hashdump.py +++ b/volatility3/framework/plugins/windows/registry/hashdump.py @@ -350,7 +350,7 @@ class Hashdump(interfaces.plugins.PluginInterface): if not user_key: return [] - return [k for k in user_key.get_subkeys() if k.Name != "Names"] + return [k for k in user_key.get_subkeys() if k.get_name() != "Names"] @classmethod def get_bootkey(cls, syshive: registry_layer.RegistryHive) -> Optional[bytes]: From 2180c07c03cd69788f4d5d760d65ee47ad13c6f8 Mon Sep 17 00:00:00 2001 From: geekscrapy <11225502+geekscrapy@users.noreply.github.com> Date: Mon, 19 May 2025 14:47:29 +0400 Subject: [PATCH 1117/1352] Make nocase accessible --- volatility3/framework/plugins/yarascan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 49db2af02..040a50c1a 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -182,7 +182,7 @@ class YaraScan(plugins.PluginInterface): rule = config["yara_string"] if rule[0] not in ["{", "/"]: rule = f'"{rule}"' - if config.get("case", False): + if config.get("insensitive", False): rule += " nocase" if config.get("wide", False): rule += " wide ascii" From 0d272c919a0a30117264c8b336c9cb1ec65406e8 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 21 May 2025 18:48:51 +0200 Subject: [PATCH 1118/1352] enhance VMA smearing protection --- .../symbols/linux/extensions/__init__.py | 44 ++++++++++++++++--- 1 file changed, 37 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index c980ee6b1..a97cf2a5a 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1094,14 +1094,11 @@ class mm_struct(objects.StructType): vm_area_struct objects """ for vma in self._do_get_vma_iter(): - try: - vma.vm_start - vma.vm_end - vma.get_protection() - - yield vma - except exceptions.InvalidAddressException: + if not vma.is_valid(): vollog.debug(f"Skipping invalid vm_area_struct at {vma.vol.offset:#x}") + continue + + yield vma class super_block(objects.StructType): @@ -1237,6 +1234,39 @@ class vm_area_struct(objects.StructType): retval = retval + "-" return retval + def is_valid(self) -> bool: + """Validate a VMA struct to prevent processing smeared entries.""" + try: + start = self.vm_start + end = self.vm_end + self.get_protection() + except exceptions.InvalidAddressException: + return False + + layer = self._context.layers[self.vol.layer_name] + length = end - start + if ( + (start > end) + or (start == 0 and length == 0) + or (length % layer.page_size != 0) + ): + return False + + if self.vm_file != 0: + try: + inode = self.vm_file.get_inode() + except exceptions.InvalidAddressException: + return False + + # Verify that a file-backed VMA's page offset + # is not greater than the size of the file's inode. + # Check only inode sizes greater than 0 to account for + # special devices (e.g. "/dev/dri/card0") and prevent false negatives. + if inode.i_size > 0 and self.get_page_offset() > inode.i_size: + return False + + return True + # only parse the rwx bits def get_protection(self) -> str: return self._parse_flags(self.vm_flags & 0b1111, vm_area_struct.perm_flags) From 75293ec93185da3cb09f072d6a07a4a67dc08136 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 21 May 2025 18:49:31 +0200 Subject: [PATCH 1119/1352] bump: 2.26.2 -> 2.27.0 --- volatility3/framework/constants/_version.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 07b9e45ec..7f71c277e 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 26 # Number of changes that only add to the interface -VERSION_PATCH = 2 # Number of changes that do not change the interface +VERSION_MINOR = 27 # Number of changes that only add to the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From 4f11586ef19bff42f28298c98ad943f769200751 Mon Sep 17 00:00:00 2001 From: Jost Alemann Date: Thu, 22 May 2025 23:25:15 +0200 Subject: [PATCH 1120/1352] fix: typos --- development/compare-vol.py | 2 +- volatility3/cli/text_renderer.py | 4 ++-- volatility3/cli/volshell/generic.py | 4 ++-- volatility3/framework/__init__.py | 2 +- volatility3/framework/automagic/symbol_cache.py | 2 +- volatility3/framework/contexts/__init__.py | 2 +- volatility3/framework/interfaces/context.py | 2 +- volatility3/framework/layers/intel.py | 2 +- volatility3/framework/objects/utility.py | 2 +- volatility3/framework/plugins/layerwriter.py | 2 +- volatility3/framework/plugins/linux/capabilities.py | 2 +- volatility3/framework/plugins/linux/netfilter.py | 4 ++-- .../framework/plugins/linux/tracing/ftrace.py | 2 +- .../framework/plugins/linux/tracing/tracepoints.py | 2 +- volatility3/framework/plugins/linux/vmaregexscan.py | 2 +- volatility3/framework/plugins/mac/pslist.py | 2 +- volatility3/framework/plugins/regexscan.py | 2 +- volatility3/framework/plugins/vmscan.py | 2 +- .../framework/plugins/windows/direct_system_calls.py | 4 ++-- .../plugins/windows/orphan_kernel_threads.py | 2 +- volatility3/framework/plugins/windows/pe_symbols.py | 8 ++++---- .../framework/plugins/windows/processghosting.py | 2 +- .../framework/plugins/windows/registry/hashdump.py | 2 +- .../plugins/windows/registry/scheduled_tasks.py | 4 ++-- .../framework/plugins/windows/shimcachemem.py | 2 +- .../framework/plugins/windows/suspicious_threads.py | 2 +- .../framework/plugins/windows/vadregexscan.py | 2 +- volatility3/framework/renderers/__init__.py | 2 +- volatility3/framework/symbols/linux/__init__.py | 2 +- .../framework/symbols/linux/extensions/__init__.py | 12 ++++++------ .../framework/symbols/linux/extensions/network.py | 6 +++--- volatility3/framework/symbols/linux/kallsyms.py | 2 +- .../symbols/linux/utilities/module_extract.py | 8 ++++---- .../framework/symbols/linux/utilities/modules.py | 6 +++--- .../framework/symbols/windows/extensions/consoles.py | 2 +- .../framework/symbols/windows/extensions/gui.py | 2 +- 36 files changed, 56 insertions(+), 56 deletions(-) diff --git a/development/compare-vol.py b/development/compare-vol.py index a01d8e93c..717d81d3e 100644 --- a/development/compare-vol.py +++ b/development/compare-vol.py @@ -339,7 +339,7 @@ if __name__ == "__main__": "--vol3path", type=str, default=os.path.join(os.getcwd(), "volatility3"), - help="Path ot the volatility 3 directory", + help="Path to the volatility 3 directory", ) parser.add_argument( "--vol2path", diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 044f33ed1..1e437a0be 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -49,7 +49,7 @@ def hex_bytes_as_text(value: bytes, width: int = 16) -> str: output += "\n" printables = "" - # Handle leftovers when the length is not mutiple of width + # Handle leftovers when the length is not a multiple of width if printables: padding = width - len(printables) output += " " * padding @@ -182,7 +182,7 @@ class LayerDataRenderer(CLITypeRenderer): output += "\n" printables = "" - # Handle leftovers when the length is not mutiple of width + # Handle leftovers when the length is not a multiple of width if printables: padding = self.width - len(printables) output += " " * padding diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index e68b0334e..ace4b2119 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -485,7 +485,7 @@ class Volshell(interfaces.plugins.PluginInterface): return if hasattr(volobject.vol, "members"): - # display the header for this object, if the orginal object was just a type string, display the type information + # display the header for this object, if the original object was just a type string, display the type information struct_header = f'{" " * dereference_count}{volobject.vol.type_name} ({volobject.vol.size} bytes)' if isinstance(object, str) and offset is None: suffix = ":" @@ -558,7 +558,7 @@ class Volshell(interfaces.plugins.PluginInterface): ) else: # simple type with no members, only one line to print - # if the orginal object was just a type string, display the type information + # if the original object was just a type string, display the type information if isinstance(object, str) and offset is None: print(self._display_simple_type(volobject, include_value=False)) diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 0bbdefa43..c384542a8 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -218,4 +218,4 @@ def clear_cache(complete=True): os.unlink(cache_filename) os.unlink(os.path.join(constants.CACHE_PATH, constants.IDENTIFIERS_FILENAME)) except FileNotFoundError: - vollog.log(constants.LOGLEVEL_VVVV, "Attempting to clear a non-existant cache") + vollog.log(constants.LOGLEVEL_VVVV, "Attempting to clear a non-existent cache") diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index cd1a348a4..327575e96 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -507,7 +507,7 @@ def load_cache_manager(cache_file: Optional[str] = None) -> CacheManagerInterfac cache_file = os.path.join(constants.CACHE_PATH, constants.IDENTIFIERS_FILENAME) # Different implementations of cache if not os.path.exists(cache_file): - raise ValueError("Non-existant cache file provided") + raise ValueError("Non-existent cache file provided") with open(cache_file, "rb") as fp: header = fp.read(4) if header not in [b"SQLi"]: diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index a000fce90..32d33f657 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -287,7 +287,7 @@ class Module(interfaces.context.ModuleInterface): symbol_name: Name of the symbol (within the module) to construct native_layer_name: Name of the layer in which constructed objects are made (for pointers) absolute: whether the symbol's address is absolute or relative to the module - object_type: Override for the type from the symobl to use (or if the symbol type is missing) + object_type: Override for the type from the symbol to use (or if the symbol type is missing) """ if constants.BANG not in symbol_name: symbol_name = self.symbol_table_name + constants.BANG + symbol_name diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index 723f2fd46..4f863898e 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -267,7 +267,7 @@ class ModuleInterface(interfaces.configuration.ConfigurableInterface): symbol_name: The name of a symbol (that must be present in the module's symbol table). The symbol's associated type will be used to construct an object at the symbol's offset. native_layer_name: The native layer for objects that reference a different layer (if not the default provided during module construction) absolute: A boolean specifying whether the offset is absolute within the layer, or relative to the start of the module - object_type: Override for the type from the symobl to use (or if the symbol type is missing) + object_type: Override for the type from the symbol to use (or if the symbol type is missing) Returns: The constructed object diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 1069b7f6d..696c33353 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -136,7 +136,7 @@ class Intel(linear.LinearlyMappedLayer): return bool(entry & (1 << 6)) def canonicalize(self, addr: int) -> int: - """Canonicalizes an address by performing an appropiate sign extension on the higher addresses""" + """Canonicalizes an address by performing an appropriate sign extension on the higher addresses""" if self._bits_per_register <= self._maxvirtaddr: return addr & self.address_mask elif addr < (1 << self._maxvirtaddr - 1): diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index ef702060c..59ac0ee55 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -152,7 +152,7 @@ def bytes_to_decoded_string( """ Args: data: The `bytes` buffer containing the string of a string at offset 0 - encoding: An encoding value for the encoding paramater of `bytes.decode` + encoding: An encoding value for the encoding parameter of `bytes.decode` errors: An errors value for the errors parameter of `bytes.decode` return_truncated: Dictates whether truncated strings should be returned or if a ValueError should be thrown if a truncated (broken) string was decoded diff --git a/volatility3/framework/plugins/layerwriter.py b/volatility3/framework/plugins/layerwriter.py index 10e7a7a72..bcc999aba 100644 --- a/volatility3/framework/plugins/layerwriter.py +++ b/volatility3/framework/plugins/layerwriter.py @@ -62,7 +62,7 @@ class LayerWriter(plugins.PluginInterface): Args: context: the context from which to read the memory layer layer_name: the name of the layer to write out - preferred_name: a string with the preferred filename for hte file + preferred_name: a string with the preferred filename for the file chunk_size: an optional size for the chunks that should be written (defaults to 0x500000) open_method: class for creating FileHandler context managers progress_callback: an optional function that takes a percentage and a string that displays output diff --git a/volatility3/framework/plugins/linux/capabilities.py b/volatility3/framework/plugins/linux/capabilities.py index dae6aac6a..364047893 100644 --- a/volatility3/framework/plugins/linux/capabilities.py +++ b/volatility3/framework/plugins/linux/capabilities.py @@ -29,7 +29,7 @@ class TaskData: @dataclass class CapabilitiesData: - """Stores each set of capabilties for a task""" + """Stores each set of capabilities for a task""" cap_inheritable: interfaces.objects.ObjectInterface cap_permitted: interfaces.objects.ObjectInterface diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index 9079adef9..d724d4296 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -417,7 +417,7 @@ class NetfilterImp_to_4_3(AbstractNetfilter): class NetfilterImp_4_3_to_4_9(AbstractNetfilter): - """Netfilter hooks were added to network namepaces in 4.3. + """Netfilter hooks were added to network namespaces in 4.3. It is still implemented as a linked list of 'struct nf_hook_ops' type but inside a network namespace. One linked list per protocol per hook type. @@ -611,7 +611,7 @@ class NetfilterImp_4_16_to_latest(NetfilterImp_4_14_to_4_16): class AbstractNetfilterNetDev(AbstractNetfilter): """Base class to handle the Netfilter NetDev hooks. It won't be executed. It has some common functions to all Netfilter NetDev hook - implementions. + implementations. Netfilter NetDev hooks are set per network device which belongs to a network namespace. diff --git a/volatility3/framework/plugins/linux/tracing/ftrace.py b/volatility3/framework/plugins/linux/tracing/ftrace.py index afcc71784..4b7c2ebb3 100644 --- a/volatility3/framework/plugins/linux/tracing/ftrace.py +++ b/volatility3/framework/plugins/linux/tracing/ftrace.py @@ -48,7 +48,7 @@ class FtraceOpsFlags(Enum): @dataclass class ParsedFtraceOps: """Parsed ftrace_ops struct representation, containing a selection of forensics valuable - informations.""" + information.""" ftrace_ops_offset: int callback_symbol: str diff --git a/volatility3/framework/plugins/linux/tracing/tracepoints.py b/volatility3/framework/plugins/linux/tracing/tracepoints.py index 25c87b664..8666ffd6a 100644 --- a/volatility3/framework/plugins/linux/tracing/tracepoints.py +++ b/volatility3/framework/plugins/linux/tracing/tracepoints.py @@ -21,7 +21,7 @@ vollog = logging.getLogger(__name__) @dataclass class ParsedTracepointFunc: """Parsed tracepoint_func struct, containing a selection of forensics valuable - informations.""" + information.""" tracepoint_name: str tracepoint_address: int diff --git a/volatility3/framework/plugins/linux/vmaregexscan.py b/volatility3/framework/plugins/linux/vmaregexscan.py index 37a1a5940..fb757beb5 100644 --- a/volatility3/framework/plugins/linux/vmaregexscan.py +++ b/volatility3/framework/plugins/linux/vmaregexscan.py @@ -91,7 +91,7 @@ class VmaRegExScan(plugins.PluginInterface): ): result_data = proc_layer.read(offset, self.MAXSIZE_DEFAULT, pad=True) - # reapply the regex in order to extact just the match + # reapply the regex in order to extract just the match regex_result = re.match(regex_pattern, result_data) if regex_result: diff --git a/volatility3/framework/plugins/mac/pslist.py b/volatility3/framework/plugins/mac/pslist.py index 19f4516ac..904e4e201 100644 --- a/volatility3/framework/plugins/mac/pslist.py +++ b/volatility3/framework/plugins/mac/pslist.py @@ -56,7 +56,7 @@ class PsList(interfaces.plugins.PluginInterface): """Returns the list_tasks method based on the selector Args: - method: Must be one fo the available methods in get_task_choices + method: Must be one of the available methods in get_task_choices Returns: list_tasks method for listing tasks diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index 343753e92..7df89f841 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -56,7 +56,7 @@ class RegExScan(plugins.PluginInterface): ): result_data = layer.read(offset, self.MAXSIZE_DEFAULT, pad=True) - # reapply the regex in order to extact just the match + # reapply the regex in order to extract just the match regex_result = re.match(regex_pattern, result_data) if regex_result: diff --git a/volatility3/framework/plugins/vmscan.py b/volatility3/framework/plugins/vmscan.py index 5322456b5..19d997605 100644 --- a/volatility3/framework/plugins/vmscan.py +++ b/volatility3/framework/plugins/vmscan.py @@ -54,7 +54,7 @@ class PageStartScanner(interfaces.layers.ScannerInterface): class Vmscan(plugins.PluginInterface): - """Scans for Intel VT-d structues and generates VM volatility configs for them""" + """Scans for Intel VT-d structures and generates VM volatility configs for them""" _required_framework_version = (2, 2, 0) _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 60dbf728c..dce09605b 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -42,7 +42,7 @@ syscall_finder_type.__doc__ = """ This type is used to specify how malicious system call invocations should be found. `get_syscall_target_address` is optionally used to extract the address containing the malicious 'syscall' instruction -`wants_syscall_inst` whether or not this method expects the 'syscall' instrunction directly within the malicious code block +`wants_syscall_inst` whether or not this method expects the 'syscall' instruction directly within the malicious code block `rule` the opcode string to search for the malicious syscall instructions `invalid_ops` instructions that only appear in invalid code blocks. Stops processing of the code block when encountered. `termination_ops` instructions that are expected to be present in the code block and that stop processing @@ -116,7 +116,7 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): address: int, ) -> Optional[Tuple[str, "capstone._cs_insn"]]: """ - Determines if the bytes starting at `data` represent a valid syscall instrunction invocation block + Determines if the bytes starting at `data` represent a valid syscall instruction invocation block To maliciously invoke the system call instruction, malware must do each of the following: diff --git a/volatility3/framework/plugins/windows/orphan_kernel_threads.py b/volatility3/framework/plugins/windows/orphan_kernel_threads.py index b4dec0fc5..16a25503e 100644 --- a/volatility3/framework/plugins/windows/orphan_kernel_threads.py +++ b/volatility3/framework/plugins/windows/orphan_kernel_threads.py @@ -85,7 +85,7 @@ class Threads(thrdscan.ThrdScan): # previous methods for determining if a thread was a kernel thread # such as bit fields and flags are not stable in Win10+ # so we check if the thread is from the kernel itself or one its child - # kernel processes (MemCompression, Regsitry, ...) + # kernel processes (MemCompression, Registry, ...) if pid != 4 and ppid != 4: continue diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index e3af0c28a..00c6fd868 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -37,7 +37,7 @@ filter_modules_type = Dict[str, filter_module_info] found_symbols_module = List[Tuple[str, int]] found_symbols_type = Dict[str, found_symbols_module] -# used to hold informatin about a range (VAD or kernel module) +# used to hold information about a range (VAD or kernel module) # (start address, size, file path) range_type = Tuple[int, int, str] ranges_type = List[range_type] @@ -243,7 +243,7 @@ class PESymbols(interfaces.plugins.PluginInterface): _required_framework_version = (2, 7, 0) # 2.0.0 - changed signature of get_kernel_modules, get_all_vads_with_file_paths, addresses_for_process_symbols, get_process_modules - # 3.0.0 - find_symbols wil now throw a ValueError if the provided wanted symbol information does not follow the spec + # 3.0.0 - find_symbols will now throw a ValueError if the provided wanted symbol information does not follow the spec _version = (3, 0, 0) # used for special handling of the kernel PDB file. See later notes @@ -649,7 +649,7 @@ class PESymbols(interfaces.plugins.PluginInterface): and wanted_addresses_identifier not in wanted_symbols ): vollog.warning( - "Invalid `wanted_symbols` sent to `find_symbols`. addresses and names keys both misssing." + "Invalid `wanted_symbols` sent to `find_symbols`. addresses and names keys both missing." ) return @@ -671,7 +671,7 @@ class PESymbols(interfaces.plugins.PluginInterface): for value_index, wanted_value in enumerate(all_wanted): symbol_value = symbol_getter(wanted_value) if symbol_value: - # yield out deleteion key, deletion index, symbol name, symbol address + # yield out deletion key, deletion index, symbol name, symbol address if symbol_key == wanted_names_identifier: yield symbol_key, wanted_value, symbol_value else: diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index 7e7f6d3cc..f234bc2e7 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -118,7 +118,7 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): Args: proc: - mapped_files: A dictionary mapping vad base addreses to the path and vad instance for the process + mapped_files: A dictionary mapping vad base addresses to the path and vad instance for the process Return: A Generator of tuples of the file object address, the delete pending state, delete on close state, base address of the VAD, and the path diff --git a/volatility3/framework/plugins/windows/registry/hashdump.py b/volatility3/framework/plugins/windows/registry/hashdump.py index 256f15d61..19bd60e81 100644 --- a/volatility3/framework/plugins/windows/registry/hashdump.py +++ b/volatility3/framework/plugins/windows/registry/hashdump.py @@ -355,7 +355,7 @@ class Hashdump(interfaces.plugins.PluginInterface): @classmethod def get_bootkey(cls, syshive: registry_layer.RegistryHive) -> Optional[bytes]: """ - Returns the scrambled bootkey necesary to decrypt hashes + Returns the scrambled bootkey necessary to decrypt hashes """ cs = 1 lsa_base = f"ControlSet{cs:03}" + "\\Control\\Lsa" diff --git a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py index a2789e5df..2c660229b 100644 --- a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py @@ -602,7 +602,7 @@ def decode_sid(data: bytes) -> Optional[str]: Decodes a windows SID from variable-length raw bytes Returns the string representation of the SID if decoding was successful, or None - if the data could not be parsed due to an insufficent number of bytes. + if the data could not be parsed due to an insufficient number of bytes. """ try: revision, subid_count, id_authority = struct.unpack( @@ -817,7 +817,7 @@ class TaskTrigger: _ = reader.read_u4() # timeout seconds repetition_interval_secs = reader.read_u4() - _ = reader.read_u4() # reptition duration seconds + _ = reader.read_u4() # repetition duration seconds _ = reader.read_u4() # repetition duration seconds 2 _ = reader.read_bool() # stop at duration end diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 5c0af7766..7a03ebbb6 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -236,7 +236,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf 2) Iterate over every 4/8 bytes (depending on OS bitness) in the .data section and test for the following: a) offset represents a valid RTL_AVL_TABLE object - b) RTL_AVL_TABLE is preceeded by an ERESOURCE object + b) RTL_AVL_TABLE is preceded by an ERESOURCE object c) RTL_AVL_TABLE is followed by the beginning of the SHIM LRU list :param context: The context to retrieve required elements (layers, symbol tables) from diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index eabc637c8..3da8cb21a 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -129,7 +129,7 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): ): yield ( vad_path, - "VAD at base address ({vad_base:#x}) hosting this thread maps an application executable that is not the process exectuable", + "VAD at base address ({vad_base:#x}) hosting this thread maps an application executable that is not the process executable", ) def _enumerate_processes( diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 5ead4e453..068838e35 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -86,7 +86,7 @@ class VadRegExScan(plugins.PluginInterface): ): result_data = proc_layer.read(offset, self.MAXSIZE_DEFAULT, pad=True) - # reapply the regex in order to extact just the match + # reapply the regex in order to extract just the match regex_result = re.match(regex_pattern, result_data) if regex_result: diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index 4f1de586a..8732e6e88 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -93,7 +93,7 @@ class Disassembly(interfaces.renderers.BasicType): class LayerData(interfaces.renderers.BasicType): """Layer data - This requires the contex to be passed in, in case plugins want to use multiple contexts + This requires the context to be passed in, in case plugins want to use multiple contexts and to ensure the TreeGrid interface doesn't change, since this would break all existing plugins """ diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 327c6dd37..ac27b7e42 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -515,7 +515,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): vmlinux: interfaces.context.ModuleInterface, ) -> Optional[interfaces.objects.ObjectInterface]: """Cast a member of a structure out to the containing structure. - It mimicks the Linux kernel macro container_of() see include/linux.kernel.h + It mimics the Linux kernel macro container_of() see include/linux.kernel.h Args: addr: The pointer to the member. diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index c980ee6b1..3b9a73e7c 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -984,9 +984,9 @@ class maple_tree(objects.StructType): current_depth + 1, ) else: - # unkown maple node type + # unknown maple node type raise AttributeError( - f"Unkown Maple Tree node type {node_type} at offset {hex(pointer)}." + f"Unknown Maple Tree node type {node_type} at offset {hex(pointer)}." ) @@ -2295,7 +2295,7 @@ class kernel_cap_t(kernel_cap_struct): class Timespec64Abstract(abc.ABC): - """Abstract class to handle all required timespec64 operations, convertions and + """Abstract class to handle all required timespec64 operations, conversions and adjustments.""" @classmethod @@ -2391,7 +2391,7 @@ class Timespec64Abstract(abc.ABC): class Timespec64Concrete(Timespec64Abstract): - """Handle all required timespec64 operations, convertions and adjustments. + """Handle all required timespec64 operations, conversions and adjustments. This is used to dynamically create timespec64-like objects, each with its own variables and the same methods as a timespec64 object extension. """ @@ -2402,7 +2402,7 @@ class Timespec64Concrete(Timespec64Abstract): class timespec64(Timespec64Abstract, objects.StructType): - """Handle all required timespec64 operations, convertions and adjustments. + """Handle all required timespec64 operations, conversions and adjustments. This works as an extension of the timespec64 object while maintaining the same methods as a Timespec64Concrete object. """ @@ -2770,7 +2770,7 @@ class IDR(objects.StructType): vmlinux = linux.LinuxUtilities.get_module_from_volobj_type(self._context, self) if not vmlinux.get_type("idr_layer").has_member("layer"): vollog.info( - "Unsupported IDR implementation, it should be a very very old kernel, probabably < 2.6" + "Unsupported IDR implementation, it should be a very very old kernel, probably < 2.6" ) return None diff --git a/volatility3/framework/symbols/linux/extensions/network.py b/volatility3/framework/symbols/linux/extensions/network.py index 30094d1b1..37fa5a41f 100644 --- a/volatility3/framework/symbols/linux/extensions/network.py +++ b/volatility3/framework/symbols/linux/extensions/network.py @@ -65,7 +65,7 @@ class net_device(objects.StructType): hwaddr = parent_layer.read(self.dev_addr, self.addr_len, pad=True) except exceptions.InvalidAddressException: vollog.debug( - f"Unable to read network inteface mac address from {self.dev_addr:#x}" + f"Unable to read network interface mac address from {self.dev_addr:#x}" ) return None @@ -255,10 +255,10 @@ class net_device(objects.StructType): return None def get_queue_length(self) -> int: - """Return the netwrok device transmision qeueue length (qlen) + """Return the network device transmission queue length (qlen) Returns: - int: the netwrok device transmision qeueue length (qlen) + int: the network device transmission queue length (qlen) """ return self.tx_queue_len diff --git a/volatility3/framework/symbols/linux/kallsyms.py b/volatility3/framework/symbols/linux/kallsyms.py index 35aba3ca5..be026fc4e 100644 --- a/volatility3/framework/symbols/linux/kallsyms.py +++ b/volatility3/framework/symbols/linux/kallsyms.py @@ -121,7 +121,7 @@ class _KallsymsIO: self._endian = endian def read(self, size: int) -> bytes: - """Return 'size' bytes from the current postion""" + """Return 'size' bytes from the current position""" layer = self._context.layers[self._layer_name] buf = layer.read(offset=self._position, length=size) self._position += size diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 49ad4d9c0..e55f77668 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -21,7 +21,7 @@ from volatility3.framework.symbols.linux import extensions vollog = logging.getLogger(__name__) -# This module is responsbile for producing an ELF file of a kernel module (LKM) loaded in memory +# This module is responsible for producing an ELF file of a kernel module (LKM) loaded in memory # This extraction task is quite complicated as the Linux kernel discards the ELF header at load time # Due to this, to support static analysis, we must create an ELF header and proper file based on the sections # There are also several other significant complications that we must deal with when trying to extract an LKM @@ -423,7 +423,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): ) if not data: vollog.debug( - f"Coult not construct a symbol table for module at {module.vol.offset}. Cannot recover." + f"Could not construct a symbol table for module at {module.vol.offset}. Cannot recover." ) return None, None, None @@ -469,7 +469,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): e_shentsize_int = 64 header_size = 64 - e_type = struct.pack(" ModuleGathererInterface.gatherer_return_type: """ Returns a ModuleInfo instance that encodes the kernel - This is required to map function pointers to the kerenl executable + This is required to map function pointers to the kernel executable """ kernel = context.modules[kernel_module_name] diff --git a/volatility3/framework/symbols/windows/extensions/consoles.py b/volatility3/framework/symbols/windows/extensions/consoles.py index 9666fd79c..b16855b9c 100644 --- a/volatility3/framework/symbols/windows/extensions/consoles.py +++ b/volatility3/framework/symbols/windows/extensions/consoles.py @@ -168,7 +168,7 @@ class SCREEN_INFORMATION(objects.StructType): @param truncate: True if the empty rows at the end (i.e. bottom) of the screen buffer should be - supressed. + suppressed. """ rows = [] diff --git a/volatility3/framework/symbols/windows/extensions/gui.py b/volatility3/framework/symbols/windows/extensions/gui.py index d1835631f..0d39f8173 100644 --- a/volatility3/framework/symbols/windows/extensions/gui.py +++ b/volatility3/framework/symbols/windows/extensions/gui.py @@ -146,7 +146,7 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): self, window, max_windows ) -> Generator[Tuple[interfaces.objects.ObjectInterface, str], None, None]: """ - Recusively walks and yields the adjacent and child windows + Recursively walks and yields the adjacent and child windows """ seen_windows = set() seen_children = set() From 40a3d23e2db14363efe219d7633e4f4de808503a Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 26 May 2025 10:19:28 +0100 Subject: [PATCH 1121/1352] Infra: Update checkout actions --- .github/workflows/build-pyinstaller.yml | 2 +- .github/workflows/codeql.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-pyinstaller.yml b/.github/workflows/build-pyinstaller.yml index b1d15eb10..7d9d86fb0 100644 --- a/.github/workflows/build-pyinstaller.yml +++ b/.github/workflows/build-pyinstaller.yml @@ -18,7 +18,7 @@ jobs: matrix: python-version: ["3.11"] steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - name: Set up Python ${{ matrix.python-version }} uses: actions/setup-python@v4 with: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 324390e43..c79f1c086 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@v4 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL From 83cfc84f36fcb848ebe951404d4bfa7ebde510c5 Mon Sep 17 00:00:00 2001 From: eve Date: Wed, 28 May 2025 20:05:03 +0100 Subject: [PATCH 1122/1352] Add a deprecation warning for PluginRequirement --- volatility3/framework/configuration/requirements.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 3e3608000..166c02fe5 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -14,7 +14,7 @@ import os from typing import Any, ClassVar, Dict, List, Optional, Set, Tuple, Type from urllib import parse, request -from volatility3.framework import constants, interfaces +from volatility3.framework import constants, interfaces, deprecation vollog = logging.getLogger(__name__) @@ -600,6 +600,11 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): return True +@deprecation.renamed_class( + deprecated_class_name="PluginRequirement", + removal_date="2026-06-01", + message="PluginRequirement is to be deprecated. Use VersionRequirement instead.", +) class PluginRequirement(VersionRequirement): def __init__( self, From 0be4d809c12fbe742b34c7f651182b6c535fc598 Mon Sep 17 00:00:00 2001 From: eve Date: Wed, 28 May 2025 21:16:04 +0100 Subject: [PATCH 1123/1352] Linux: update PerfEvents plugin to use VersionRequirement for pslist --- volatility3/framework/plugins/linux/tracing/perf_events.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/tracing/perf_events.py b/volatility3/framework/plugins/linux/tracing/perf_events.py index 3e0a40579..23b2f2c72 100644 --- a/volatility3/framework/plugins/linux/tracing/perf_events.py +++ b/volatility3/framework/plugins/linux/tracing/perf_events.py @@ -18,7 +18,7 @@ class PerfEvents(plugins.PluginInterface): """Lists performance events for each process.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -28,8 +28,8 @@ class PerfEvents(plugins.PluginInterface): description="Linux kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="pslist", plugin=pslist.PsList, version=(4, 0, 0) + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) ), ] From bb4cee7071fb071b8ee9a06ed1b2cd4d78af2b51 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Thu, 29 May 2025 06:47:03 +0100 Subject: [PATCH 1124/1352] Tweak comments Also remove zeroes starting a slice. --- .../framework/plugins/windows/malfind.py | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index d9861d9c8..4727d5ff0 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -61,7 +61,7 @@ class Malfind(interfaces.plugins.PluginInterface): vad: the MMVAD structure to test Returns: - A boolean indicating whether a vad is empty or not + A boolean indicating whether a VAD is empty or not """ CHUNK_SIZE = 0x1000 @@ -112,13 +112,13 @@ class Malfind(interfaces.plugins.PluginInterface): code. Args: - context: The context to retrieve required elements (layers, symbol tables) from + context: The context to retrieve required elements (layers, symbol tables) kernel_layer_name: The name of the kernel layer from which to read the VAD protections symbol_table: The name of the table containing the kernel symbols proc: an _EPROCESS instance Returns: - An iterable of VAD instances and the first 64 bytes of data containing in that region + An iterable of VAD instances and the first 64 bytes of data contained in that region """ proc_id = "Unknown" try: @@ -144,7 +144,7 @@ class Malfind(interfaces.plugins.PluginInterface): if not write_exec: """ # Inspect "PAGE_EXECUTE_READ" VAD pages to detect - # non writable memory regions having been injected + # non-writable memory regions having been injected # using elevated WriteProcessMemory(). """ if "EXECUTE" in protection_string: @@ -152,7 +152,7 @@ class Malfind(interfaces.plugins.PluginInterface): vad.get_start(), vad.get_end(), proc_layer.page_size ): try: - # If we have a dirty page in a non writable "EXECUTE" region, it is suspicious. + # If we have a dirty page in a non-writable "EXECUTE" region, it is suspicious. if proc_layer.is_dirty(page): dirty_page = page break @@ -188,10 +188,10 @@ class Malfind(interfaces.plugins.PluginInterface): yield (vad, data) def _generator(self, procs): - # determine if we're on a 32 or 64 bit kernel + # Determine if we're on a 32 or 64 bit kernel kernel = self.context.modules[self.config["kernel"]] - # set refined criteria to know when to add to "Notes" column + # Set refined criteria to know when to add to "Notes" column refined_criteria = { b"MZ": "MZ header", b"\x55\x8b": "PE header", @@ -204,7 +204,7 @@ class Malfind(interfaces.plugins.PluginInterface): ) for proc in procs: - # by default, "Notes" column will be set to N/A + # By default, "Notes" column will be set to N/A process_name = utility.array_to_string(proc.ImageFileName) for vad, data_object in self.list_injection_sites( @@ -215,10 +215,10 @@ class Malfind(interfaces.plugins.PluginInterface): data = data_object.context.layers[data_object.layer_name].read( data_object.offset, data_object.length, True ) - if data[0:2] in refined_criteria: - notes = refined_criteria[data[0:2]] + if data[:2] in refined_criteria: + notes = refined_criteria[data[:2]] - # if we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64 + # If we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64 if is_32bit_arch or proc.get_is_wow64(): architecture = "intel" else: From a4bc02e41f49de526a793d198d325ac5c0b944cf Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 29 May 2025 07:26:53 +0100 Subject: [PATCH 1125/1352] Move version checking logic into versionutils module --- volatility3/framework/__init__.py | 20 ++++++---------- .../framework/configuration/requirements.py | 10 +++----- volatility3/framework/deprecation.py | 5 ++-- volatility3/framework/versionutils.py | 23 +++++++++++++++++++ 4 files changed, 35 insertions(+), 23 deletions(-) create mode 100644 volatility3/framework/versionutils.py diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index c384542a8..1c899f434 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -13,7 +13,7 @@ import os import traceback from typing import Any, Dict, Generator, List, Optional, Tuple, Type, TypeVar -from volatility3.framework import constants, interfaces +from volatility3.framework import constants, interfaces, versionutils if ( sys.version_info.major != constants.REQUIRED_PYTHON_VERSION[0] @@ -48,19 +48,13 @@ vollog = logging.getLogger(__name__) def require_interface_version(*args) -> None: """Checks the required version of a plugin.""" - if len(args): - if args[0] != interface_version()[0]: - raise RuntimeError( - f"Framework interface version {interface_version()[0]} is incompatible with required version {args[0]}" + if not versionutils.matches_required(args, interface_version()): + raise RuntimeError( + "Framework interface version {} is incompatible with required version {}".format( + ".".join(str(x) for x in interface_version()[0:2]), + ".".join(str(x) for x in args[0:2]), ) - if len(args) > 1: - if args[1] > interface_version()[1]: - raise RuntimeError( - "Framework interface version {} is an older revision than the required version {}".format( - ".".join(str(x) for x in interface_version()[0:2]), - ".".join(str(x) for x in args[0:2]), - ) - ) + ) class NonInheritable: diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 166c02fe5..b7971d727 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -14,7 +14,7 @@ import os from typing import Any, ClassVar, Dict, List, Optional, Set, Tuple, Type from urllib import parse, request -from volatility3.framework import constants, interfaces, deprecation +from volatility3.framework import constants, interfaces, deprecation, versionutils vollog = logging.getLogger(__name__) @@ -551,7 +551,7 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): ) -> Dict[str, interfaces.configuration.RequirementInterface]: # Mypy doesn't appreciate our classproperty implementation, self._plugin.version has no type config_path = interfaces.configuration.path_join(config_path, self.name) - if not self.matches_required(self._version, self._component.version): + if not versionutils.matches_required(self._version, self._component.version): return {config_path: self} recurse = True @@ -593,11 +593,7 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): def matches_required( cls, required: Tuple[int, ...], version: Tuple[int, int, int] ) -> bool: - if len(required) > 0 and version[0] != required[0]: - return False - if len(required) > 1 and version[1] < required[1]: - return False - return True + versionutils.matches_required(required, version) @deprecation.renamed_class( diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index 859a32bad..667ea72a5 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -10,8 +10,7 @@ import inspect from typing import Callable, Tuple -from volatility3.framework import interfaces, exceptions -from volatility3.framework.configuration import requirements +from volatility3.framework import interfaces, exceptions, versionutils def method_being_removed(message: str, removal_date: str): @@ -70,7 +69,7 @@ def deprecated_method( interfaces.configuration.VersionableInterface, ): # SemVer check - if not requirements.VersionRequirement.matches_required( + if not versionutils.matches_required( replacement_version, replacement_base_class.version ): raise exceptions.VersionMismatchException( diff --git a/volatility3/framework/versionutils.py b/volatility3/framework/versionutils.py new file mode 100644 index 000000000..334410ff8 --- /dev/null +++ b/volatility3/framework/versionutils.py @@ -0,0 +1,23 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +from typing import Tuple + + +def matches_required(required: Tuple[int, ...], version: Tuple[int, int, int]) -> bool: + """ + Checks if a version tuple satisfies the required version major and minor constraints. + + Parameters: + required (Tuple[int, ...]): A tuple containing required major and optionally minor version numbers. + version (Tuple[int, int, int]): A tuple containing the full version (major, minor, patch). + + Returns: + bool: True if the version matches the required constraints, False otherwise. + """ + if len(required) > 0 and version[0] != required[0]: + return False + if len(required) > 1 and version[1] < required[1]: + return False + return True From 1206b69abd362c750e4b7ab471950d5fe43726fe Mon Sep 17 00:00:00 2001 From: ikelos Date: Thu, 29 May 2025 09:45:26 +0100 Subject: [PATCH 1126/1352] Update volatility3/framework/plugins/windows/malfind.py --- volatility3/framework/plugins/windows/malfind.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 4727d5ff0..33eaf64ef 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -112,7 +112,7 @@ class Malfind(interfaces.plugins.PluginInterface): code. Args: - context: The context to retrieve required elements (layers, symbol tables) + context: The context from which to retrieve required elements (layers, symbol tables) kernel_layer_name: The name of the kernel layer from which to read the VAD protections symbol_table: The name of the table containing the kernel symbols proc: an _EPROCESS instance From 3ce515bc017b2bd19c1ac2dd7ab9f2d94d44c6e8 Mon Sep 17 00:00:00 2001 From: eve Date: Thu, 29 May 2025 16:53:35 +0100 Subject: [PATCH 1127/1352] Add return for matches_required in VersionRequirement --- volatility3/framework/configuration/requirements.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index b7971d727..6d978e2a9 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -593,7 +593,7 @@ class VersionRequirement(interfaces.configuration.RequirementInterface): def matches_required( cls, required: Tuple[int, ...], version: Tuple[int, int, int] ) -> bool: - versionutils.matches_required(required, version) + return versionutils.matches_required(required, version) @deprecation.renamed_class( From 306b7ff42bde54830be3e1c34880d981b9c35743 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Fri, 6 Jun 2025 23:55:12 +0300 Subject: [PATCH 1128/1352] use maxsize argument --- volatility3/framework/plugins/regexscan.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index 7df89f841..c5ec97fd6 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -49,24 +49,24 @@ class RegExScan(plugins.PluginInterface): def _generator(self, regex_pattern): regex_pattern = bytes(regex_pattern, "UTF-8") vollog.debug(f"RegEx Pattern: {regex_pattern}") - + maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT) layer = self.context.layers[self.config["primary"]] for offset in layer.scan( context=self.context, scanner=scanners.RegExScanner(regex_pattern) ): - result_data = layer.read(offset, self.MAXSIZE_DEFAULT, pad=True) + result_data = layer.read(offset, maxsize, pad=True) # reapply the regex in order to extract just the match regex_result = re.match(regex_pattern, result_data) if regex_result: - # the match is within the results_data (e.g. it fits within MAXSIZE_DEFAULT) + # the match is within the results_data (e.g. it fits within maxsize) # extract just the match itself regex_match = regex_result.group(0) text_result = str(regex_match, encoding="UTF-8", errors="replace") bytes_result = regex_match else: - # the match is not with the results_data (e.g. it doesn't fit within MAXSIZE_DEFAULT) + # the match is not with the results_data (e.g. it doesn't fit within maxsize) text_result = str(result_data, encoding="UTF-8", errors="replace") bytes_result = result_data From f01310c238d7b7d4f47814d4c482454f7b928dd0 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 11:39:56 +0300 Subject: [PATCH 1129/1352] use search instead of match --- volatility3/framework/plugins/regexscan.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index c5ec97fd6..4df00a583 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -48,6 +48,7 @@ class RegExScan(plugins.PluginInterface): def _generator(self, regex_pattern): regex_pattern = bytes(regex_pattern, "UTF-8") + compiled_pattern = re.compile(regex_pattern) vollog.debug(f"RegEx Pattern: {regex_pattern}") maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT) layer = self.context.layers[self.config["primary"]] @@ -57,7 +58,7 @@ class RegExScan(plugins.PluginInterface): result_data = layer.read(offset, maxsize, pad=True) # reapply the regex in order to extract just the match - regex_result = re.match(regex_pattern, result_data) + regex_result = compiled_pattern.search(result_data) if regex_result: # the match is within the results_data (e.g. it fits within maxsize) From 89247766981b0d4afd40d886e248e9dbbab1c909 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 7 Jun 2025 09:41:19 +0100 Subject: [PATCH 1130/1352] Plugins: Remove deprecated PluginRequirement in favour of VersionRequirement --- volatility3/framework/plugins/mac/timers.py | 4 ++-- volatility3/framework/plugins/windows/timers.py | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/mac/timers.py b/volatility3/framework/plugins/mac/timers.py index 8a267bd55..aef8c5e1c 100644 --- a/volatility3/framework/plugins/mac/timers.py +++ b/volatility3/framework/plugins/mac/timers.py @@ -31,8 +31,8 @@ class Timers(plugins.PluginInterface): requirements.VersionRequirement( name="macutils", component=mac.MacUtilities, version=(1, 3, 0) ), - requirements.PluginRequirement( - name="lsmod", plugin=lsmod.Lsmod, version=(2, 0, 0) + requirements.VersionRequirement( + name="lsmod", component=lsmod.Lsmod, version=(2, 0, 0) ), ] diff --git a/volatility3/framework/plugins/windows/timers.py b/volatility3/framework/plugins/windows/timers.py index f530a4c7b..c7364d5a5 100644 --- a/volatility3/framework/plugins/windows/timers.py +++ b/volatility3/framework/plugins/windows/timers.py @@ -35,11 +35,11 @@ class Timers(interfaces.plugins.PluginInterface): description="Windows kernel", architectures=["Intel32", "Intel64"], ), - requirements.PluginRequirement( - name="ssdt", plugin=ssdt.SSDT, version=(2, 0, 0) + requirements.VersionRequirement( + name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) ), - requirements.PluginRequirement( - name="kpcrs", plugin=kpcrs.KPCRs, version=(2, 0, 0) + requirements.VersionRequirement( + name="kpcrs", component=kpcrs.KPCRs, version=(2, 0, 0) ), ] From eba4e4b50c8842e286410bcd62a0930b0c9b9602 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 11:50:07 +0300 Subject: [PATCH 1131/1352] generator overhead --- volatility3/framework/plugins/regexscan.py | 38 ++++++++++++++++++---- 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index 4df00a583..e95986899 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -46,14 +46,12 @@ class RegExScan(plugins.PluginInterface): ), ] - def _generator(self, regex_pattern): - regex_pattern = bytes(regex_pattern, "UTF-8") - compiled_pattern = re.compile(regex_pattern) - vollog.debug(f"RegEx Pattern: {regex_pattern}") - maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT) + def _generator(self, compiled_pattern, raw_pattern, maxsize): + vollog.debug(f"RegEx Pattern: {raw_pattern}") layer = self.context.layers[self.config["primary"]] + for offset in layer.scan( - context=self.context, scanner=scanners.RegExScanner(regex_pattern) + context=self.context, scanner=scanners.RegExScanner(raw_pattern) ): result_data = layer.read(offset, maxsize, pad=True) @@ -74,11 +72,37 @@ class RegExScan(plugins.PluginInterface): yield 0, (format_hints.Hex(offset), text_result, bytes_result) def run(self): + pattern = self.config.get("pattern") + + # Handle pattern encoding robustly + if isinstance(pattern, str): + try: + raw_pattern = pattern.encode("utf-8") + except UnicodeEncodeError: + raw_pattern = pattern.encode("latin1", errors="replace") + else: + raw_pattern = pattern + + try: + compiled_pattern = re.compile(raw_pattern) + except re.error as e: + vollog.error(f"Invalid regex pattern: {e}") + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Text", str), + ("Hex", bytes), + ], + [], + ) + + maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT) + return renderers.TreeGrid( [ ("Offset", format_hints.Hex), ("Text", str), ("Hex", bytes), ], - self._generator(self.config.get("pattern")), + self._generator(compiled_pattern, raw_pattern, maxsize), ) From 0d7f985ef67cddd57b135bd1454d8f6e0597ab0d Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 7 Jun 2025 10:16:22 +0100 Subject: [PATCH 1132/1352] Plugins: Add in __init__ files to create submodules for OS plugins --- volatility3/framework/plugins/linux/graphics/__init__.py | 0 volatility3/framework/plugins/linux/malware/__init__.py | 8 ++++++++ volatility3/framework/plugins/windows/malware/__init__.py | 8 ++++++++ 3 files changed, 16 insertions(+) create mode 100644 volatility3/framework/plugins/linux/graphics/__init__.py create mode 100644 volatility3/framework/plugins/linux/malware/__init__.py create mode 100644 volatility3/framework/plugins/windows/malware/__init__.py diff --git a/volatility3/framework/plugins/linux/graphics/__init__.py b/volatility3/framework/plugins/linux/graphics/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/volatility3/framework/plugins/linux/malware/__init__.py b/volatility3/framework/plugins/linux/malware/__init__.py new file mode 100644 index 000000000..89458befc --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/__init__.py @@ -0,0 +1,8 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +"""All core linux malware plugins. + +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins +""" diff --git a/volatility3/framework/plugins/windows/malware/__init__.py b/volatility3/framework/plugins/windows/malware/__init__.py new file mode 100644 index 000000000..2e2fec739 --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/__init__.py @@ -0,0 +1,8 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +"""All core windows malware plugins. + +These modules should only be imported from volatility3.plugins NOT +volatility3.framework.plugins +""" From fb76bf6b6c6583c0197868780df55190e3158ebf Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 7 Jun 2025 10:20:59 +0100 Subject: [PATCH 1133/1352] Linux: Minor linting fixes to fbdev plugin --- .../framework/plugins/linux/graphics/fbdev.py | 25 ++++++++----------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index f7cde1bf0..1f9fd74b5 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -6,14 +6,9 @@ import io from dataclasses import dataclass from typing import Type, List, Dict, Tuple -from volatility3.framework import constants, exceptions, interfaces +from volatility3.framework import constants, exceptions, interfaces, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import ( - format_hints, - TreeGrid, - NotAvailableValue, - UnreadableValue, -) +from volatility3.framework.renderers import format_hints from volatility3.framework.objects import utility from volatility3.framework.constants import architectures from volatility3.framework.symbols import linux @@ -181,7 +176,7 @@ class Fbdev(interfaces.plugins.PluginInterface): """ kernel = context.modules[kernel_name] kernel_layer = context.layers[kernel.layer_name] - id = "N-A" if isinstance(fb.id, NotAvailableValue) else fb.id + id = "N-A" if isinstance(fb.id, renderers.NotAvailableValue) else fb.id base_filename = f"{id}_{fb.xres_virtual}x{fb.yres_virtual}_{fb.bpp}bpp" if convert_to_png_image: image_object = cls.convert_fb_raw_buffer_to_image(context, kernel_name, fb) @@ -193,9 +188,9 @@ class Fbdev(interfaces.plugins.PluginInterface): final_fb_buffer = kernel_layer.read(fb.fb_info.screen_base, fb.size) filename = f"{base_filename}.raw" - with open_method(filename) as f: - f.write(final_fb_buffer) - return f.preferred_filename + with open_method(filename) as fp: + fp.write(final_fb_buffer) + return fp.preferred_filename @classmethod def parse_fb_info( @@ -216,7 +211,7 @@ class Fbdev(interfaces.plugins.PluginInterface): - struct fb_var_screeninfo stores device independent changeable information about a frame buffer device, its current format and video mode, as well as other miscellaneous parameters. """ - id = utility.array_to_string(fb_info.fix.id) or NotAvailableValue() + id = utility.array_to_string(fb_info.fix.id) or renderers.NotAvailableValue() color_fields = None # 0 = color, 1 = grayscale, >1 = FOURCC @@ -299,14 +294,14 @@ You can try using ffmpeg to decode the raw buffer. Example usage: vollog.error( f'Layer {excp.layer_name} failed to read address {hex(excp.invalid_address)} when dumping framebuffer "{fb.id}".' ) - file_output = UnreadableValue() + file_output = renderers.UnreadableValue() try: fb_device_name = utility.pointer_to_string( fb.fb_info.dev.kobj.name, 256 ) except exceptions.InvalidAddressException: - fb_device_name = NotAvailableValue() + fb_device_name = renderers.NotAvailableValue() yield ( 0, @@ -334,7 +329,7 @@ You can try using ffmpeg to decode the raw buffer. Example usage: ("Filename", str), ] - return TreeGrid( + return renderers.TreeGrid( columns, self._generator(), ) From fd1e5510bb5a6e8d3f40b6037fe7bd27a8d2d369 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 12:27:27 +0300 Subject: [PATCH 1134/1352] categorize malfind as malware plugin --- .../framework/plugins/windows/malfind.py | 293 +----------------- .../plugins/windows/malware/malfind.py | 293 ++++++++++++++++++ 2 files changed, 303 insertions(+), 283 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/malfind.py diff --git a/volatility3/framework/plugins/windows/malfind.py b/volatility3/framework/plugins/windows/malfind.py index 33eaf64ef..a98ab5ec0 100644 --- a/volatility3/framework/plugins/windows/malfind.py +++ b/volatility3/framework/plugins/windows/malfind.py @@ -1,293 +1,20 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import Iterable, Generator, Tuple - -from volatility3.framework import interfaces, symbols, exceptions -from volatility3.framework import renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.objects import utility -from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import pslist, vadinfo +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import malfind vollog = logging.getLogger(__name__) -class Malfind(interfaces.plugins.PluginInterface): - """Lists process memory ranges that potentially contain injected code.""" +class Malfind( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=malfind.Malfind, + removal_date="2026-06-07", +): + """Lists process memory ranges that potentially contain injected code (deprecated).""" _required_framework_version = (2, 22, 0) _version = (1, 1, 0) - - @classmethod - def get_requirements(cls): - # Since we're calling the plugin, make sure we have the plugin's requirements - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.ListRequirement( - name="pid", - element_type=int, - description="Process IDs to include (all other processes are excluded)", - optional=True, - ), - requirements.BooleanRequirement( - name="dump", - description="Extract injected VADs", - default=False, - optional=True, - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) - ), - ] - - @classmethod - def is_vad_empty(cls, proc_layer, vad): - """Check if a VAD region is either entirely unavailable due to paging, - entirely consisting of zeros, or a combination of the two. This helps - ignore false positives whose VAD flags match task._injection_filter - requirements but there's no data and thus not worth reporting it. - - Args: - proc_layer: the process layer - vad: the MMVAD structure to test - - Returns: - A boolean indicating whether a VAD is empty or not - """ - - CHUNK_SIZE = 0x1000 - all_zero_page = b"\x00" * CHUNK_SIZE - - offset = 0 - vad_length = vad.get_size() - - while offset < vad_length: - next_addr = vad.get_start() + offset - if ( - proc_layer.is_valid(next_addr, CHUNK_SIZE) - and proc_layer.read(next_addr, CHUNK_SIZE) != all_zero_page - ): - return False - offset += CHUNK_SIZE - - return True - - @classmethod - def list_injections( - cls, - context: interfaces.context.ContextInterface, - kernel_layer_name: str, - symbol_table: str, - proc: interfaces.objects.ObjectInterface, - ) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]: - for vad, data_object in cls.list_injection_sites( - context, kernel_layer_name, symbol_table, proc - ): - yield vad, data_object.context.layers[data_object.layer_name].read( - data_object.offset, data_object.length - ) - - @classmethod - def list_injection_sites( - cls, - context: interfaces.context.ContextInterface, - kernel_layer_name: str, - symbol_table: str, - proc: interfaces.objects.ObjectInterface, - ) -> Generator[ - Tuple[interfaces.objects.ObjectInterface, renderers.LayerData], - None, - None, - ]: - """Generate memory regions for a process that may contain injected - code. - - Args: - context: The context from which to retrieve required elements (layers, symbol tables) - kernel_layer_name: The name of the kernel layer from which to read the VAD protections - symbol_table: The name of the table containing the kernel symbols - proc: an _EPROCESS instance - - Returns: - An iterable of VAD instances and the first 64 bytes of data contained in that region - """ - proc_id = "Unknown" - try: - proc_id = proc.UniqueProcessId - proc_layer_name = proc.add_process_layer() - except exceptions.InvalidAddressException as excp: - vollog.debug( - f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" - ) - return None - - proc_layer = context.layers[proc_layer_name] - - for vad in proc.get_vad_root().traverse(): - protection_string = vad.get_protection( - vadinfo.VadInfo.protect_values( - context, kernel_layer_name, symbol_table - ), - vadinfo.winnt_protections, - ) - write_exec = "EXECUTE" in protection_string and "WRITE" in protection_string - dirty_page = None - if not write_exec: - """ - # Inspect "PAGE_EXECUTE_READ" VAD pages to detect - # non-writable memory regions having been injected - # using elevated WriteProcessMemory(). - """ - if "EXECUTE" in protection_string: - for page in range( - vad.get_start(), vad.get_end(), proc_layer.page_size - ): - try: - # If we have a dirty page in a non-writable "EXECUTE" region, it is suspicious. - if proc_layer.is_dirty(page): - dirty_page = page - break - except exceptions.InvalidAddressException: - # Abort as it is likely that other addresses in the same range will also fail. - break - if dirty_page is None: - continue - else: - continue - - if (vad.get_private_memory() == 1 and vad.get_tag() == "VadS") or ( - vad.get_private_memory() == 0 - and protection_string != "PAGE_EXECUTE_WRITECOPY" - ): - if cls.is_vad_empty(proc_layer, vad): - continue - - if dirty_page is not None: - # Useful information to investigate the page content with volshell afterwards. - vollog.warning( - f"[proc_id {proc_id}] Found suspicious DIRTY + {protection_string} page at {hex(dirty_page)}", - ) - start = vad.get_start() - length = 64 - data = renderers.LayerData( - context=context, - layer_name=proc_layer_name, - offset=start, - length=length, - no_surrounding=True, - ) - yield (vad, data) - - def _generator(self, procs): - # Determine if we're on a 32 or 64 bit kernel - kernel = self.context.modules[self.config["kernel"]] - - # Set refined criteria to know when to add to "Notes" column - refined_criteria = { - b"MZ": "MZ header", - b"\x55\x8b": "PE header", - b"\x55\x48": "Function prologue", - b"\x55\x89": "Function prologue", - } - - is_32bit_arch = not symbols.symbol_table_is_64bit( - context=self.context, symbol_table_name=kernel.symbol_table_name - ) - - for proc in procs: - # By default, "Notes" column will be set to N/A - process_name = utility.array_to_string(proc.ImageFileName) - - for vad, data_object in self.list_injection_sites( - self.context, kernel.layer_name, kernel.symbol_table_name, proc - ): - notes = renderers.NotApplicableValue() - # Check for unique headers and update "Notes" column if criteria is met - data = data_object.context.layers[data_object.layer_name].read( - data_object.offset, data_object.length, True - ) - if data[:2] in refined_criteria: - notes = refined_criteria[data[:2]] - - # If we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64 - if is_32bit_arch or proc.get_is_wow64(): - architecture = "intel" - else: - architecture = "intel64" - - disasm = renderers.Disassembly(data, vad.get_start(), architecture) - - file_output = "Disabled" - if self.config["dump"]: - file_output = "Error outputting to file" - try: - file_handle = vadinfo.VadInfo.vad_dump( - self.context, proc, vad, self.open - ) - file_handle.close() - file_output = file_handle.preferred_filename - except (exceptions.InvalidAddressException, OverflowError) as excp: - vollog.debug( - f"Unable to dump PE with pid {proc.UniqueProcessId}.{vad.get_start():#x}: {excp}" - ) - - yield ( - 0, - ( - proc.UniqueProcessId, - process_name, - format_hints.Hex(vad.get_start()), - format_hints.Hex(vad.get_end()), - vad.get_tag(), - vad.get_protection( - vadinfo.VadInfo.protect_values( - self.context, - kernel.layer_name, - kernel.symbol_table_name, - ), - vadinfo.winnt_protections, - ), - vad.get_commit_charge(), - vad.get_private_memory(), - file_output, - notes, - data_object, - disasm, - ), - ) - - def run(self): - filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - - return renderers.TreeGrid( - [ - ("PID", int), - ("Process", str), - ("Start VPN", format_hints.Hex), - ("End VPN", format_hints.Hex), - ("Tag", str), - ("Protection", str), - ("CommitCharge", int), - ("PrivateMemory", int), - ("File output", str), - ("Notes", str), - ("Hexdump", renderers.LayerData), - ("Disasm", renderers.Disassembly), - ], - self._generator( - pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config["kernel"], - filter_func=filter_func, - ) - ), - ) diff --git a/volatility3/framework/plugins/windows/malware/malfind.py b/volatility3/framework/plugins/windows/malware/malfind.py new file mode 100644 index 000000000..33eaf64ef --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/malfind.py @@ -0,0 +1,293 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import Iterable, Generator, Tuple + +from volatility3.framework import interfaces, symbols, exceptions +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist, vadinfo + +vollog = logging.getLogger(__name__) + + +class Malfind(interfaces.plugins.PluginInterface): + """Lists process memory ranges that potentially contain injected code.""" + + _required_framework_version = (2, 22, 0) + _version = (1, 1, 0) + + @classmethod + def get_requirements(cls): + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.ListRequirement( + name="pid", + element_type=int, + description="Process IDs to include (all other processes are excluded)", + optional=True, + ), + requirements.BooleanRequirement( + name="dump", + description="Extract injected VADs", + default=False, + optional=True, + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) + ), + ] + + @classmethod + def is_vad_empty(cls, proc_layer, vad): + """Check if a VAD region is either entirely unavailable due to paging, + entirely consisting of zeros, or a combination of the two. This helps + ignore false positives whose VAD flags match task._injection_filter + requirements but there's no data and thus not worth reporting it. + + Args: + proc_layer: the process layer + vad: the MMVAD structure to test + + Returns: + A boolean indicating whether a VAD is empty or not + """ + + CHUNK_SIZE = 0x1000 + all_zero_page = b"\x00" * CHUNK_SIZE + + offset = 0 + vad_length = vad.get_size() + + while offset < vad_length: + next_addr = vad.get_start() + offset + if ( + proc_layer.is_valid(next_addr, CHUNK_SIZE) + and proc_layer.read(next_addr, CHUNK_SIZE) != all_zero_page + ): + return False + offset += CHUNK_SIZE + + return True + + @classmethod + def list_injections( + cls, + context: interfaces.context.ContextInterface, + kernel_layer_name: str, + symbol_table: str, + proc: interfaces.objects.ObjectInterface, + ) -> Iterable[Tuple[interfaces.objects.ObjectInterface, bytes]]: + for vad, data_object in cls.list_injection_sites( + context, kernel_layer_name, symbol_table, proc + ): + yield vad, data_object.context.layers[data_object.layer_name].read( + data_object.offset, data_object.length + ) + + @classmethod + def list_injection_sites( + cls, + context: interfaces.context.ContextInterface, + kernel_layer_name: str, + symbol_table: str, + proc: interfaces.objects.ObjectInterface, + ) -> Generator[ + Tuple[interfaces.objects.ObjectInterface, renderers.LayerData], + None, + None, + ]: + """Generate memory regions for a process that may contain injected + code. + + Args: + context: The context from which to retrieve required elements (layers, symbol tables) + kernel_layer_name: The name of the kernel layer from which to read the VAD protections + symbol_table: The name of the table containing the kernel symbols + proc: an _EPROCESS instance + + Returns: + An iterable of VAD instances and the first 64 bytes of data contained in that region + """ + proc_id = "Unknown" + try: + proc_id = proc.UniqueProcessId + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException as excp: + vollog.debug( + f"Process {proc_id}: invalid address {excp.invalid_address} in layer {excp.layer_name}" + ) + return None + + proc_layer = context.layers[proc_layer_name] + + for vad in proc.get_vad_root().traverse(): + protection_string = vad.get_protection( + vadinfo.VadInfo.protect_values( + context, kernel_layer_name, symbol_table + ), + vadinfo.winnt_protections, + ) + write_exec = "EXECUTE" in protection_string and "WRITE" in protection_string + dirty_page = None + if not write_exec: + """ + # Inspect "PAGE_EXECUTE_READ" VAD pages to detect + # non-writable memory regions having been injected + # using elevated WriteProcessMemory(). + """ + if "EXECUTE" in protection_string: + for page in range( + vad.get_start(), vad.get_end(), proc_layer.page_size + ): + try: + # If we have a dirty page in a non-writable "EXECUTE" region, it is suspicious. + if proc_layer.is_dirty(page): + dirty_page = page + break + except exceptions.InvalidAddressException: + # Abort as it is likely that other addresses in the same range will also fail. + break + if dirty_page is None: + continue + else: + continue + + if (vad.get_private_memory() == 1 and vad.get_tag() == "VadS") or ( + vad.get_private_memory() == 0 + and protection_string != "PAGE_EXECUTE_WRITECOPY" + ): + if cls.is_vad_empty(proc_layer, vad): + continue + + if dirty_page is not None: + # Useful information to investigate the page content with volshell afterwards. + vollog.warning( + f"[proc_id {proc_id}] Found suspicious DIRTY + {protection_string} page at {hex(dirty_page)}", + ) + start = vad.get_start() + length = 64 + data = renderers.LayerData( + context=context, + layer_name=proc_layer_name, + offset=start, + length=length, + no_surrounding=True, + ) + yield (vad, data) + + def _generator(self, procs): + # Determine if we're on a 32 or 64 bit kernel + kernel = self.context.modules[self.config["kernel"]] + + # Set refined criteria to know when to add to "Notes" column + refined_criteria = { + b"MZ": "MZ header", + b"\x55\x8b": "PE header", + b"\x55\x48": "Function prologue", + b"\x55\x89": "Function prologue", + } + + is_32bit_arch = not symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=kernel.symbol_table_name + ) + + for proc in procs: + # By default, "Notes" column will be set to N/A + process_name = utility.array_to_string(proc.ImageFileName) + + for vad, data_object in self.list_injection_sites( + self.context, kernel.layer_name, kernel.symbol_table_name, proc + ): + notes = renderers.NotApplicableValue() + # Check for unique headers and update "Notes" column if criteria is met + data = data_object.context.layers[data_object.layer_name].read( + data_object.offset, data_object.length, True + ) + if data[:2] in refined_criteria: + notes = refined_criteria[data[:2]] + + # If we're on a 64 bit kernel, we may still need 32 bit disasm due to wow64 + if is_32bit_arch or proc.get_is_wow64(): + architecture = "intel" + else: + architecture = "intel64" + + disasm = renderers.Disassembly(data, vad.get_start(), architecture) + + file_output = "Disabled" + if self.config["dump"]: + file_output = "Error outputting to file" + try: + file_handle = vadinfo.VadInfo.vad_dump( + self.context, proc, vad, self.open + ) + file_handle.close() + file_output = file_handle.preferred_filename + except (exceptions.InvalidAddressException, OverflowError) as excp: + vollog.debug( + f"Unable to dump PE with pid {proc.UniqueProcessId}.{vad.get_start():#x}: {excp}" + ) + + yield ( + 0, + ( + proc.UniqueProcessId, + process_name, + format_hints.Hex(vad.get_start()), + format_hints.Hex(vad.get_end()), + vad.get_tag(), + vad.get_protection( + vadinfo.VadInfo.protect_values( + self.context, + kernel.layer_name, + kernel.symbol_table_name, + ), + vadinfo.winnt_protections, + ), + vad.get_commit_charge(), + vad.get_private_memory(), + file_output, + notes, + data_object, + disasm, + ), + ) + + def run(self): + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Start VPN", format_hints.Hex), + ("End VPN", format_hints.Hex), + ("Tag", str), + ("Protection", str), + ("CommitCharge", int), + ("PrivateMemory", int), + ("File output", str), + ("Notes", str), + ("Hexdump", renderers.LayerData), + ("Disasm", renderers.Disassembly), + ], + self._generator( + pslist.PsList.list_processes( + context=self.context, + kernel_module_name=self.config["kernel"], + filter_func=filter_func, + ) + ), + ) From 1498926decb332f99bf64620a719c26dc3937db2 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 12:58:31 +0300 Subject: [PATCH 1135/1352] categorize windows.hollowprocesses as malware --- .../plugins/windows/hollowprocesses.py | 224 +----------------- .../windows/malware/hollowprocesses.py | 223 +++++++++++++++++ 2 files changed, 234 insertions(+), 213 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/hollowprocesses.py diff --git a/volatility3/framework/plugins/windows/hollowprocesses.py b/volatility3/framework/plugins/windows/hollowprocesses.py index af559bfbc..9949a223c 100644 --- a/volatility3/framework/plugins/windows/hollowprocesses.py +++ b/volatility3/framework/plugins/windows/hollowprocesses.py @@ -1,222 +1,20 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import NamedTuple, Dict, Generator - -from volatility3.framework import interfaces, exceptions, constants -from volatility3.framework import renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.objects import utility -from volatility3.plugins.windows import pslist, vadinfo +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import hollowprocesses vollog = logging.getLogger(__name__) -class VadData(NamedTuple): - protection: str - path: str - - -class DLLData(NamedTuple): - path: str - - -### Useful references on process hollowing -# https://cysinfo.com/detecting-deceptive-hollowing-techniques/ -# https://github.com/m0n0ph1/Process-Hollowing - - -class HollowProcesses(interfaces.plugins.PluginInterface): - """Lists hollowed processes""" +class HollowProcesses( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=hollowprocesses.HollowProcesses, + removal_date="2026-06-07", +): + """Lists hollowed processes (deprecated)""" _required_framework_version = (2, 4, 0) - - @classmethod - def get_requirements(cls): - # Since we're calling the plugin, make sure we have the plugin's requirements - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.ListRequirement( - name="pid", - element_type=int, - description="Process IDs to include (all other processes are excluded)", - optional=True, - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) - ), - ] - - def _get_vads_data( - self, proc: interfaces.objects.ObjectInterface - ) -> Dict[int, VadData]: - """ - Returns a dictionary of: - base address -> (protection string, file name) - For each mapped VAD in the process. This is used - for quick lookups of data and matching the DLL - at the same base address as the VAD - """ - vads = {} - - kernel = self.context.modules[self.config["kernel"]] - - for vad in proc.get_vad_root().traverse(): - protection_string = vad.get_protection( - vadinfo.VadInfo.protect_values( - self.context, kernel.layer_name, kernel.symbol_table_name - ), - vadinfo.winnt_protections, - ) - - fn = vad.get_file_name() - if not fn or not isinstance(fn, str): - fn = "" - - vads[vad.get_start()] = VadData(protection_string, fn) - - return vads - - def _get_dlls_map( - self, proc: interfaces.objects.ObjectInterface - ) -> Dict[int, DLLData]: - """ - Returns a dictionary of: - base address -> path - for each DLL loaded in the process - - This is used to cross compare with - the corresponding VAD and to have a - backup path source in case of smear - in the VAD - """ - dlls = {} - - for entry in proc.load_order_modules(): - try: - base = entry.DllBase - except exceptions.InvalidAddressException: - continue - - try: - FullDllName = entry.FullDllName.get_string() - except exceptions.InvalidAddressException: - FullDllName = renderers.UnreadableValue() - - dlls[base] = DLLData(FullDllName) - - return dlls - - def _get_image_base(self, proc: interfaces.objects.ObjectInterface) -> int: - """ - Uses the PEB to get the image base of the process - """ - kernel = self.context.modules[self.config["kernel"]] - - try: - proc_layer_name = proc.add_process_layer() - peb = self.context.object( - kernel.symbol_table_name + constants.BANG + "_PEB", - layer_name=proc_layer_name, - offset=proc.Peb, - ) - return peb.ImageBaseAddress - except exceptions.InvalidAddressException: - return None - - def _check_load_address(self, proc, _, __) -> Generator[str, None, None]: - """ - Detects when the image base in the PEB, which is writable by process malware, - does not match the section base address - whose value lives in kernel memory. - Many malware samples will manipulate their image base to fool AVs/EDRs and - as a necessary part of certain hollowing techniques - """ - image_base = self._get_image_base(proc) - if image_base is not None and image_base != proc.SectionBaseAddress: - yield f"The ImageBaseAddress reported from the PEB ({image_base:#x}) does not match the process SectionBaseAddress ({proc.SectionBaseAddress:#x})" - - def _check_exe_protection( - self, proc, vads: Dict[int, VadData], __ - ) -> Generator[str, None, None]: - """ - Legitimately mapped application executables and DLLs - will have a VAD present and its initial protection will be - PAGE_EXECUTE_WRITECOPY. - Many process hollowing and code injection techniques will - unmap the real executable and/or map in executables with - incorrect permissions. - This check verifies the VAD for the application exe. - `_check_dlls_protection` checks for DLLs mapped in the process. - """ - base = proc.SectionBaseAddress - - if base not in vads: - yield f"There is no VAD starting at the base address of the process executable ({base:#x})" - elif vads[base].protection != "PAGE_EXECUTE_WRITECOPY": - yield f"Unexpected protection ({vads[base].protection}) for VAD hosting the process executable ({base:#x}) with path {vads[base].path}" - - def _check_dlls_protection( - self, _, vads: Dict[int, VadData], dlls: Dict[int, DLLData] - ) -> Generator[str, None, None]: - for dll_base in dlls: - # could be malicious but triggers too many FPs from smear - if dll_base not in vads: - continue - - # PAGE_EXECUTE_WRITECOPY is the only valid permission for mapped DLLs and .exe files - if vads[dll_base].protection != "PAGE_EXECUTE_WRITECOPY": - yield f"Unexpected protection ({vads[dll_base].protection}) for DLL in the PEB's load order list ({dll_base:#x}) with path {dlls[dll_base].path}" - - def _generator(self, procs): - checks = [ - self._check_load_address, - self._check_exe_protection, - self._check_dlls_protection, - ] - - for proc in procs: - # smear and/or terminated process - dlls = self._get_dlls_map(proc) - if len(dlls) < 3: - continue - - vads = self._get_vads_data(proc) - if len(vads) < 5: - continue - - proc_name = utility.array_to_string(proc.ImageFileName) - pid = proc.UniqueProcessId - - for check in checks: - for note in check(proc, vads, dlls): - yield 0, ( - pid, - proc_name, - note, - ) - - def run(self): - filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - - return renderers.TreeGrid( - [ - ("PID", int), - ("Process", str), - ("Notes", str), - ], - self._generator( - pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config["kernel"], - filter_func=filter_func, - ) - ), - ) + _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/windows/malware/hollowprocesses.py b/volatility3/framework/plugins/windows/malware/hollowprocesses.py new file mode 100644 index 000000000..f981ae340 --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/hollowprocesses.py @@ -0,0 +1,223 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import NamedTuple, Dict, Generator + +from volatility3.framework import interfaces, exceptions, constants +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.plugins.windows import pslist, vadinfo + +vollog = logging.getLogger(__name__) + + +class VadData(NamedTuple): + protection: str + path: str + + +class DLLData(NamedTuple): + path: str + + +### Useful references on process hollowing +# https://cysinfo.com/detecting-deceptive-hollowing-techniques/ +# https://github.com/m0n0ph1/Process-Hollowing + + +class HollowProcesses(interfaces.plugins.PluginInterface): + """Lists hollowed processes""" + + _required_framework_version = (2, 4, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls): + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.ListRequirement( + name="pid", + element_type=int, + description="Process IDs to include (all other processes are excluded)", + optional=True, + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) + ), + ] + + def _get_vads_data( + self, proc: interfaces.objects.ObjectInterface + ) -> Dict[int, VadData]: + """ + Returns a dictionary of: + base address -> (protection string, file name) + For each mapped VAD in the process. This is used + for quick lookups of data and matching the DLL + at the same base address as the VAD + """ + vads = {} + + kernel = self.context.modules[self.config["kernel"]] + + for vad in proc.get_vad_root().traverse(): + protection_string = vad.get_protection( + vadinfo.VadInfo.protect_values( + self.context, kernel.layer_name, kernel.symbol_table_name + ), + vadinfo.winnt_protections, + ) + + fn = vad.get_file_name() + if not fn or not isinstance(fn, str): + fn = "" + + vads[vad.get_start()] = VadData(protection_string, fn) + + return vads + + def _get_dlls_map( + self, proc: interfaces.objects.ObjectInterface + ) -> Dict[int, DLLData]: + """ + Returns a dictionary of: + base address -> path + for each DLL loaded in the process + + This is used to cross compare with + the corresponding VAD and to have a + backup path source in case of smear + in the VAD + """ + dlls = {} + + for entry in proc.load_order_modules(): + try: + base = entry.DllBase + except exceptions.InvalidAddressException: + continue + + try: + FullDllName = entry.FullDllName.get_string() + except exceptions.InvalidAddressException: + FullDllName = renderers.UnreadableValue() + + dlls[base] = DLLData(FullDllName) + + return dlls + + def _get_image_base(self, proc: interfaces.objects.ObjectInterface) -> int: + """ + Uses the PEB to get the image base of the process + """ + kernel = self.context.modules[self.config["kernel"]] + + try: + proc_layer_name = proc.add_process_layer() + peb = self.context.object( + kernel.symbol_table_name + constants.BANG + "_PEB", + layer_name=proc_layer_name, + offset=proc.Peb, + ) + return peb.ImageBaseAddress + except exceptions.InvalidAddressException: + return None + + def _check_load_address(self, proc, _, __) -> Generator[str, None, None]: + """ + Detects when the image base in the PEB, which is writable by process malware, + does not match the section base address - whose value lives in kernel memory. + Many malware samples will manipulate their image base to fool AVs/EDRs and + as a necessary part of certain hollowing techniques + """ + image_base = self._get_image_base(proc) + if image_base is not None and image_base != proc.SectionBaseAddress: + yield f"The ImageBaseAddress reported from the PEB ({image_base:#x}) does not match the process SectionBaseAddress ({proc.SectionBaseAddress:#x})" + + def _check_exe_protection( + self, proc, vads: Dict[int, VadData], __ + ) -> Generator[str, None, None]: + """ + Legitimately mapped application executables and DLLs + will have a VAD present and its initial protection will be + PAGE_EXECUTE_WRITECOPY. + Many process hollowing and code injection techniques will + unmap the real executable and/or map in executables with + incorrect permissions. + This check verifies the VAD for the application exe. + `_check_dlls_protection` checks for DLLs mapped in the process. + """ + base = proc.SectionBaseAddress + + if base not in vads: + yield f"There is no VAD starting at the base address of the process executable ({base:#x})" + elif vads[base].protection != "PAGE_EXECUTE_WRITECOPY": + yield f"Unexpected protection ({vads[base].protection}) for VAD hosting the process executable ({base:#x}) with path {vads[base].path}" + + def _check_dlls_protection( + self, _, vads: Dict[int, VadData], dlls: Dict[int, DLLData] + ) -> Generator[str, None, None]: + for dll_base in dlls: + # could be malicious but triggers too many FPs from smear + if dll_base not in vads: + continue + + # PAGE_EXECUTE_WRITECOPY is the only valid permission for mapped DLLs and .exe files + if vads[dll_base].protection != "PAGE_EXECUTE_WRITECOPY": + yield f"Unexpected protection ({vads[dll_base].protection}) for DLL in the PEB's load order list ({dll_base:#x}) with path {dlls[dll_base].path}" + + def _generator(self, procs): + checks = [ + self._check_load_address, + self._check_exe_protection, + self._check_dlls_protection, + ] + + for proc in procs: + # smear and/or terminated process + dlls = self._get_dlls_map(proc) + if len(dlls) < 3: + continue + + vads = self._get_vads_data(proc) + if len(vads) < 5: + continue + + proc_name = utility.array_to_string(proc.ImageFileName) + pid = proc.UniqueProcessId + + for check in checks: + for note in check(proc, vads, dlls): + yield 0, ( + pid, + proc_name, + note, + ) + + def run(self): + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Notes", str), + ], + self._generator( + pslist.PsList.list_processes( + context=self.context, + kernel_module_name=self.config["kernel"], + filter_func=filter_func, + ) + ), + ) From 21da9002d7be2492f14cb894b1e742e2efe3e104 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 13:31:26 +0300 Subject: [PATCH 1136/1352] categorize windows.processghosting as a malware plugin --- .../windows/malware/processghosting.py | 220 +++++++++++++++++ .../plugins/windows/processghosting.py | 222 +----------------- 2 files changed, 231 insertions(+), 211 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/processghosting.py diff --git a/volatility3/framework/plugins/windows/malware/processghosting.py b/volatility3/framework/plugins/windows/malware/processghosting.py new file mode 100644 index 000000000..f234bc2e7 --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/processghosting.py @@ -0,0 +1,220 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging + +from typing import Optional, Tuple, Generator, Dict + +from volatility3.framework import interfaces, exceptions +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist, vadinfo + +vollog = logging.getLogger(__name__) + + +class ProcessGhosting(interfaces.plugins.PluginInterface): + """Lists processes whose DeletePending bit is set or whose FILE_OBJECT is set to 0 or Vads that are DeleteOnClose""" + + _version = (1, 0, 0) + _required_framework_version = (2, 4, 0) + + @classmethod + def get_requirements(cls): + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 1) + ), + ] + + @classmethod + def _process_checks( + cls, + proc: interfaces.objects.ObjectInterface, + mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]], + ) -> Generator[ + Tuple[int, Optional[int], Optional[int], int, Optional[str]], None, None + ]: + """ + Checks the EPROCESS for signs of ghosting + """ + if not proc.has_member("ImageFilePointer"): + return + + delete_pending = None + + # if it is 0 then its a side effect of process ghosting + if proc.ImageFilePointer.vol.offset != 0: + try: + file_object = proc.ImageFilePointer + delete_pending = file_object.DeletePending + file_object = file_object.dereference().vol.offset + except exceptions.InvalidAddressException: + file_object = 0 + + # ImageFilePointer equal to 0 means process ghosting or similar techniques were used + else: + file_object = 0 + + # delete_pending besides 0 or 1 = smear + if isinstance(delete_pending, int) and delete_pending not in [0, 1]: + vollog.debug( + f"Invalid delete_pending value {delete_pending} found for process {proc.UniqueProcessId}" + ) + delete_pending = None + + if file_object == 0 or delete_pending == 1: + yield file_object, delete_pending, None, proc.SectionBaseAddress + + @classmethod + def _vad_checks( + cls, control_area: interfaces.objects.ObjectInterface, vad_path: str + ) -> Generator[Tuple[int, Optional[int], Optional[int]], None, None]: + """ + Checks the control area for delete on close or delete pending being set + """ + try: + file_object = control_area.FilePointer.dereference().cast("_FILE_OBJECT") + except exceptions.InvalidAddressException: + return + + try: + delete_on_close = control_area.u.Flags.DeleteOnClose + except exceptions.InvalidAddressException: + delete_on_close = None + + if delete_on_close and vad_path.lower().endswith((".exe", ".dll")): + yield file_object.vol.offset, None, delete_on_close + + try: + delete_pending = file_object.DeletePending + except exceptions.InvalidAddressException: + delete_pending = None + + if delete_pending == 1: + yield file_object.vol.offset, delete_pending, None + + @classmethod + def check_for_ghosting( + cls, + proc: interfaces.objects.ObjectInterface, + mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]], + ) -> Generator[ + Tuple[int, Optional[int], Optional[int], int, Optional[str]], None, None + ]: + """ + Returns process or vad info for ghosting files + + Args: + proc: + mapped_files: A dictionary mapping vad base addresses to the path and vad instance for the process + + Return: + A Generator of tuples of the file object address, the delete pending state, delete on close state, base address of the VAD, and the path + """ + # check the direct file object of the process + yield from cls._process_checks(proc, mapped_files) + + # walk each vad, check if it is pending delete or has its delete on close bit set + for vad_base, (path, vad) in mapped_files.items(): + # these checks have no meaning for private memory areas + if vad.get_private_memory() == 1: + continue + + try: + if vad.has_member("ControlArea"): + control_area = vad.ControlArea + elif vad.has_member("Subsection"): + control_area = vad.Subsection.ControlArea + # We got here from a short vad, likely smear + else: + continue + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to get control area for vad at base {vad_base:#x} for process with pid {proc.UniqueProcessId}" + ) + continue + + for file_object_address, delete_pending, delete_on_close in cls._vad_checks( + control_area, path + ): + yield format_hints.Hex( + file_object_address + ), delete_pending, delete_on_close, vad_base + + def _generator(self, procs): + kernel = self.context.modules[self.config["kernel"]] + + has_imagefilepointer = kernel.get_type("_EPROCESS").has_member( + "ImageFilePointer" + ) + if not has_imagefilepointer: + vollog.warning( + "ImageFilePointer checks are only supported on Windows 10+ builds when the ImageFilePointer member of _EPROCESS is present" + ) + + for proc in procs: + process_name = utility.array_to_string(proc.ImageFileName) + pid = proc.UniqueProcessId + + # base address -> (file path, VAD instance) + mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]] = {} + for vad in vadinfo.VadInfo.list_vads(proc): + path = vad.get_file_name() + if isinstance(path, str): + mapped_files[vad.get_start()] = (path, vad) + + for ( + file_object_address, + delete_pending, + delete_on_close, + base_address, + ) in self.check_for_ghosting(proc, mapped_files): + vad_info = mapped_files.get(base_address) + if vad_info: + path = vad_info[0] + else: + path = renderers.NotAvailableValue() + + yield 0, ( + pid, + process_name, + format_hints.Hex(base_address), + format_hints.Hex(file_object_address), + delete_pending or renderers.NotApplicableValue(), + delete_on_close or renderers.NotApplicableValue(), + path, + ) + + def run(self): + filter_func = pslist.PsList.create_active_process_filter() + + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Base", format_hints.Hex), + ("FILE_OBJECT", format_hints.Hex), + ("DeletePending", int), + ("DeleteOnClose", int), + ("Path", str), + ], + self._generator( + pslist.PsList.list_processes( + context=self.context, + kernel_module_name=self.config["kernel"], + filter_func=filter_func, + ) + ), + ) diff --git a/volatility3/framework/plugins/windows/processghosting.py b/volatility3/framework/plugins/windows/processghosting.py index f234bc2e7..24eb6fa9a 100644 --- a/volatility3/framework/plugins/windows/processghosting.py +++ b/volatility3/framework/plugins/windows/processghosting.py @@ -1,220 +1,20 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging - -from typing import Optional, Tuple, Generator, Dict - -from volatility3.framework import interfaces, exceptions -from volatility3.framework import renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.objects import utility -from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import pslist, vadinfo +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import processghosting vollog = logging.getLogger(__name__) -class ProcessGhosting(interfaces.plugins.PluginInterface): - """Lists processes whose DeletePending bit is set or whose FILE_OBJECT is set to 0 or Vads that are DeleteOnClose""" +class ProcessGhosting( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=processghosting.ProcessGhosting, + removal_date="2026-06-07", +): + """Lists processes whose DeletePending bit is set or whose FILE_OBJECT is set to 0 or Vads that are DeleteOnClose (deprecated).""" - _version = (1, 0, 0) _required_framework_version = (2, 4, 0) - - @classmethod - def get_requirements(cls): - # Since we're calling the plugin, make sure we have the plugin's requirements - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 1) - ), - ] - - @classmethod - def _process_checks( - cls, - proc: interfaces.objects.ObjectInterface, - mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]], - ) -> Generator[ - Tuple[int, Optional[int], Optional[int], int, Optional[str]], None, None - ]: - """ - Checks the EPROCESS for signs of ghosting - """ - if not proc.has_member("ImageFilePointer"): - return - - delete_pending = None - - # if it is 0 then its a side effect of process ghosting - if proc.ImageFilePointer.vol.offset != 0: - try: - file_object = proc.ImageFilePointer - delete_pending = file_object.DeletePending - file_object = file_object.dereference().vol.offset - except exceptions.InvalidAddressException: - file_object = 0 - - # ImageFilePointer equal to 0 means process ghosting or similar techniques were used - else: - file_object = 0 - - # delete_pending besides 0 or 1 = smear - if isinstance(delete_pending, int) and delete_pending not in [0, 1]: - vollog.debug( - f"Invalid delete_pending value {delete_pending} found for process {proc.UniqueProcessId}" - ) - delete_pending = None - - if file_object == 0 or delete_pending == 1: - yield file_object, delete_pending, None, proc.SectionBaseAddress - - @classmethod - def _vad_checks( - cls, control_area: interfaces.objects.ObjectInterface, vad_path: str - ) -> Generator[Tuple[int, Optional[int], Optional[int]], None, None]: - """ - Checks the control area for delete on close or delete pending being set - """ - try: - file_object = control_area.FilePointer.dereference().cast("_FILE_OBJECT") - except exceptions.InvalidAddressException: - return - - try: - delete_on_close = control_area.u.Flags.DeleteOnClose - except exceptions.InvalidAddressException: - delete_on_close = None - - if delete_on_close and vad_path.lower().endswith((".exe", ".dll")): - yield file_object.vol.offset, None, delete_on_close - - try: - delete_pending = file_object.DeletePending - except exceptions.InvalidAddressException: - delete_pending = None - - if delete_pending == 1: - yield file_object.vol.offset, delete_pending, None - - @classmethod - def check_for_ghosting( - cls, - proc: interfaces.objects.ObjectInterface, - mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]], - ) -> Generator[ - Tuple[int, Optional[int], Optional[int], int, Optional[str]], None, None - ]: - """ - Returns process or vad info for ghosting files - - Args: - proc: - mapped_files: A dictionary mapping vad base addresses to the path and vad instance for the process - - Return: - A Generator of tuples of the file object address, the delete pending state, delete on close state, base address of the VAD, and the path - """ - # check the direct file object of the process - yield from cls._process_checks(proc, mapped_files) - - # walk each vad, check if it is pending delete or has its delete on close bit set - for vad_base, (path, vad) in mapped_files.items(): - # these checks have no meaning for private memory areas - if vad.get_private_memory() == 1: - continue - - try: - if vad.has_member("ControlArea"): - control_area = vad.ControlArea - elif vad.has_member("Subsection"): - control_area = vad.Subsection.ControlArea - # We got here from a short vad, likely smear - else: - continue - except exceptions.InvalidAddressException: - vollog.debug( - f"Unable to get control area for vad at base {vad_base:#x} for process with pid {proc.UniqueProcessId}" - ) - continue - - for file_object_address, delete_pending, delete_on_close in cls._vad_checks( - control_area, path - ): - yield format_hints.Hex( - file_object_address - ), delete_pending, delete_on_close, vad_base - - def _generator(self, procs): - kernel = self.context.modules[self.config["kernel"]] - - has_imagefilepointer = kernel.get_type("_EPROCESS").has_member( - "ImageFilePointer" - ) - if not has_imagefilepointer: - vollog.warning( - "ImageFilePointer checks are only supported on Windows 10+ builds when the ImageFilePointer member of _EPROCESS is present" - ) - - for proc in procs: - process_name = utility.array_to_string(proc.ImageFileName) - pid = proc.UniqueProcessId - - # base address -> (file path, VAD instance) - mapped_files: Dict[int, Tuple[str, interfaces.objects.ObjectInterface]] = {} - for vad in vadinfo.VadInfo.list_vads(proc): - path = vad.get_file_name() - if isinstance(path, str): - mapped_files[vad.get_start()] = (path, vad) - - for ( - file_object_address, - delete_pending, - delete_on_close, - base_address, - ) in self.check_for_ghosting(proc, mapped_files): - vad_info = mapped_files.get(base_address) - if vad_info: - path = vad_info[0] - else: - path = renderers.NotAvailableValue() - - yield 0, ( - pid, - process_name, - format_hints.Hex(base_address), - format_hints.Hex(file_object_address), - delete_pending or renderers.NotApplicableValue(), - delete_on_close or renderers.NotApplicableValue(), - path, - ) - - def run(self): - filter_func = pslist.PsList.create_active_process_filter() - - return renderers.TreeGrid( - [ - ("PID", int), - ("Process", str), - ("Base", format_hints.Hex), - ("FILE_OBJECT", format_hints.Hex), - ("DeletePending", int), - ("DeleteOnClose", int), - ("Path", str), - ], - self._generator( - pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config["kernel"], - filter_func=filter_func, - ) - ), - ) + _version = (1, 0, 0) From e5738c126380a7624702ec4ee95fdb53dc7ed81d Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 14:03:36 +0300 Subject: [PATCH 1137/1352] categorize windows.psxview as malware plugin --- .../plugins/windows/malware/psxview.py | 241 ++++++++++++++++++ .../framework/plugins/windows/psxview.py | 237 +---------------- 2 files changed, 255 insertions(+), 223 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/psxview.py diff --git a/volatility3/framework/plugins/windows/malware/psxview.py b/volatility3/framework/plugins/windows/malware/psxview.py new file mode 100644 index 000000000..51616a22c --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/psxview.py @@ -0,0 +1,241 @@ +import datetime +import logging +import string +from itertools import chain +from typing import Dict, Iterable, List + +from volatility3.framework import constants, exceptions, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols.windows import extensions +from volatility3.plugins.windows import handles, pslist, psscan, thrdscan + +vollog = logging.getLogger(__name__) + + +class PsXView(plugins.PluginInterface): + """Lists all processes found via four of the methods described in \"The Art of Memory Forensics\" which may help \ +identify processes that are trying to hide themselves. + +We recommend using -r pretty if you are looking at this plugin's output in a terminal.""" + + # I've omitted the desktop thread scanning method because Volatility3 doesn't appear to have the functionality + # which the original plugin used to do it. + + # The sessions method is omitted because it begins with the list of processes found by Pslist anyway. + + # Lastly, I've omitted the pspcid method because I could not for the life of me get it to work. I saved the + # code I do have from it, and will happily share it if anyone else wants to add it. + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + valid_proc_name_chars = set( + string.ascii_lowercase + string.ascii_uppercase + "." + " " + ) + + @classmethod + def get_requirements(cls): + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="psscan", component=psscan.PsScan, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="handles", component=handles.Handles, version=(4, 0, 0) + ), + requirements.BooleanRequirement( + name="physical-offsets", + description="List processes with physical offsets instead of virtual offsets.", + optional=True, + ), + ] + + def _proc_name_to_string(self, proc): + return proc.ImageFileName.cast( + "string", max_length=proc.ImageFileName.vol.count, errors="replace" + ) + + def _is_valid_proc_name(self, string: str) -> bool: + return all(c in self.valid_proc_name_chars for c in string) + + def _filter_garbage_procs( + self, proc_list: Iterable[extensions.EPROCESS] + ) -> List[extensions.EPROCESS]: + return [ + p + for p in proc_list + if p.is_valid() and self._is_valid_proc_name(self._proc_name_to_string(p)) + ] + + def _translate_offset(self, offset: int) -> int: + if not self.config["physical-offsets"]: + return offset + + kernel = self.context.modules[self.config["kernel"]] + layer_name = kernel.layer_name + + try: + _original_offset, _original_length, offset, _length, _layer_name = list( + self.context.layers[layer_name].mapping(offset=offset, length=0) + )[0] + except exceptions.PagedInvalidAddressException: + vollog.debug(f"Page fault: unable to translate {offset:0x}") + + return offset + + def _proc_list_to_dict( + self, tasks: Iterable[extensions.EPROCESS] + ) -> Dict[int, extensions.EPROCESS]: + tasks = self._filter_garbage_procs(tasks) + return {self._translate_offset(proc.vol.offset): proc for proc in tasks} + + def _check_pslist(self, tasks): + return self._proc_list_to_dict(tasks) + + def _check_psscan( + self, + ) -> Dict[int, extensions.EPROCESS]: + res = psscan.PsScan.scan_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) + + return self._proc_list_to_dict(res) + + def _check_thrdscan(self) -> Dict[int, extensions.EPROCESS]: + ret = [] + + for ethread in thrdscan.ThrdScan.scan_threads( + self.context, module_name="kernel" + ): + process = None + try: + process = ethread.owning_process() + if not process.is_valid(): + continue + + ret.append(process) + except AttributeError: + vollog.log( + constants.LOGLEVEL_VVV, + "Unable to find the owning process of ethread", + ) + + return self._proc_list_to_dict(ret) + + def _check_csrss_handles( + self, tasks: Iterable[extensions.EPROCESS] + ) -> Dict[int, extensions.EPROCESS]: + ret: List[extensions.EPROCESS] = [] + + type_map = handles.Handles.get_type_map( + context=self.context, kernel_module_name=self.config["kernel"] + ) + + cookie = handles.Handles.find_cookie( + context=self.context, kernel_module_name=self.config["kernel"] + ) + + for p in tasks: + name = self._proc_name_to_string(p) + if name != "csrss.exe": + continue + + try: + ret += [ + handle.Body.cast("_EPROCESS") + for handle in handles.Handles.handles( + context=self.context, + kernel_module_name=self.config["kernel"], + handle_table=p.ObjectTable, + ) + if handle.get_object_type(type_map, cookie) == "Process" + ] + except exceptions.InvalidAddressException: + vollog.log( + constants.LOGLEVEL_VVV, "Cannot access eprocess object table" + ) + + return self._proc_list_to_dict(ret) + + def _generator(self): + kdbg_list_processes = list( + pslist.PsList.list_processes( + context=self.context, kernel_module_name=self.config["kernel"] + ) + ) + + # get processes from each source + processes: Dict[str, Dict[int, extensions.EPROCESS]] = {} + + processes["pslist"] = self._check_pslist(kdbg_list_processes) + processes["psscan"] = self._check_psscan() + processes["thrdscan"] = self._check_thrdscan() + processes["csrss"] = self._check_csrss_handles(kdbg_list_processes) + + # Unique set of all offsets from all sources + offsets = set(chain(*(mapping.keys() for mapping in processes.values()))) + + for offset in offsets: + # We know there will be at least one process mapped to each offset + proc: extensions.EPROCESS = next( + mapping[offset] for mapping in processes.values() if offset in mapping + ) + + in_sources = {src: False for src in processes} + + for source, process_mapping in processes.items(): + if offset in process_mapping: + in_sources[source] = True + + pid = proc.UniqueProcessId + name = self._proc_name_to_string(proc) + + exit_time = proc.get_exit_time() + if type(exit_time) is not datetime.datetime: + exit_time = "" + else: + exit_time = str(exit_time) + + yield ( + 0, + ( + format_hints.Hex(offset), + name, + pid, + in_sources["pslist"], + in_sources["psscan"], + in_sources["thrdscan"], + in_sources["csrss"], + exit_time, + ), + ) + + def run(self): + offset_type = "(Physical)" if self.config["physical-offsets"] else "(Virtual)" + offset_str = "Offset" + offset_type + + return renderers.TreeGrid( + [ + (offset_str, format_hints.Hex), + ("Name", str), + ("PID", int), + ("pslist", bool), + ("psscan", bool), + ("thrdscan", bool), + ("csrss", bool), + ("Exit Time", str), + ], + self._generator(), + ) diff --git a/volatility3/framework/plugins/windows/psxview.py b/volatility3/framework/plugins/windows/psxview.py index 51616a22c..625f02387 100644 --- a/volatility3/framework/plugins/windows/psxview.py +++ b/volatility3/framework/plugins/windows/psxview.py @@ -1,24 +1,24 @@ -import datetime +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# import logging -import string -from itertools import chain -from typing import Dict, Iterable, List - -from volatility3.framework import constants, exceptions, renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins -from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols.windows import extensions -from volatility3.plugins.windows import handles, pslist, psscan, thrdscan +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import psxview vollog = logging.getLogger(__name__) -class PsXView(plugins.PluginInterface): +class PsXView( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=psxview.PsXView, + removal_date="2026-06-07", +): """Lists all processes found via four of the methods described in \"The Art of Memory Forensics\" which may help \ -identify processes that are trying to hide themselves. + identify processes that are trying to hide themselves. -We recommend using -r pretty if you are looking at this plugin's output in a terminal.""" + We recommend using -r pretty if you are looking at this plugin's output in a terminal. + deprecated.""" # I've omitted the desktop thread scanning method because Volatility3 doesn't appear to have the functionality # which the original plugin used to do it. @@ -30,212 +30,3 @@ We recommend using -r pretty if you are looking at this plugin's output in a ter _required_framework_version = (2, 0, 0) _version = (1, 0, 0) - - valid_proc_name_chars = set( - string.ascii_lowercase + string.ascii_uppercase + "." + " " - ) - - @classmethod - def get_requirements(cls): - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="psscan", component=psscan.PsScan, version=(2, 0, 0) - ), - requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) - ), - requirements.VersionRequirement( - name="handles", component=handles.Handles, version=(4, 0, 0) - ), - requirements.BooleanRequirement( - name="physical-offsets", - description="List processes with physical offsets instead of virtual offsets.", - optional=True, - ), - ] - - def _proc_name_to_string(self, proc): - return proc.ImageFileName.cast( - "string", max_length=proc.ImageFileName.vol.count, errors="replace" - ) - - def _is_valid_proc_name(self, string: str) -> bool: - return all(c in self.valid_proc_name_chars for c in string) - - def _filter_garbage_procs( - self, proc_list: Iterable[extensions.EPROCESS] - ) -> List[extensions.EPROCESS]: - return [ - p - for p in proc_list - if p.is_valid() and self._is_valid_proc_name(self._proc_name_to_string(p)) - ] - - def _translate_offset(self, offset: int) -> int: - if not self.config["physical-offsets"]: - return offset - - kernel = self.context.modules[self.config["kernel"]] - layer_name = kernel.layer_name - - try: - _original_offset, _original_length, offset, _length, _layer_name = list( - self.context.layers[layer_name].mapping(offset=offset, length=0) - )[0] - except exceptions.PagedInvalidAddressException: - vollog.debug(f"Page fault: unable to translate {offset:0x}") - - return offset - - def _proc_list_to_dict( - self, tasks: Iterable[extensions.EPROCESS] - ) -> Dict[int, extensions.EPROCESS]: - tasks = self._filter_garbage_procs(tasks) - return {self._translate_offset(proc.vol.offset): proc for proc in tasks} - - def _check_pslist(self, tasks): - return self._proc_list_to_dict(tasks) - - def _check_psscan( - self, - ) -> Dict[int, extensions.EPROCESS]: - res = psscan.PsScan.scan_processes( - context=self.context, kernel_module_name=self.config["kernel"] - ) - - return self._proc_list_to_dict(res) - - def _check_thrdscan(self) -> Dict[int, extensions.EPROCESS]: - ret = [] - - for ethread in thrdscan.ThrdScan.scan_threads( - self.context, module_name="kernel" - ): - process = None - try: - process = ethread.owning_process() - if not process.is_valid(): - continue - - ret.append(process) - except AttributeError: - vollog.log( - constants.LOGLEVEL_VVV, - "Unable to find the owning process of ethread", - ) - - return self._proc_list_to_dict(ret) - - def _check_csrss_handles( - self, tasks: Iterable[extensions.EPROCESS] - ) -> Dict[int, extensions.EPROCESS]: - ret: List[extensions.EPROCESS] = [] - - type_map = handles.Handles.get_type_map( - context=self.context, kernel_module_name=self.config["kernel"] - ) - - cookie = handles.Handles.find_cookie( - context=self.context, kernel_module_name=self.config["kernel"] - ) - - for p in tasks: - name = self._proc_name_to_string(p) - if name != "csrss.exe": - continue - - try: - ret += [ - handle.Body.cast("_EPROCESS") - for handle in handles.Handles.handles( - context=self.context, - kernel_module_name=self.config["kernel"], - handle_table=p.ObjectTable, - ) - if handle.get_object_type(type_map, cookie) == "Process" - ] - except exceptions.InvalidAddressException: - vollog.log( - constants.LOGLEVEL_VVV, "Cannot access eprocess object table" - ) - - return self._proc_list_to_dict(ret) - - def _generator(self): - kdbg_list_processes = list( - pslist.PsList.list_processes( - context=self.context, kernel_module_name=self.config["kernel"] - ) - ) - - # get processes from each source - processes: Dict[str, Dict[int, extensions.EPROCESS]] = {} - - processes["pslist"] = self._check_pslist(kdbg_list_processes) - processes["psscan"] = self._check_psscan() - processes["thrdscan"] = self._check_thrdscan() - processes["csrss"] = self._check_csrss_handles(kdbg_list_processes) - - # Unique set of all offsets from all sources - offsets = set(chain(*(mapping.keys() for mapping in processes.values()))) - - for offset in offsets: - # We know there will be at least one process mapped to each offset - proc: extensions.EPROCESS = next( - mapping[offset] for mapping in processes.values() if offset in mapping - ) - - in_sources = {src: False for src in processes} - - for source, process_mapping in processes.items(): - if offset in process_mapping: - in_sources[source] = True - - pid = proc.UniqueProcessId - name = self._proc_name_to_string(proc) - - exit_time = proc.get_exit_time() - if type(exit_time) is not datetime.datetime: - exit_time = "" - else: - exit_time = str(exit_time) - - yield ( - 0, - ( - format_hints.Hex(offset), - name, - pid, - in_sources["pslist"], - in_sources["psscan"], - in_sources["thrdscan"], - in_sources["csrss"], - exit_time, - ), - ) - - def run(self): - offset_type = "(Physical)" if self.config["physical-offsets"] else "(Virtual)" - offset_str = "Offset" + offset_type - - return renderers.TreeGrid( - [ - (offset_str, format_hints.Hex), - ("Name", str), - ("PID", int), - ("pslist", bool), - ("psscan", bool), - ("thrdscan", bool), - ("csrss", bool), - ("Exit Time", str), - ], - self._generator(), - ) From a95ebfe3fd2c246e2103c57c61801704ba3e5751 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 16:06:32 +0300 Subject: [PATCH 1138/1352] categorize windows.suspicious_threads as malware plugin --- .../windows/malware/suspicious_threads.py | 221 ++++++++++++++++++ .../plugins/windows/suspicious_threads.py | 221 +----------------- 2 files changed, 231 insertions(+), 211 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/suspicious_threads.py diff --git a/volatility3/framework/plugins/windows/malware/suspicious_threads.py b/volatility3/framework/plugins/windows/malware/suspicious_threads.py new file mode 100644 index 000000000..3da8cb21a --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/suspicious_threads.py @@ -0,0 +1,221 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +from typing import List, Dict, Tuple, Generator +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist, threads, vadinfo, thrdscan + +vollog = logging.getLogger(__name__) + + +class SuspiciousThreads(interfaces.plugins.PluginInterface): + """Lists suspicious userland process threads""" + + _required_framework_version = (2, 4, 0) + _version = (2, 0, 1) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.ListRequirement( + name="pid", + description="Filter on specific process IDs", + element_type=int, + optional=True, + ), + requirements.VersionRequirement( + name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="threads", component=threads.Threads, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) + ), + ] + + def _get_ranges( + self, + kernel: interfaces.context.ModuleInterface, + all_ranges: Dict[int, List[Tuple[int, int, str, str]]], + proc, + ) -> Tuple[int, int, str, str]: + """ + Maintains a hash table so each process' VADs + are only enumerated once per plugin run + """ + key = proc.vol.offset + + if key not in all_ranges: + all_ranges[key] = [] + + for vad in proc.get_vad_root().traverse(): + fn = vad.get_file_name() + if not isinstance(fn, str) or not fn: + fn = None + + protection_string = vad.get_protection( + vadinfo.VadInfo.protect_values( + self.context, kernel.layer_name, kernel.symbol_table_name + ), + vadinfo.winnt_protections, + ) + + all_ranges[key].append( + (vad.get_start(), vad.get_end(), protection_string, fn) + ) + + return all_ranges[key] + + def _get_range( + self, ranges: Dict[int, List[Tuple[int, int, str, str]]], address: int + ) -> Tuple[int, str, str]: + """ + Walks a process' VADs looking for the one + containing `address` + + Returns its base address, protection string, and mapped file, if any + """ + for start, end, protection_string, fn in ranges: + if start <= address < end: + return start, protection_string, fn + + return None, None, None + + def _check_thread_address( + self, exe_path: str, ranges, thread_address: int + ) -> Generator[Tuple[str, str], None, None]: + vad_base, prot, vad_path = self._get_range(ranges, thread_address) + + # threads outside of a VAD means either smear from this thread or this process' VAD tree + if vad_base is None: + return + + if vad_path is None: + # set this so checks after report the non file backed region in the path column + vad_path = "" + + yield ( + vad_path, + f"This thread started execution in the VAD starting at base address ({vad_base:#x}), which is not backed by a file", + ) + + # All threads should point to PAGE_EXECUTE_WRITECOPY mapped regions + if prot != "PAGE_EXECUTE_WRITECOPY": + yield ( + vad_path, + f"VAD at base address ({vad_base:#x}) hosting this thread has an unexpected starting protection {prot}", + ) + + # check for process hollowing type techniques that mapped in a second, malicious exe file + if ( + exe_path + and vad_path.lower().endswith(".exe") + and (vad_path.lower() != exe_path.lower()) + ): + yield ( + vad_path, + "VAD at base address ({vad_base:#x}) hosting this thread maps an application executable that is not the process executable", + ) + + def _enumerate_processes( + self, kernel: interfaces.context.ModuleInterface, all_ranges + ): + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + + for proc in pslist.PsList.list_processes( + context=self.context, + kernel_module_name=self.config["kernel"], + filter_func=filter_func, + ): + ranges = self._get_ranges(kernel, all_ranges, proc) + + # smeared vads or process is terminating + if len(all_ranges[proc.vol.offset]) < 5: + continue + + pid = proc.UniqueProcessId + proc_name = utility.array_to_string(proc.ImageFileName) + + _, __, exe_path = self._get_range(ranges, proc.SectionBaseAddress) + if not isinstance(exe_path, str): + exe_path = None + + yield proc, pid, proc_name, exe_path, ranges + + def _generator(self): + kernel = self.context.modules[self.config["kernel"]] + + all_ranges = {} + + for proc, pid, proc_name, exe_path, ranges in self._enumerate_processes( + kernel, all_ranges + ): + # processes often create multiple threads at the same address + # there is no benefit to checking the same address more than once per process + checked = set() + + for thread in threads.Threads.list_threads( + self.context, self.config["kernel"], proc + ): + # do not process if a thread is exited or terminated (4 = Terminated) + if thread.ExitTime.QuadPart > 0 or thread.Tcb.State == 4: + continue + + # bail if accessing the threads members causes a page fault + info = thrdscan.ThrdScan.gather_thread_info(thread) + if not info: + continue + + _, _, tid, start_address, _, win32_start_address, _, _, _ = info + + addresses = [ + (start_address, "Start"), + (win32_start_address, "Win32Start"), + ] + + for address, context in addresses: + if address in checked: + continue + checked.add(address) + + for vad_path, note in self._check_thread_address( + exe_path, ranges, address + ): + yield 0, ( + proc_name, + pid, + tid, + context, + format_hints.Hex(address), + vad_path, + note, + ) + + def run(self): + return renderers.TreeGrid( + [ + ("Process", str), + ("PID", int), + ("TID", int), + ("Context", str), + ("Address", format_hints.Hex), + ("VAD Path", str), + ("Note", str), + ], + self._generator(), + ) diff --git a/volatility3/framework/plugins/windows/suspicious_threads.py b/volatility3/framework/plugins/windows/suspicious_threads.py index 3da8cb21a..068bdccaf 100644 --- a/volatility3/framework/plugins/windows/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/suspicious_threads.py @@ -1,221 +1,20 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - import logging -from typing import List, Dict, Tuple, Generator -from volatility3.framework import renderers, interfaces -from volatility3.framework.configuration import requirements -from volatility3.framework.objects import utility -from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import pslist, threads, vadinfo, thrdscan +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import suspicious_threads vollog = logging.getLogger(__name__) -class SuspiciousThreads(interfaces.plugins.PluginInterface): - """Lists suspicious userland process threads""" +class SuspiciousThreads( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=suspicious_threads.SuspiciousThreads, + removal_date="2026-06-07", +): + """Lists suspicious userland process threads (deprecated).""" _required_framework_version = (2, 4, 0) _version = (2, 0, 1) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - # Since we're calling the plugin, make sure we have the plugin's requirements - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.ListRequirement( - name="pid", - description="Filter on specific process IDs", - element_type=int, - optional=True, - ), - requirements.VersionRequirement( - name="thrdscan", component=thrdscan.ThrdScan, version=(2, 0, 0) - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="threads", component=threads.Threads, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) - ), - ] - - def _get_ranges( - self, - kernel: interfaces.context.ModuleInterface, - all_ranges: Dict[int, List[Tuple[int, int, str, str]]], - proc, - ) -> Tuple[int, int, str, str]: - """ - Maintains a hash table so each process' VADs - are only enumerated once per plugin run - """ - key = proc.vol.offset - - if key not in all_ranges: - all_ranges[key] = [] - - for vad in proc.get_vad_root().traverse(): - fn = vad.get_file_name() - if not isinstance(fn, str) or not fn: - fn = None - - protection_string = vad.get_protection( - vadinfo.VadInfo.protect_values( - self.context, kernel.layer_name, kernel.symbol_table_name - ), - vadinfo.winnt_protections, - ) - - all_ranges[key].append( - (vad.get_start(), vad.get_end(), protection_string, fn) - ) - - return all_ranges[key] - - def _get_range( - self, ranges: Dict[int, List[Tuple[int, int, str, str]]], address: int - ) -> Tuple[int, str, str]: - """ - Walks a process' VADs looking for the one - containing `address` - - Returns its base address, protection string, and mapped file, if any - """ - for start, end, protection_string, fn in ranges: - if start <= address < end: - return start, protection_string, fn - - return None, None, None - - def _check_thread_address( - self, exe_path: str, ranges, thread_address: int - ) -> Generator[Tuple[str, str], None, None]: - vad_base, prot, vad_path = self._get_range(ranges, thread_address) - - # threads outside of a VAD means either smear from this thread or this process' VAD tree - if vad_base is None: - return - - if vad_path is None: - # set this so checks after report the non file backed region in the path column - vad_path = "" - - yield ( - vad_path, - f"This thread started execution in the VAD starting at base address ({vad_base:#x}), which is not backed by a file", - ) - - # All threads should point to PAGE_EXECUTE_WRITECOPY mapped regions - if prot != "PAGE_EXECUTE_WRITECOPY": - yield ( - vad_path, - f"VAD at base address ({vad_base:#x}) hosting this thread has an unexpected starting protection {prot}", - ) - - # check for process hollowing type techniques that mapped in a second, malicious exe file - if ( - exe_path - and vad_path.lower().endswith(".exe") - and (vad_path.lower() != exe_path.lower()) - ): - yield ( - vad_path, - "VAD at base address ({vad_base:#x}) hosting this thread maps an application executable that is not the process executable", - ) - - def _enumerate_processes( - self, kernel: interfaces.context.ModuleInterface, all_ranges - ): - filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - - for proc in pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config["kernel"], - filter_func=filter_func, - ): - ranges = self._get_ranges(kernel, all_ranges, proc) - - # smeared vads or process is terminating - if len(all_ranges[proc.vol.offset]) < 5: - continue - - pid = proc.UniqueProcessId - proc_name = utility.array_to_string(proc.ImageFileName) - - _, __, exe_path = self._get_range(ranges, proc.SectionBaseAddress) - if not isinstance(exe_path, str): - exe_path = None - - yield proc, pid, proc_name, exe_path, ranges - - def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - - all_ranges = {} - - for proc, pid, proc_name, exe_path, ranges in self._enumerate_processes( - kernel, all_ranges - ): - # processes often create multiple threads at the same address - # there is no benefit to checking the same address more than once per process - checked = set() - - for thread in threads.Threads.list_threads( - self.context, self.config["kernel"], proc - ): - # do not process if a thread is exited or terminated (4 = Terminated) - if thread.ExitTime.QuadPart > 0 or thread.Tcb.State == 4: - continue - - # bail if accessing the threads members causes a page fault - info = thrdscan.ThrdScan.gather_thread_info(thread) - if not info: - continue - - _, _, tid, start_address, _, win32_start_address, _, _, _ = info - - addresses = [ - (start_address, "Start"), - (win32_start_address, "Win32Start"), - ] - - for address, context in addresses: - if address in checked: - continue - checked.add(address) - - for vad_path, note in self._check_thread_address( - exe_path, ranges, address - ): - yield 0, ( - proc_name, - pid, - tid, - context, - format_hints.Hex(address), - vad_path, - note, - ) - - def run(self): - return renderers.TreeGrid( - [ - ("Process", str), - ("PID", int), - ("TID", int), - ("Context", str), - ("Address", format_hints.Hex), - ("VAD Path", str), - ("Note", str), - ], - self._generator(), - ) From c85026ee91e7466a394c6475e1c5677fe2eb7d39 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 7 Jun 2025 14:20:37 +0100 Subject: [PATCH 1139/1352] Core: Ensure people running renamed plugins know that the plugins are deprecated --- volatility3/framework/deprecation.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index 667ea72a5..4866a5a6e 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -133,6 +133,15 @@ class PluginRenameClass: ), ) else: - if not attr.startswith("__"): + if attr == "run": + setattr( + cls, + attr, + method_being_removed( + removal_date=removal_date, + message=f"This plugin has been renamed, please call {replacement_class.__module__}.{replacement_class.__qualname__} rather than deprecated_class_name.", + )(value), + ) + elif not attr.startswith("__"): setattr(cls, attr, value) return super(PluginRenameClass).__init_subclass__(**kwargs) From 520e2cfcdd94c67ebfa8727065880c648d53858f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 7 Jun 2025 14:21:22 +0100 Subject: [PATCH 1140/1352] Core: Fix up warning message --- volatility3/framework/deprecation.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index 4866a5a6e..90fa9bce0 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -139,7 +139,7 @@ class PluginRenameClass: attr, method_being_removed( removal_date=removal_date, - message=f"This plugin has been renamed, please call {replacement_class.__module__}.{replacement_class.__qualname__} rather than deprecated_class_name.", + message=f"This plugin has been renamed, please call {replacement_class.__module__}.{replacement_class.__qualname__} rather than {deprecated_class_name}.", )(value), ) elif not attr.startswith("__"): From 48a97166ea82a34ff32c39fd301c5a327b523178 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 15:55:20 +0300 Subject: [PATCH 1141/1352] categorize windows.skeleton_key_check as malware plugin --- .../windows/malware/skeleton_key_check.py | 686 ++++++++++++++++++ .../plugins/windows/skeleton_key_check.py | 685 +---------------- 2 files changed, 696 insertions(+), 675 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/skeleton_key_check.py diff --git a/volatility3/framework/plugins/windows/malware/skeleton_key_check.py b/volatility3/framework/plugins/windows/malware/skeleton_key_check.py new file mode 100644 index 000000000..d9cba0704 --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/skeleton_key_check.py @@ -0,0 +1,686 @@ +# This file is Copyright 2021 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +# This module attempts to locate skeleton-key like function hooks. +# It does this by locating the CSystems array through a variety of methods, +# and then validating the entry for RC4 HMAC (0x17 / 23) +# +# For a thorough walkthrough on how the R&D was performed to develop this plugin, +# please see our blogpost here: +# +# https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html + +import logging +from typing import Iterable, Tuple, List, Optional + +import pefile + +from volatility3.framework import interfaces, symbols, exceptions +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.layers import scanners +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows import pdbutil +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, vadinfo, pe_symbols + +try: + import capstone + + has_capstone = True +except ImportError: + has_capstone = False + +vollog = logging.getLogger(__name__) + + +class Skeleton_Key_Check(interfaces.plugins.PluginInterface): + """Looks for signs of Skeleton Key malware""" + + _required_framework_version = (2, 4, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls): + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) + ), + requirements.VersionRequirement( + name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="bytes_scanner", + component=scanners.BytesScanner, + version=(1, 0, 0), + ), + ] + + def _check_for_skeleton_key_vad( + self, + csystem: interfaces.objects.ObjectInterface, + cryptdll_base: int, + cryptdll_size: int, + ) -> bool: + """ + Checks if Initialize and/or Decrypt is hooked by determining if + these function pointers reference addresses inside of the cryptdll VAD + + Args: + csystem: The RC4HMAC KERB_ECRYPT instance + cryptdll_base: Base address of the cryptdll.dll VAD + cryptdll_size: Size of the VAD + Returns: + bool: if a skeleton key hook is present + """ + return not ( + (cryptdll_base <= csystem.Initialize <= cryptdll_base + cryptdll_size) + and (cryptdll_base <= csystem.Decrypt <= cryptdll_base + cryptdll_size) + ) + + def _check_for_skeleton_key_symbols( + self, + csystem: interfaces.objects.ObjectInterface, + rc4HmacInitialize: int, + rc4HmacDecrypt: int, + ) -> bool: + """ + Uses the PDB information to specifically check if the csystem for RC4HMAC + has an initialization pointer to rc4HmacInitialize and a decryption pointer + to rc4HmacDecrypt. + + Args: + csystem: The RC4HMAC KERB_ECRYPT instance + rc4HmacInitialize: The expected address of csystem Initialization function + rc4HmacDecrypt: The expected address of the csystem Decryption function + + Returns: + bool: if a skeleton key hook was found + """ + return ( + csystem.Initialize != rc4HmacInitialize or csystem.Decrypt != rc4HmacDecrypt + ) + + def _construct_ecrypt_array( + self, + array_start: int, + count: int, + cryptdll_types: interfaces.context.ModuleInterface, + ) -> interfaces.context.ModuleInterface: + """ + Attempts to construct an array of _KERB_ECRYPT structures + + Args: + array_start: starting virtual address of the array + count: how many elements are in the array + cryptdll_types: the reverse engineered types + + Returns: + The instantiated array + """ + + try: + array = cryptdll_types.object( + object_type="array", + offset=array_start, + subtype=cryptdll_types.get_type("_KERB_ECRYPT"), + count=count, + absolute=True, + ) + + except exceptions.InvalidAddressException: + vollog.debug( + f"Unable to construct cSystems array at given offset: {array_start:x}" + ) + array = None + + return array + + def _find_array_with_pdb_symbols( + self, + cryptdll_symbols: str, + cryptdll_types: interfaces.context.ModuleInterface, + proc_layer_name: str, + cryptdll_base: int, + ) -> Tuple[interfaces.objects.ObjectInterface, int, int, int]: + """ + Finds the CSystems array through use of PDB symbols + + Args: + cryptdll_symbols: The symbols table from the PDB file + cryptdll_types: The types from cryptdll binary analysis + proc_layer_name: The lsass.exe process layer name + cryptdll_base: Base address of cryptdll.dll inside of lsass.exe + + Returns: + Tuple of: + array: The cSystems array + rc4HmacInitialize: The runtime address of the expected initialization function + rc4HmacDecrypt: The runtime address of the expected decryption function + """ + cryptdll_module = self.context.module( + cryptdll_symbols, layer_name=proc_layer_name, offset=cryptdll_base + ) + + rc4HmacInitialize = cryptdll_module.get_absolute_symbol_address( + "rc4HmacInitialize" + ) + + rc4HmacDecrypt = cryptdll_module.get_absolute_symbol_address("rc4HmacDecrypt") + + count_address = cryptdll_module.get_symbol("cCSystems").address + + # we do not want to fail just because the count is not in memory + # 16 was the size on samples I tested, so I chose it as the default + try: + count = cryptdll_types.object( + object_type="unsigned long", offset=count_address + ) + except exceptions.InvalidAddressException: + count = 16 + + array_start = cryptdll_module.get_absolute_symbol_address("CSystems") + + array = self._construct_ecrypt_array(array_start, count, cryptdll_types) + + if array is None: + vollog.debug( + "The CSystem array is not present in memory. Stopping PDB based analysis." + ) + + return array, rc4HmacInitialize, rc4HmacDecrypt + + def _get_cryptdll_types( + self, + context: interfaces.context.ContextInterface, + config, + config_path: str, + proc_layer_name: str, + cryptdll_base: int, + ): + """ + Builds a symbol table from the cryptdll types generated after binary analysis + + Args: + context: the context to operate upon + config: + config_path: + proc_layer_name: name of the lsass.exe process layer + cryptdll_base: base address of cryptdll.dll inside of lsass.exe + """ + kernel = self.context.modules[self.config["kernel"]] + table_mapping = {"nt_symbols": kernel.symbol_table_name} + + cryptdll_symbol_table = intermed.IntermediateSymbolTable.create( + context=context, + config_path=config_path, + sub_path="windows", + filename="kerb_ecrypt", + table_mapping=table_mapping, + ) + + return context.module( + cryptdll_symbol_table, proc_layer_name, offset=cryptdll_base + ) + + def _find_lsass_proc( + self, proc_list: Iterable + ) -> Tuple[interfaces.context.ContextInterface, str]: + """ + Walks the process list and returns the first valid lsass instances. + There should be only one lsass process, but malware will often use the + process name to try and blend in. + + Args: + proc_list: The process list generator + + Return: + The process object for lsass + """ + + for proc in proc_list: + try: + proc_layer_name = proc.add_process_layer() + + return proc, proc_layer_name + + except exceptions.InvalidAddressException as excp: + vollog.debug( + f"Invalid address {excp.invalid_address} in layer {excp.layer_name}" + ) + + return None, None + + def _find_cryptdll( + self, lsass_proc: interfaces.context.ContextInterface + ) -> Tuple[int, int]: + """ + Finds the base address of cryptdll.dll inside of lsass.exe + + Args: + lsass_proc: the process object for lsass.exe + + Returns: + A tuple of: + cryptdll_base: the base address of cryptdll.dll + crytpdll_size: the size of the VAD for cryptdll.dll + """ + for vad in lsass_proc.get_vad_root().traverse(): + filename = vad.get_file_name() + + if isinstance(filename, str) and filename.lower().endswith("cryptdll.dll"): + base = vad.get_start() + return base, vad.get_size() + + return None, None + + def _find_csystems_with_symbols( + self, + proc_layer_name: str, + cryptdll_types: interfaces.context.ModuleInterface, + cryptdll_base: int, + cryptdll_size: int, + ) -> Tuple[interfaces.objects.ObjectInterface, int, int]: + """ + Attempts to find CSystems and the expected address of the handlers. + Relies on downloading and parsing of the cryptdll PDB file. + + Args: + proc_layer_name: the name of the lsass.exe process layer + cryptdll_types: The types from cryptdll binary analysis + cryptdll_base: the base address of cryptdll.dll + crytpdll_size: the size of the VAD for cryptdll.dll + + Returns: + A tuple of: + array: An initialized Volatility array of _KERB_ECRYPT structures + rc4HmacInitialize: The expected address of csystem Initialization function + rc4HmacDecrypt: The expected address of the csystem Decryption function + """ + try: + cryptdll_symbols = pdbutil.PDBUtility.symbol_table_from_pdb( + self.context, + interfaces.configuration.path_join(self.config_path, "cryptdll"), + proc_layer_name, + "cryptdll.pdb", + cryptdll_base, + cryptdll_size, + ) + except exceptions.VolatilityException: + vollog.debug( + "Unable to use the cryptdll PDB. Stopping PDB symbols based analysis." + ) + return None, None, None + + array, rc4HmacInitialize, rc4HmacDecrypt = self._find_array_with_pdb_symbols( + cryptdll_symbols, cryptdll_types, proc_layer_name, cryptdll_base + ) + + if array is None: + vollog.debug( + "The CSystem array is not present in memory. Stopping PDB symbols based analysis." + ) + + return array, rc4HmacInitialize, rc4HmacDecrypt + + def _get_rip_relative_target(self, inst) -> int: + """ + Returns the target address of a RIP-relative instruction. + + These instructions contain the offset of a target address + relative to the current instruction pointer. + + Args: + inst: A capstone instruction instance + + Returns: + None or the target address of the instruction + """ + try: + opnd = inst.operands[1] + except capstone.CsError: + return None + + if opnd.type != capstone.x86.X86_OP_MEM: + return None + + if inst.reg_name(opnd.mem.base) != "rip": + return None + + return inst.address + inst.size + opnd.mem.disp + + def _analyze_cdlocatecsystem( + self, + function_bytes: bytes, + function_start: int, + cryptdll_types: interfaces.context.ModuleInterface, + proc_layer_name: str, + ) -> Optional[interfaces.objects.ObjectInterface]: + """ + Performs static analysis on CDLocateCSystem to find the instructions that + reference CSystems as well as cCsystems + + Args: + function_bytes: the instruction bytes of CDLocateCSystem + function_start: the address of CDLocateCSystem + proc_layer_name: the name of the lsass.exe process layer + + Return: + The cSystems array of ecrypt instances + """ + found_count = False + array_start = None + count = None + + ## we only support 64bit disassembly analysis + md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64) + md.detail = True + + for inst in md.disasm(function_bytes, function_start): + # we should not reach debug traps + if inst.mnemonic == "int3": + break + + # cCsystems is referenced by a mov instruction + elif inst.mnemonic == "mov": + if not found_count: + target_address = self._get_rip_relative_target(inst) + + # we do not want to fail just because the count is not in memory + # 16 was the size on samples I tested, so I chose it as the default + count = 16 + + if target_address: + try: + count = int.from_bytes( + self.context.layers[proc_layer_name].read( + target_address, 4 + ), + "little", + ) + except exceptions.InvalidAddressException: + vollog.debug( + "Unable to read `cCsystems`. Defaulting to 16." + ) + + found_count = True + + elif inst.mnemonic == "lea": + target_address = self._get_rip_relative_target(inst) + + if target_address: + array_start = target_address + + # we find the count before, so we can terminate the static analysis here + break + + if array_start and count: + array = self._construct_ecrypt_array(array_start, count, cryptdll_types) + else: + array = None + + return array + + def _find_csystems_with_export( + self, + proc_layer_name: str, + cryptdll_types: interfaces.context.ModuleInterface, + cryptdll_base: int, + _, + ) -> Optional[interfaces.objects.ObjectInterface]: + """ + Uses export table analysis to locate CDLocateCsystem + This function references CSystems and cCsystems + + Args: + proc_layer_name: The lsass.exe process layer name + cryptdll_types: The types from cryptdll binary analysis + cryptdll_base: Base address of cryptdll.dll inside of lsass.exe + _: unused in this source + Returns: + The cSystems array + """ + + if not has_capstone: + vollog.debug( + "capstone is not installed so cannot fall back to export table analysis." + ) + return None + + vollog.debug( + "Unable to perform analysis using PDB symbols, falling back to export table analysis." + ) + + pe_table_name = intermed.IntermediateSymbolTable.create( + self.context, self.config_path, "windows", "pe", class_types=pe.class_types + ) + + cryptdll = pe_symbols.PESymbols.get_pefile_obj( + self.context, pe_table_name, proc_layer_name, cryptdll_base + ) + if not cryptdll: + return None + + cryptdll.parse_data_directories( + directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_EXPORT"]] + ) + if not hasattr(cryptdll, "DIRECTORY_ENTRY_EXPORT"): + return None + + # find the location of CDLocateCSystem and then perform static analysis + for export in cryptdll.DIRECTORY_ENTRY_EXPORT.symbols: + if export.name != b"CDLocateCSystem": + continue + + function_start = cryptdll_base + export.address + + try: + function_bytes = self.context.layers[proc_layer_name].read( + function_start, 0x50 + ) + except exceptions.InvalidAddressException: + vollog.debug( + "The CDLocateCSystem function is not present in the lsass address space. Stopping export based analysis." + ) + break + + array = self._analyze_cdlocatecsystem( + function_bytes, function_start, cryptdll_types, proc_layer_name + ) + if array is None: + vollog.debug( + "The CSystem array is not present in memory. Stopping export based analysis." + ) + + return array + + return None + + def _find_csystems_with_scanning( + self, + proc_layer_name: str, + cryptdll_types: interfaces.context.ModuleInterface, + cryptdll_base: int, + cryptdll_size: int, + ) -> List[interfaces.context.ModuleInterface]: + """ + Performs scanning to find potential RC4 HMAC csystem instances + + This function may return several values as it cannot validate which is the active one + + Args: + proc_layer_name: the lsass.exe process layer name + cryptdll_types: the types from cryptdll binary analysis + cryptdll_base: base address of cryptdll.dll inside of lsass.exe + cryptdll_size: size of the VAD + Returns: + A list of csystem instances + """ + + csystems = [] + + cryptdll_end = cryptdll_base + cryptdll_size + + proc_layer = self.context.layers[proc_layer_name] + + ecrypt_size = cryptdll_types.get_type("_KERB_ECRYPT").size + + # scan for potential instances of RC4 HMAC + # the signature is based on the type being 0x17 + # and the block size member being 1 in all test samples + for address in proc_layer.scan( + self.context, + scanners.BytesScanner(b"\x17\x00\x00\x00\x01\x00\x00\x00"), + sections=[(cryptdll_base, cryptdll_size)], + ): + # this occurs across page boundaries + if not proc_layer.is_valid(address, ecrypt_size): + continue + + kerb = cryptdll_types.object("_KERB_ECRYPT", offset=address, absolute=True) + + # ensure the Encrypt and Finish pointers are inside the VAD + # these are not manipulated in the attack + if (cryptdll_base < kerb.Encrypt < cryptdll_end) and ( + cryptdll_base < kerb.Finish < cryptdll_end + ): + csystems.append(kerb) + + return csystems + + def _generator(self, procs): + """ + Finds instances of the RC4 HMAC CSystem structure + + Returns whether the instances are hooked as well as the function handler addresses + + Args: + procs: the process list filtered to lsass.exe instances + """ + kernel = self.context.modules[self.config["kernel"]] + + if not symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=kernel.symbol_table_name + ): + vollog.info("This plugin only supports 64bit Windows memory samples") + return None + + lsass_proc, proc_layer_name = self._find_lsass_proc(procs) + if not lsass_proc: + vollog.info( + "Unable to find a valid lsass.exe process in the process list. This should never happen. Analysis cannot proceed." + ) + return None + + cryptdll_base, cryptdll_size = self._find_cryptdll(lsass_proc) + if not cryptdll_base: + vollog.info( + "Unable to find the location of cryptdll.dll inside of lsass.exe. Analysis cannot proceed." + ) + return None + + # the custom type information from binary analysis + cryptdll_types = self._get_cryptdll_types( + self.context, self.config, self.config_path, proc_layer_name, cryptdll_base + ) + + # attempt to find the array and symbols directly from the PDB + csystems, rc4HmacInitialize, rc4HmacDecrypt = self._find_csystems_with_symbols( + proc_layer_name, cryptdll_types, cryptdll_base, cryptdll_size + ) + + # if we can't find cSystems through the PDB then + # we fall back to export analysis and scanning + # we keep the address of the rc4 functions from the PDB + # though as its our only source to get them + if csystems is None: + fallback_sources = [ + self._find_csystems_with_export, + self._find_csystems_with_scanning, + ] + + for source in fallback_sources: + csystems = source( + proc_layer_name, cryptdll_types, cryptdll_base, cryptdll_size + ) + + if csystems is not None: + break + + if csystems is None: + vollog.info( + "Unable to find CSystems inside of cryptdll.dll. Analysis cannot proceed." + ) + return None + + for csystem in csystems: + if not self.context.layers[proc_layer_name].is_valid( + csystem.vol.offset, csystem.vol.size + ): + continue + + # filter for RC4 HMAC + if csystem.EncryptionType != 0x17: + continue + + # use the specific symbols if present, otherwise use the vad start and size + if rc4HmacInitialize and rc4HmacDecrypt: + skeleton_key_present = self._check_for_skeleton_key_symbols( + csystem, rc4HmacInitialize, rc4HmacDecrypt + ) + else: + skeleton_key_present = self._check_for_skeleton_key_vad( + csystem, cryptdll_base, cryptdll_size + ) + + yield 0, ( + lsass_proc.UniqueProcessId, + "lsass.exe", + skeleton_key_present, + format_hints.Hex(csystem.Initialize), + format_hints.Hex(csystem.Decrypt), + ) + + def _lsass_proc_filter(self, proc): + """ + Used to filter to only lsass.exe processes + + There should only be one of these, but malware can/does make lsass.exe + named processes to blend in or uses lsass.exe as a process hollowing target + """ + process_name = utility.array_to_string(proc.ImageFileName) + + return process_name != "lsass.exe" + + def run(self): + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Skeleton Key Found", bool), + ("rc4HmacInitialize", format_hints.Hex), + ("rc4HmacDecrypt", format_hints.Hex), + ], + self._generator( + pslist.PsList.list_processes( + context=self.context, + kernel_module_name=self.config["kernel"], + filter_func=self._lsass_proc_filter, + ) + ), + ) diff --git a/volatility3/framework/plugins/windows/skeleton_key_check.py b/volatility3/framework/plugins/windows/skeleton_key_check.py index 6071a2a39..86c5cf1df 100644 --- a/volatility3/framework/plugins/windows/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/skeleton_key_check.py @@ -1,685 +1,20 @@ -# This file is Copyright 2021 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - -# This module attempts to locate skeleton-key like function hooks. -# It does this by locating the CSystems array through a variety of methods, -# and then validating the entry for RC4 HMAC (0x17 / 23) -# -# For a thorough walkthrough on how the R&D was performed to develop this plugin, -# please see our blogpost here: -# -# https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html - import logging -from typing import Iterable, Tuple, List, Optional - -import pefile - -from volatility3.framework import interfaces, symbols, exceptions -from volatility3.framework import renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.layers import scanners -from volatility3.framework.objects import utility -from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols import intermed -from volatility3.framework.symbols.windows import pdbutil -from volatility3.framework.symbols.windows.extensions import pe -from volatility3.plugins.windows import pslist, vadinfo, pe_symbols - -try: - import capstone - - has_capstone = True -except ImportError: - has_capstone = False +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import skeleton_key_check vollog = logging.getLogger(__name__) -class Skeleton_Key_Check(interfaces.plugins.PluginInterface): +class Skeleton_Key_Check( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=skeleton_key_check.Skeleton_Key_Check, + removal_date="2026-06-07", +): """Looks for signs of Skeleton Key malware""" _required_framework_version = (2, 4, 0) - - @classmethod - def get_requirements(cls): - # Since we're calling the plugin, make sure we have the plugin's requirements - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) - ), - requirements.VersionRequirement( - name="pdbutil", component=pdbutil.PDBUtility, version=(1, 0, 0) - ), - requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="bytes_scanner", - component=scanners.BytesScanner, - version=(1, 0, 0), - ), - ] - - def _check_for_skeleton_key_vad( - self, - csystem: interfaces.objects.ObjectInterface, - cryptdll_base: int, - cryptdll_size: int, - ) -> bool: - """ - Checks if Initialize and/or Decrypt is hooked by determining if - these function pointers reference addresses inside of the cryptdll VAD - - Args: - csystem: The RC4HMAC KERB_ECRYPT instance - cryptdll_base: Base address of the cryptdll.dll VAD - cryptdll_size: Size of the VAD - Returns: - bool: if a skeleton key hook is present - """ - return not ( - (cryptdll_base <= csystem.Initialize <= cryptdll_base + cryptdll_size) - and (cryptdll_base <= csystem.Decrypt <= cryptdll_base + cryptdll_size) - ) - - def _check_for_skeleton_key_symbols( - self, - csystem: interfaces.objects.ObjectInterface, - rc4HmacInitialize: int, - rc4HmacDecrypt: int, - ) -> bool: - """ - Uses the PDB information to specifically check if the csystem for RC4HMAC - has an initialization pointer to rc4HmacInitialize and a decryption pointer - to rc4HmacDecrypt. - - Args: - csystem: The RC4HMAC KERB_ECRYPT instance - rc4HmacInitialize: The expected address of csystem Initialization function - rc4HmacDecrypt: The expected address of the csystem Decryption function - - Returns: - bool: if a skeleton key hook was found - """ - return ( - csystem.Initialize != rc4HmacInitialize or csystem.Decrypt != rc4HmacDecrypt - ) - - def _construct_ecrypt_array( - self, - array_start: int, - count: int, - cryptdll_types: interfaces.context.ModuleInterface, - ) -> interfaces.context.ModuleInterface: - """ - Attempts to construct an array of _KERB_ECRYPT structures - - Args: - array_start: starting virtual address of the array - count: how many elements are in the array - cryptdll_types: the reverse engineered types - - Returns: - The instantiated array - """ - - try: - array = cryptdll_types.object( - object_type="array", - offset=array_start, - subtype=cryptdll_types.get_type("_KERB_ECRYPT"), - count=count, - absolute=True, - ) - - except exceptions.InvalidAddressException: - vollog.debug( - f"Unable to construct cSystems array at given offset: {array_start:x}" - ) - array = None - - return array - - def _find_array_with_pdb_symbols( - self, - cryptdll_symbols: str, - cryptdll_types: interfaces.context.ModuleInterface, - proc_layer_name: str, - cryptdll_base: int, - ) -> Tuple[interfaces.objects.ObjectInterface, int, int, int]: - """ - Finds the CSystems array through use of PDB symbols - - Args: - cryptdll_symbols: The symbols table from the PDB file - cryptdll_types: The types from cryptdll binary analysis - proc_layer_name: The lsass.exe process layer name - cryptdll_base: Base address of cryptdll.dll inside of lsass.exe - - Returns: - Tuple of: - array: The cSystems array - rc4HmacInitialize: The runtime address of the expected initialization function - rc4HmacDecrypt: The runtime address of the expected decryption function - """ - cryptdll_module = self.context.module( - cryptdll_symbols, layer_name=proc_layer_name, offset=cryptdll_base - ) - - rc4HmacInitialize = cryptdll_module.get_absolute_symbol_address( - "rc4HmacInitialize" - ) - - rc4HmacDecrypt = cryptdll_module.get_absolute_symbol_address("rc4HmacDecrypt") - - count_address = cryptdll_module.get_symbol("cCSystems").address - - # we do not want to fail just because the count is not in memory - # 16 was the size on samples I tested, so I chose it as the default - try: - count = cryptdll_types.object( - object_type="unsigned long", offset=count_address - ) - except exceptions.InvalidAddressException: - count = 16 - - array_start = cryptdll_module.get_absolute_symbol_address("CSystems") - - array = self._construct_ecrypt_array(array_start, count, cryptdll_types) - - if array is None: - vollog.debug( - "The CSystem array is not present in memory. Stopping PDB based analysis." - ) - - return array, rc4HmacInitialize, rc4HmacDecrypt - - def _get_cryptdll_types( - self, - context: interfaces.context.ContextInterface, - config, - config_path: str, - proc_layer_name: str, - cryptdll_base: int, - ): - """ - Builds a symbol table from the cryptdll types generated after binary analysis - - Args: - context: the context to operate upon - config: - config_path: - proc_layer_name: name of the lsass.exe process layer - cryptdll_base: base address of cryptdll.dll inside of lsass.exe - """ - kernel = self.context.modules[self.config["kernel"]] - table_mapping = {"nt_symbols": kernel.symbol_table_name} - - cryptdll_symbol_table = intermed.IntermediateSymbolTable.create( - context=context, - config_path=config_path, - sub_path="windows", - filename="kerb_ecrypt", - table_mapping=table_mapping, - ) - - return context.module( - cryptdll_symbol_table, proc_layer_name, offset=cryptdll_base - ) - - def _find_lsass_proc( - self, proc_list: Iterable - ) -> Tuple[interfaces.context.ContextInterface, str]: - """ - Walks the process list and returns the first valid lsass instances. - There should be only one lsass process, but malware will often use the - process name to try and blend in. - - Args: - proc_list: The process list generator - - Return: - The process object for lsass - """ - - for proc in proc_list: - try: - proc_layer_name = proc.add_process_layer() - - return proc, proc_layer_name - - except exceptions.InvalidAddressException as excp: - vollog.debug( - f"Invalid address {excp.invalid_address} in layer {excp.layer_name}" - ) - - return None, None - - def _find_cryptdll( - self, lsass_proc: interfaces.context.ContextInterface - ) -> Tuple[int, int]: - """ - Finds the base address of cryptdll.dll inside of lsass.exe - - Args: - lsass_proc: the process object for lsass.exe - - Returns: - A tuple of: - cryptdll_base: the base address of cryptdll.dll - crytpdll_size: the size of the VAD for cryptdll.dll - """ - for vad in lsass_proc.get_vad_root().traverse(): - filename = vad.get_file_name() - - if isinstance(filename, str) and filename.lower().endswith("cryptdll.dll"): - base = vad.get_start() - return base, vad.get_size() - - return None, None - - def _find_csystems_with_symbols( - self, - proc_layer_name: str, - cryptdll_types: interfaces.context.ModuleInterface, - cryptdll_base: int, - cryptdll_size: int, - ) -> Tuple[interfaces.objects.ObjectInterface, int, int]: - """ - Attempts to find CSystems and the expected address of the handlers. - Relies on downloading and parsing of the cryptdll PDB file. - - Args: - proc_layer_name: the name of the lsass.exe process layer - cryptdll_types: The types from cryptdll binary analysis - cryptdll_base: the base address of cryptdll.dll - crytpdll_size: the size of the VAD for cryptdll.dll - - Returns: - A tuple of: - array: An initialized Volatility array of _KERB_ECRYPT structures - rc4HmacInitialize: The expected address of csystem Initialization function - rc4HmacDecrypt: The expected address of the csystem Decryption function - """ - try: - cryptdll_symbols = pdbutil.PDBUtility.symbol_table_from_pdb( - self.context, - interfaces.configuration.path_join(self.config_path, "cryptdll"), - proc_layer_name, - "cryptdll.pdb", - cryptdll_base, - cryptdll_size, - ) - except exceptions.VolatilityException: - vollog.debug( - "Unable to use the cryptdll PDB. Stopping PDB symbols based analysis." - ) - return None, None, None - - array, rc4HmacInitialize, rc4HmacDecrypt = self._find_array_with_pdb_symbols( - cryptdll_symbols, cryptdll_types, proc_layer_name, cryptdll_base - ) - - if array is None: - vollog.debug( - "The CSystem array is not present in memory. Stopping PDB symbols based analysis." - ) - - return array, rc4HmacInitialize, rc4HmacDecrypt - - def _get_rip_relative_target(self, inst) -> int: - """ - Returns the target address of a RIP-relative instruction. - - These instructions contain the offset of a target address - relative to the current instruction pointer. - - Args: - inst: A capstone instruction instance - - Returns: - None or the target address of the instruction - """ - try: - opnd = inst.operands[1] - except capstone.CsError: - return None - - if opnd.type != capstone.x86.X86_OP_MEM: - return None - - if inst.reg_name(opnd.mem.base) != "rip": - return None - - return inst.address + inst.size + opnd.mem.disp - - def _analyze_cdlocatecsystem( - self, - function_bytes: bytes, - function_start: int, - cryptdll_types: interfaces.context.ModuleInterface, - proc_layer_name: str, - ) -> Optional[interfaces.objects.ObjectInterface]: - """ - Performs static analysis on CDLocateCSystem to find the instructions that - reference CSystems as well as cCsystems - - Args: - function_bytes: the instruction bytes of CDLocateCSystem - function_start: the address of CDLocateCSystem - proc_layer_name: the name of the lsass.exe process layer - - Return: - The cSystems array of ecrypt instances - """ - found_count = False - array_start = None - count = None - - ## we only support 64bit disassembly analysis - md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64) - md.detail = True - - for inst in md.disasm(function_bytes, function_start): - # we should not reach debug traps - if inst.mnemonic == "int3": - break - - # cCsystems is referenced by a mov instruction - elif inst.mnemonic == "mov": - if not found_count: - target_address = self._get_rip_relative_target(inst) - - # we do not want to fail just because the count is not in memory - # 16 was the size on samples I tested, so I chose it as the default - count = 16 - - if target_address: - try: - count = int.from_bytes( - self.context.layers[proc_layer_name].read( - target_address, 4 - ), - "little", - ) - except exceptions.InvalidAddressException: - vollog.debug( - "Unable to read `cCsystems`. Defaulting to 16." - ) - - found_count = True - - elif inst.mnemonic == "lea": - target_address = self._get_rip_relative_target(inst) - - if target_address: - array_start = target_address - - # we find the count before, so we can terminate the static analysis here - break - - if array_start and count: - array = self._construct_ecrypt_array(array_start, count, cryptdll_types) - else: - array = None - - return array - - def _find_csystems_with_export( - self, - proc_layer_name: str, - cryptdll_types: interfaces.context.ModuleInterface, - cryptdll_base: int, - _, - ) -> Optional[interfaces.objects.ObjectInterface]: - """ - Uses export table analysis to locate CDLocateCsystem - This function references CSystems and cCsystems - - Args: - proc_layer_name: The lsass.exe process layer name - cryptdll_types: The types from cryptdll binary analysis - cryptdll_base: Base address of cryptdll.dll inside of lsass.exe - _: unused in this source - Returns: - The cSystems array - """ - - if not has_capstone: - vollog.debug( - "capstone is not installed so cannot fall back to export table analysis." - ) - return None - - vollog.debug( - "Unable to perform analysis using PDB symbols, falling back to export table analysis." - ) - - pe_table_name = intermed.IntermediateSymbolTable.create( - self.context, self.config_path, "windows", "pe", class_types=pe.class_types - ) - - cryptdll = pe_symbols.PESymbols.get_pefile_obj( - self.context, pe_table_name, proc_layer_name, cryptdll_base - ) - if not cryptdll: - return None - - cryptdll.parse_data_directories( - directories=[pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_EXPORT"]] - ) - if not hasattr(cryptdll, "DIRECTORY_ENTRY_EXPORT"): - return None - - # find the location of CDLocateCSystem and then perform static analysis - for export in cryptdll.DIRECTORY_ENTRY_EXPORT.symbols: - if export.name != b"CDLocateCSystem": - continue - - function_start = cryptdll_base + export.address - - try: - function_bytes = self.context.layers[proc_layer_name].read( - function_start, 0x50 - ) - except exceptions.InvalidAddressException: - vollog.debug( - "The CDLocateCSystem function is not present in the lsass address space. Stopping export based analysis." - ) - break - - array = self._analyze_cdlocatecsystem( - function_bytes, function_start, cryptdll_types, proc_layer_name - ) - if array is None: - vollog.debug( - "The CSystem array is not present in memory. Stopping export based analysis." - ) - - return array - - return None - - def _find_csystems_with_scanning( - self, - proc_layer_name: str, - cryptdll_types: interfaces.context.ModuleInterface, - cryptdll_base: int, - cryptdll_size: int, - ) -> List[interfaces.context.ModuleInterface]: - """ - Performs scanning to find potential RC4 HMAC csystem instances - - This function may return several values as it cannot validate which is the active one - - Args: - proc_layer_name: the lsass.exe process layer name - cryptdll_types: the types from cryptdll binary analysis - cryptdll_base: base address of cryptdll.dll inside of lsass.exe - cryptdll_size: size of the VAD - Returns: - A list of csystem instances - """ - - csystems = [] - - cryptdll_end = cryptdll_base + cryptdll_size - - proc_layer = self.context.layers[proc_layer_name] - - ecrypt_size = cryptdll_types.get_type("_KERB_ECRYPT").size - - # scan for potential instances of RC4 HMAC - # the signature is based on the type being 0x17 - # and the block size member being 1 in all test samples - for address in proc_layer.scan( - self.context, - scanners.BytesScanner(b"\x17\x00\x00\x00\x01\x00\x00\x00"), - sections=[(cryptdll_base, cryptdll_size)], - ): - # this occurs across page boundaries - if not proc_layer.is_valid(address, ecrypt_size): - continue - - kerb = cryptdll_types.object("_KERB_ECRYPT", offset=address, absolute=True) - - # ensure the Encrypt and Finish pointers are inside the VAD - # these are not manipulated in the attack - if (cryptdll_base < kerb.Encrypt < cryptdll_end) and ( - cryptdll_base < kerb.Finish < cryptdll_end - ): - csystems.append(kerb) - - return csystems - - def _generator(self, procs): - """ - Finds instances of the RC4 HMAC CSystem structure - - Returns whether the instances are hooked as well as the function handler addresses - - Args: - procs: the process list filtered to lsass.exe instances - """ - kernel = self.context.modules[self.config["kernel"]] - - if not symbols.symbol_table_is_64bit( - context=self.context, symbol_table_name=kernel.symbol_table_name - ): - vollog.info("This plugin only supports 64bit Windows memory samples") - return None - - lsass_proc, proc_layer_name = self._find_lsass_proc(procs) - if not lsass_proc: - vollog.info( - "Unable to find a valid lsass.exe process in the process list. This should never happen. Analysis cannot proceed." - ) - return None - - cryptdll_base, cryptdll_size = self._find_cryptdll(lsass_proc) - if not cryptdll_base: - vollog.info( - "Unable to find the location of cryptdll.dll inside of lsass.exe. Analysis cannot proceed." - ) - return None - - # the custom type information from binary analysis - cryptdll_types = self._get_cryptdll_types( - self.context, self.config, self.config_path, proc_layer_name, cryptdll_base - ) - - # attempt to find the array and symbols directly from the PDB - csystems, rc4HmacInitialize, rc4HmacDecrypt = self._find_csystems_with_symbols( - proc_layer_name, cryptdll_types, cryptdll_base, cryptdll_size - ) - - # if we can't find cSystems through the PDB then - # we fall back to export analysis and scanning - # we keep the address of the rc4 functions from the PDB - # though as its our only source to get them - if csystems is None: - fallback_sources = [ - self._find_csystems_with_export, - self._find_csystems_with_scanning, - ] - - for source in fallback_sources: - csystems = source( - proc_layer_name, cryptdll_types, cryptdll_base, cryptdll_size - ) - - if csystems is not None: - break - - if csystems is None: - vollog.info( - "Unable to find CSystems inside of cryptdll.dll. Analysis cannot proceed." - ) - return None - - for csystem in csystems: - if not self.context.layers[proc_layer_name].is_valid( - csystem.vol.offset, csystem.vol.size - ): - continue - - # filter for RC4 HMAC - if csystem.EncryptionType != 0x17: - continue - - # use the specific symbols if present, otherwise use the vad start and size - if rc4HmacInitialize and rc4HmacDecrypt: - skeleton_key_present = self._check_for_skeleton_key_symbols( - csystem, rc4HmacInitialize, rc4HmacDecrypt - ) - else: - skeleton_key_present = self._check_for_skeleton_key_vad( - csystem, cryptdll_base, cryptdll_size - ) - - yield 0, ( - lsass_proc.UniqueProcessId, - "lsass.exe", - skeleton_key_present, - format_hints.Hex(csystem.Initialize), - format_hints.Hex(csystem.Decrypt), - ) - - def _lsass_proc_filter(self, proc): - """ - Used to filter to only lsass.exe processes - - There should only be one of these, but malware can/does make lsass.exe - named processes to blend in or uses lsass.exe as a process hollowing target - """ - process_name = utility.array_to_string(proc.ImageFileName) - - return process_name != "lsass.exe" - - def run(self): - return renderers.TreeGrid( - [ - ("PID", int), - ("Process", str), - ("Skeleton Key Found", bool), - ("rc4HmacInitialize", format_hints.Hex), - ("rc4HmacDecrypt", format_hints.Hex), - ], - self._generator( - pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config["kernel"], - filter_func=self._lsass_proc_filter, - ) - ), - ) + _version = (1, 0, 0) From 93defa112c707b1155e53f18362c3afc77f3861c Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 16:29:30 +0300 Subject: [PATCH 1142/1352] Plugins: categorize windows.svcdiff as a malware plugin --- .../plugins/windows/malware/svcdiff.py | 102 ++++++++++++++++++ .../framework/plugins/windows/svcdiff.py | 101 ++--------------- 2 files changed, 112 insertions(+), 91 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/svcdiff.py diff --git a/volatility3/framework/plugins/windows/malware/svcdiff.py b/volatility3/framework/plugins/windows/malware/svcdiff.py new file mode 100644 index 000000000..78b61eb67 --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/svcdiff.py @@ -0,0 +1,102 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +# This module compares services found through list walking versus scanning, +# with the aim of finding hidden services. +# +# For background of hidden services and a real-world example of the use of this plugin, +# please see our blogpost: +# +# https://volatilityfoundation.org/memory-forensics-rd-illustrated-detecting-hidden-windows-services/ + +import logging + +from volatility3.framework import symbols, interfaces +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import svclist, svcscan +from volatility3.framework.symbols.windows import versions + +vollog = logging.getLogger(__name__) + + +class SvcDiff(svcscan.SvcScan): + """Compares services found through list walking versus scanning to find rootkits""" + + _required_framework_version = (2, 4, 0) + + _version = (2, 0, 0) + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self._enumeration_method = self.service_diff + + @classmethod + def get_requirements(cls): + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="svclist", component=svclist.SvcList, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="svcscan", component=svcscan.SvcScan, version=(4, 0, 0) + ), + ] + + @classmethod + def service_diff( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + service_table_name: str, + service_binary_dll_map, + filter_func, + ): + """ + On Windows 10 version 15063+ 64bit Windows memory samples, walk the services list + and scan for services then report differences + """ + kernel = context.modules[kernel_module_name] + + if not symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) or not versions.is_win10_15063_or_later( + context=context, symbol_table=kernel.symbol_table_name + ): + vollog.warning( + "This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples" + ) + return + + from_scan = set() + from_list = set() + records = {} + + # collect unique service names from scanning + for service in svcscan.SvcScan.service_scan( + context, + kernel_module_name, + service_table_name, + service_binary_dll_map, + filter_func, + ): + from_scan.add(service[6]) + records[service[6]] = service + + # collect services from listing walking + for service in svclist.SvcList.service_list( + context, + kernel_module_name, + service_table_name, + service_binary_dll_map, + filter_func, + ): + from_list.add(service[6]) + + # report services found from scanning but not list walking + for hidden_service in from_scan - from_list: + yield records[hidden_service] diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py index 78b61eb67..c95a9e62d 100644 --- a/volatility3/framework/plugins/windows/svcdiff.py +++ b/volatility3/framework/plugins/windows/svcdiff.py @@ -1,102 +1,21 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -# This module compares services found through list walking versus scanning, -# with the aim of finding hidden services. -# -# For background of hidden services and a real-world example of the use of this plugin, -# please see our blogpost: -# -# https://volatilityfoundation.org/memory-forensics-rd-illustrated-detecting-hidden-windows-services/ - import logging - -from volatility3.framework import symbols, interfaces -from volatility3.framework.configuration import requirements -from volatility3.plugins.windows import svclist, svcscan -from volatility3.framework.symbols.windows import versions +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import svcdiff vollog = logging.getLogger(__name__) -class SvcDiff(svcscan.SvcScan): - """Compares services found through list walking versus scanning to find rootkits""" +class SvcDiff( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=svcdiff.SvcDiff, + removal_date="2026-06-07", +): + """Compares services found through list walking versus scanning to find rootkits (deprecated).""" _required_framework_version = (2, 4, 0) _version = (2, 0, 0) - - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - self._enumeration_method = self.service_diff - - @classmethod - def get_requirements(cls): - # Since we're calling the plugin, make sure we have the plugin's requirements - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="svclist", component=svclist.SvcList, version=(2, 0, 0) - ), - requirements.VersionRequirement( - name="svcscan", component=svcscan.SvcScan, version=(4, 0, 0) - ), - ] - - @classmethod - def service_diff( - cls, - context: interfaces.context.ContextInterface, - kernel_module_name: str, - service_table_name: str, - service_binary_dll_map, - filter_func, - ): - """ - On Windows 10 version 15063+ 64bit Windows memory samples, walk the services list - and scan for services then report differences - """ - kernel = context.modules[kernel_module_name] - - if not symbols.symbol_table_is_64bit( - context=context, symbol_table_name=kernel.symbol_table_name - ) or not versions.is_win10_15063_or_later( - context=context, symbol_table=kernel.symbol_table_name - ): - vollog.warning( - "This plugin only supports Windows 10 version 15063+ 64bit Windows memory samples" - ) - return - - from_scan = set() - from_list = set() - records = {} - - # collect unique service names from scanning - for service in svcscan.SvcScan.service_scan( - context, - kernel_module_name, - service_table_name, - service_binary_dll_map, - filter_func, - ): - from_scan.add(service[6]) - records[service[6]] = service - - # collect services from listing walking - for service in svclist.SvcList.service_list( - context, - kernel_module_name, - service_table_name, - service_binary_dll_map, - filter_func, - ): - from_list.add(service[6]) - - # report services found from scanning but not list walking - for hidden_service in from_scan - from_list: - yield records[hidden_service] From d4644208a972d8a10b4532c4b0a8a16e5e33e11c Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 17:32:54 +0300 Subject: [PATCH 1143/1352] Plugins: fix svcdiff deprecation wrapper --- volatility3/framework/plugins/windows/svcdiff.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py index c95a9e62d..bafdf34da 100644 --- a/volatility3/framework/plugins/windows/svcdiff.py +++ b/volatility3/framework/plugins/windows/svcdiff.py @@ -4,18 +4,21 @@ import logging from volatility3.framework import interfaces, deprecation from volatility3.plugins.windows.malware import svcdiff +from volatility3.plugins.windows import svcscan vollog = logging.getLogger(__name__) class SvcDiff( - interfaces.plugins.PluginInterface, + svcscan.SvcScan, deprecation.PluginRenameClass, replacement_class=svcdiff.SvcDiff, removal_date="2026-06-07", ): """Compares services found through list walking versus scanning to find rootkits (deprecated).""" - + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + self._enumeration_method = self.service_diff _required_framework_version = (2, 4, 0) _version = (2, 0, 0) From 6537086e62d65f85fcbc3359432237af7278706c Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 17:33:09 +0300 Subject: [PATCH 1144/1352] black --- volatility3/framework/plugins/windows/svcdiff.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py index bafdf34da..6e4bc30e0 100644 --- a/volatility3/framework/plugins/windows/svcdiff.py +++ b/volatility3/framework/plugins/windows/svcdiff.py @@ -16,9 +16,11 @@ class SvcDiff( removal_date="2026-06-07", ): """Compares services found through list walking versus scanning to find rootkits (deprecated).""" + def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self._enumeration_method = self.service_diff + _required_framework_version = (2, 4, 0) _version = (2, 0, 0) From 45934ae0fd13a88ff03b2325e57424ac56b9eb1d Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 17:40:02 +0300 Subject: [PATCH 1145/1352] removed import for ruff --- volatility3/framework/plugins/windows/svcdiff.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/svcdiff.py b/volatility3/framework/plugins/windows/svcdiff.py index 6e4bc30e0..24bc53e49 100644 --- a/volatility3/framework/plugins/windows/svcdiff.py +++ b/volatility3/framework/plugins/windows/svcdiff.py @@ -2,7 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation +from volatility3.framework import deprecation from volatility3.plugins.windows.malware import svcdiff from volatility3.plugins.windows import svcscan From 66473ac644a89e685f050463f44e04f3a7eb07ab Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 18:00:36 +0300 Subject: [PATCH 1146/1352] categorize windows.unhooked_system_calls as a malware plugin --- .../windows/malware/unhooked_system_calls.py | 202 +++++++++++++++++ .../plugins/windows/unhooked_system_calls.py | 204 +----------------- 2 files changed, 213 insertions(+), 193 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/unhooked_system_calls.py diff --git a/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py b/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py new file mode 100644 index 000000000..5723ce0fd --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py @@ -0,0 +1,202 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 + +# Full details on the techniques used in these plugins to detect EDR-evading malware +# can be found in our 20 page whitepaper submitted to DEFCON along with the presentation +# https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf + +import logging + +from typing import Dict, Tuple, List, Generator + +from volatility3.framework import interfaces, exceptions +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.plugins.windows import pslist, pe_symbols + +vollog = logging.getLogger(__name__) + + +class unhooked_system_calls(interfaces.plugins.PluginInterface): + """Detects hooked ntdll.dll stub functions in Windows processes.""" + + _required_framework_version = (2, 4, 0) + _version = (2, 0, 0) + + system_calls = { + "ntdll.dll": { + pe_symbols.wanted_names_identifier: [ + "NtCreateThread", + "NtProtectVirtualMemory", + "NtReadVirtualMemory", + "NtOpenProcess", + "NtWriteFile", + "NtQueryVirtualMemory", + "NtAllocateVirtualMemory", + "NtWorkerFactoryWorkerReady", + "NtAcceptConnectPort", + "NtAddDriverEntry", + "NtAdjustPrivilegesToken", + "NtAlpcCreatePort", + "NtClose", + "NtCreateFile", + "NtCreateMutant", + "NtOpenFile", + "NtOpenIoCompletion", + "NtOpenJobObject", + "NtOpenKey", + "NtOpenKeyEx", + "NtOpenThread", + "NtOpenThreadToken", + "NtOpenThreadTokenEx", + "NtWriteVirtualMemory", + "NtTraceEvent", + "NtTranslateFilePath", + "NtUmsThreadYield", + "NtUnloadDriver", + "NtUnloadKey", + "NtUnloadKey2", + "NtUnloadKeyEx", + "NtCreateKey", + "NtCreateSection", + "NtDeleteKey", + "NtDeleteValueKey", + "NtDuplicateObject", + "NtQueryValueKey", + "NtReplaceKey", + "NtRequestWaitReplyPort", + "NtRestoreKey", + "NtSetContextThread", + "NtSetSecurityObject", + "NtSetValueKey", + "NtSystemDebugControl", + "NtTerminateProcess", + ] + } + } + + # This data structure is used to track unique implementations of functions across processes + # The outer dictionary holds the module name (e.g., ntdll.dll) + # The next dictionary holds the function names (NtTerminateProcess, NtSetValueKey, etc.) inside a module + # The innermost dictionary holds the unique implementation (bytes) of a function across processes + # Each implementation is tracked along with the process(es) that host it + # For systems without malware, all functions should have the same implementation + # When API hooking/module unhooking is done, the victim (infected) processes will have unique implementations + _code_bytes_type = Dict[str, Dict[str, Dict[bytes, List[Tuple[int, str]]]]] + + @classmethod + def get_requirements(cls) -> List: + # Since we're calling the plugin, make sure we have the plugin's requirements + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) + ), + ] + + def _gather_code_bytes( + self, + kernel_module_name: str, + found_symbols: pe_symbols.found_symbols_type, + ) -> _code_bytes_type: + """ + Enumerates the desired DLLs and function implementations in each process + Groups based on unique implementations of each DLLs' functions + The purpose is to detect when a function has different implementations (code) + in different processes. + This very effectively detects code injection. + """ + code_bytes: unhooked_system_calls._code_bytes_type = {} + + procs = pslist.PsList.list_processes(self.context, kernel_module_name) + + for proc in procs: + try: + proc_id = proc.UniqueProcessId + proc_name = utility.array_to_string(proc.ImageFileName) + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue + + for dll_name, functions in found_symbols.items(): + for func_name, func_addr in functions: + try: + fbytes = self.context.layers[proc_layer_name].read( + func_addr, 0x20 + ) + except exceptions.InvalidAddressException: + continue + + # see the definition of _code_bytes_type for details of this data structure + if dll_name not in code_bytes: + code_bytes[dll_name] = {} + + if func_name not in code_bytes[dll_name]: + code_bytes[dll_name][func_name] = {} + + if fbytes not in code_bytes[dll_name][func_name]: + code_bytes[dll_name][func_name][fbytes] = [] + + code_bytes[dll_name][func_name][fbytes].append((proc_id, proc_name)) + + return code_bytes + + def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]: + found_symbols = pe_symbols.PESymbols.addresses_for_process_symbols( + context=self.context, + config_path=self.config_path, + kernel_module_name=self.config["kernel"], + symbols=unhooked_system_calls.system_calls, + ) + + # code_bytes[dll_name][func_name][func_bytes] + code_bytes = self._gather_code_bytes(self.config["kernel"], found_symbols) + + # walk the functions that were evaluated + for functions in code_bytes.values(): + # cbb is the distinct groups of bytes (instructions) + # for this function across processes + for func_name, cbb in functions.items(): + # the dict key here is the raw instructions, which is not helpful to look at + # the values are the list of tuples for the (proc_id, proc_name) pairs for this set of bytes (instructions) + cb = list(cbb.values()) + + # if all processes map to the same implementation, then no malware is present + if len(cb) == 1: + yield 0, (func_name, "", len(cb[0])) + else: + # if there are differing implementations then it means + # that malware has overwritten system call(s) in infected processes + # max_idx and small_idx find which implementation of a system call has the least processes + # as all observed malware and open source projects only infected a few targets, leaving the + # rest with the original EDR hooks in place + max_idx = 0 if len(cb[0]) > len(cb[1]) else 1 + small_idx = (~max_idx) & 1 + + ps = [] + + # gather processes on small_idx since these are the malware infected ones + for pid, pname in cb[small_idx]: + ps.append(f"{pid:d}:{pname}") + + proc_names = ", ".join(ps) + + yield 0, (func_name, proc_names, len(cb[max_idx])) + + def run(self) -> renderers.TreeGrid: + return renderers.TreeGrid( + [ + ("Function", str), + ("Distinct Implementations", str), + ("Total Implementations", int), + ], + self._generator(), + ) diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index 3ff0aa158..0c42415b6 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -1,202 +1,20 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 - -# Full details on the techniques used in these plugins to detect EDR-evading malware -# can be found in our 20 page whitepaper submitted to DEFCON along with the presentation -# https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf - +# import logging - -from typing import Dict, Tuple, List, Generator - -from volatility3.framework import interfaces, exceptions -from volatility3.framework import renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.objects import utility -from volatility3.plugins.windows import pslist, pe_symbols +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import unhooked_system_calls vollog = logging.getLogger(__name__) -class unhooked_system_calls(interfaces.plugins.PluginInterface): - """Looks for signs of Skeleton Key malware""" +class unhooked_system_calls( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=unhooked_system_calls.unhooked_system_calls, + removal_date="2026-06-07", +): + """Detects hooked ntdll.dll stub functions in Windows processes (deprecated).""" _required_framework_version = (2, 4, 0) _version = (2, 0, 0) - - system_calls = { - "ntdll.dll": { - pe_symbols.wanted_names_identifier: [ - "NtCreateThread", - "NtProtectVirtualMemory", - "NtReadVirtualMemory", - "NtOpenProcess", - "NtWriteFile", - "NtQueryVirtualMemory", - "NtAllocateVirtualMemory", - "NtWorkerFactoryWorkerReady", - "NtAcceptConnectPort", - "NtAddDriverEntry", - "NtAdjustPrivilegesToken", - "NtAlpcCreatePort", - "NtClose", - "NtCreateFile", - "NtCreateMutant", - "NtOpenFile", - "NtOpenIoCompletion", - "NtOpenJobObject", - "NtOpenKey", - "NtOpenKeyEx", - "NtOpenThread", - "NtOpenThreadToken", - "NtOpenThreadTokenEx", - "NtWriteVirtualMemory", - "NtTraceEvent", - "NtTranslateFilePath", - "NtUmsThreadYield", - "NtUnloadDriver", - "NtUnloadKey", - "NtUnloadKey2", - "NtUnloadKeyEx", - "NtCreateKey", - "NtCreateSection", - "NtDeleteKey", - "NtDeleteValueKey", - "NtDuplicateObject", - "NtQueryValueKey", - "NtReplaceKey", - "NtRequestWaitReplyPort", - "NtRestoreKey", - "NtSetContextThread", - "NtSetSecurityObject", - "NtSetValueKey", - "NtSystemDebugControl", - "NtTerminateProcess", - ] - } - } - - # This data structure is used to track unique implementations of functions across processes - # The outer dictionary holds the module name (e.g., ntdll.dll) - # The next dictionary holds the function names (NtTerminateProcess, NtSetValueKey, etc.) inside a module - # The innermost dictionary holds the unique implementation (bytes) of a function across processes - # Each implementation is tracked along with the process(es) that host it - # For systems without malware, all functions should have the same implementation - # When API hooking/module unhooking is done, the victim (infected) processes will have unique implementations - _code_bytes_type = Dict[str, Dict[str, Dict[bytes, List[Tuple[int, str]]]]] - - @classmethod - def get_requirements(cls) -> List: - # Since we're calling the plugin, make sure we have the plugin's requirements - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="pe_symbols", component=pe_symbols.PESymbols, version=(3, 0, 0) - ), - ] - - def _gather_code_bytes( - self, - kernel_module_name: str, - found_symbols: pe_symbols.found_symbols_type, - ) -> _code_bytes_type: - """ - Enumerates the desired DLLs and function implementations in each process - Groups based on unique implementations of each DLLs' functions - The purpose is to detect when a function has different implementations (code) - in different processes. - This very effectively detects code injection. - """ - code_bytes: unhooked_system_calls._code_bytes_type = {} - - procs = pslist.PsList.list_processes(self.context, kernel_module_name) - - for proc in procs: - try: - proc_id = proc.UniqueProcessId - proc_name = utility.array_to_string(proc.ImageFileName) - proc_layer_name = proc.add_process_layer() - except exceptions.InvalidAddressException: - continue - - for dll_name, functions in found_symbols.items(): - for func_name, func_addr in functions: - try: - fbytes = self.context.layers[proc_layer_name].read( - func_addr, 0x20 - ) - except exceptions.InvalidAddressException: - continue - - # see the definition of _code_bytes_type for details of this data structure - if dll_name not in code_bytes: - code_bytes[dll_name] = {} - - if func_name not in code_bytes[dll_name]: - code_bytes[dll_name][func_name] = {} - - if fbytes not in code_bytes[dll_name][func_name]: - code_bytes[dll_name][func_name][fbytes] = [] - - code_bytes[dll_name][func_name][fbytes].append((proc_id, proc_name)) - - return code_bytes - - def _generator(self) -> Generator[Tuple[int, Tuple[str, str, int]], None, None]: - found_symbols = pe_symbols.PESymbols.addresses_for_process_symbols( - context=self.context, - config_path=self.config_path, - kernel_module_name=self.config["kernel"], - symbols=unhooked_system_calls.system_calls, - ) - - # code_bytes[dll_name][func_name][func_bytes] - code_bytes = self._gather_code_bytes(self.config["kernel"], found_symbols) - - # walk the functions that were evaluated - for functions in code_bytes.values(): - # cbb is the distinct groups of bytes (instructions) - # for this function across processes - for func_name, cbb in functions.items(): - # the dict key here is the raw instructions, which is not helpful to look at - # the values are the list of tuples for the (proc_id, proc_name) pairs for this set of bytes (instructions) - cb = list(cbb.values()) - - # if all processes map to the same implementation, then no malware is present - if len(cb) == 1: - yield 0, (func_name, "", len(cb[0])) - else: - # if there are differing implementations then it means - # that malware has overwritten system call(s) in infected processes - # max_idx and small_idx find which implementation of a system call has the least processes - # as all observed malware and open source projects only infected a few targets, leaving the - # rest with the original EDR hooks in place - max_idx = 0 if len(cb[0]) > len(cb[1]) else 1 - small_idx = (~max_idx) & 1 - - ps = [] - - # gather processes on small_idx since these are the malware infected ones - for pid, pname in cb[small_idx]: - ps.append(f"{pid:d}:{pname}") - - proc_names = ", ".join(ps) - - yield 0, (func_name, proc_names, len(cb[max_idx])) - - def run(self) -> renderers.TreeGrid: - return renderers.TreeGrid( - [ - ("Function", str), - ("Distinct Implementations", str), - ("Total Implementations", int), - ], - self._generator(), - ) From f97bc920bbfdbded80e9140b09640298a8249481 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 18:09:26 +0300 Subject: [PATCH 1147/1352] Plugins: changed class name due to incorrect resolution --- .../plugins/windows/malware/unhooked_system_calls.py | 6 +++--- .../framework/plugins/windows/unhooked_system_calls.py | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py b/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py index 5723ce0fd..71dc20021 100644 --- a/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py @@ -18,7 +18,7 @@ from volatility3.plugins.windows import pslist, pe_symbols vollog = logging.getLogger(__name__) -class unhooked_system_calls(interfaces.plugins.PluginInterface): +class UnhookedSystemCalls(interfaces.plugins.PluginInterface): """Detects hooked ntdll.dll stub functions in Windows processes.""" _required_framework_version = (2, 4, 0) @@ -114,7 +114,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): in different processes. This very effectively detects code injection. """ - code_bytes: unhooked_system_calls._code_bytes_type = {} + code_bytes: UnhookedSystemCalls._code_bytes_type = {} procs = pslist.PsList.list_processes(self.context, kernel_module_name) @@ -154,7 +154,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface): context=self.context, config_path=self.config_path, kernel_module_name=self.config["kernel"], - symbols=unhooked_system_calls.system_calls, + symbols=UnhookedSystemCalls.system_calls, ) # code_bytes[dll_name][func_name][func_bytes] diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index 0c42415b6..e6fb2fb6c 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -8,10 +8,10 @@ from volatility3.plugins.windows.malware import unhooked_system_calls vollog = logging.getLogger(__name__) -class unhooked_system_calls( +class UnhookedSystemCalls( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, - replacement_class=unhooked_system_calls.unhooked_system_calls, + replacement_class=unhooked_system_calls.UnhookedSystemCalls, removal_date="2026-06-07", ): """Detects hooked ntdll.dll stub functions in Windows processes (deprecated).""" From ef07b07659a3c2475b36b6d0c26b5e24ee02687a Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 18:25:53 +0300 Subject: [PATCH 1148/1352] Plugins: categorize windows.drivermodule as a malware plugin --- .../framework/plugins/windows/drivermodule.py | 105 ++---------------- .../plugins/windows/malware/drivermodule.py | 101 +++++++++++++++++ 2 files changed, 113 insertions(+), 93 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/drivermodule.py diff --git a/volatility3/framework/plugins/windows/drivermodule.py b/volatility3/framework/plugins/windows/drivermodule.py index c31fe2500..bf8f333f6 100644 --- a/volatility3/framework/plugins/windows/drivermodule.py +++ b/volatility3/framework/plugins/windows/drivermodule.py @@ -1,101 +1,20 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from typing import Iterator, List, Tuple -from volatility3.framework import renderers, interfaces -from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import ssdt, driverscan, modules +import logging +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import drivermodule -# built in Windows-components that trigger false positives -KNOWN_DRIVERS = ["ACPI_HAL", "PnpManager", "RAW", "WMIxWDM", "Win32k", "Fs_Rec"] +vollog = logging.getLogger(__name__) -class DriverModule(interfaces.plugins.PluginInterface): - """Determines if any loaded drivers were hidden by a rootkit""" +class DriverModule( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=drivermodule.DriverModule, + removal_date="2026-06-07", +): + """Determines if any loaded drivers were hidden by a rootkit (deprecated).""" _required_framework_version = (2, 0, 0) _version = (1, 0, 0) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) - ), - requirements.VersionRequirement( - name="driverscan", component=driverscan.DriverScan, version=(2, 0, 0) - ), - requirements.VersionRequirement( - name="modules", component=modules.Modules, version=(3, 0, 0) - ), - ] - - def _generator(self) -> Iterator[Tuple]: - """ - Attempt to match each driver's start code address to a known kernel module - A common rootkit technique is to register drivers from modules that are hidden, - which allows us to detect the disconnect between a malicious driver and its hidden module. - """ - collection = ssdt.SSDT.build_module_collection( - context=self.context, - kernel_module_name=self.config["kernel"], - ) - - kernel_space_start = modules.Modules.get_kernel_space_start( - self.context, self.config["kernel"] - ) - - for driver in driverscan.DriverScan.scan_drivers( - self.context, - self.config["kernel"], - ): - # We want starts of 0 as rootkits often set this value - # greater than 0 but less than the kernel space start is smear/terminated though - if 0 < driver.DriverStart < kernel_space_start: - continue - - # we do not care about actual symbol names, we just want to know if the driver points to a known module - module_symbols = list( - collection.get_module_symbols_by_absolute_location(driver.DriverStart) - ) - if not module_symbols: - ( - driver_name, - service_key, - name, - ) = driverscan.DriverScan.get_names_for_driver(driver) - - # drivers without any names will not produce useful output - if not driver_name and not service_key and not name: - continue - - known_exception = driver_name in KNOWN_DRIVERS - - yield ( - 0, - ( - format_hints.Hex(driver.vol.offset), - known_exception, - driver_name or renderers.NotAvailableValue(), - service_key or renderers.NotAvailableValue(), - name or renderers.NotAvailableValue(), - ), - ) - - def run(self) -> renderers.TreeGrid: - return renderers.TreeGrid( - [ - ("Offset", format_hints.Hex), - ("Known Exception", bool), - ("Driver Name", str), - ("Service Key", str), - ("Alternative Name", str), - ], - self._generator(), - ) diff --git a/volatility3/framework/plugins/windows/malware/drivermodule.py b/volatility3/framework/plugins/windows/malware/drivermodule.py new file mode 100644 index 000000000..c31fe2500 --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/drivermodule.py @@ -0,0 +1,101 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +from typing import Iterator, List, Tuple +from volatility3.framework import renderers, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import ssdt, driverscan, modules + +# built in Windows-components that trigger false positives +KNOWN_DRIVERS = ["ACPI_HAL", "PnpManager", "RAW", "WMIxWDM", "Win32k", "Fs_Rec"] + + +class DriverModule(interfaces.plugins.PluginInterface): + """Determines if any loaded drivers were hidden by a rootkit""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="ssdt", component=ssdt.SSDT, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="driverscan", component=driverscan.DriverScan, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="modules", component=modules.Modules, version=(3, 0, 0) + ), + ] + + def _generator(self) -> Iterator[Tuple]: + """ + Attempt to match each driver's start code address to a known kernel module + A common rootkit technique is to register drivers from modules that are hidden, + which allows us to detect the disconnect between a malicious driver and its hidden module. + """ + collection = ssdt.SSDT.build_module_collection( + context=self.context, + kernel_module_name=self.config["kernel"], + ) + + kernel_space_start = modules.Modules.get_kernel_space_start( + self.context, self.config["kernel"] + ) + + for driver in driverscan.DriverScan.scan_drivers( + self.context, + self.config["kernel"], + ): + # We want starts of 0 as rootkits often set this value + # greater than 0 but less than the kernel space start is smear/terminated though + if 0 < driver.DriverStart < kernel_space_start: + continue + + # we do not care about actual symbol names, we just want to know if the driver points to a known module + module_symbols = list( + collection.get_module_symbols_by_absolute_location(driver.DriverStart) + ) + if not module_symbols: + ( + driver_name, + service_key, + name, + ) = driverscan.DriverScan.get_names_for_driver(driver) + + # drivers without any names will not produce useful output + if not driver_name and not service_key and not name: + continue + + known_exception = driver_name in KNOWN_DRIVERS + + yield ( + 0, + ( + format_hints.Hex(driver.vol.offset), + known_exception, + driver_name or renderers.NotAvailableValue(), + service_key or renderers.NotAvailableValue(), + name or renderers.NotAvailableValue(), + ), + ) + + def run(self) -> renderers.TreeGrid: + return renderers.TreeGrid( + [ + ("Offset", format_hints.Hex), + ("Known Exception", bool), + ("Driver Name", str), + ("Service Key", str), + ("Alternative Name", str), + ], + self._generator(), + ) From 8acf97c475aab174e183669a104e8fa66ef6d599 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 18:42:13 +0300 Subject: [PATCH 1149/1352] Plugins: categorize linux.check_creds as a malwarep lugin --- .../framework/plugins/linux/check_creds.py | 75 +++---------------- .../plugins/linux/malware/check_creds.py | 71 ++++++++++++++++++ 2 files changed, 83 insertions(+), 63 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/check_creds.py diff --git a/volatility3/framework/plugins/linux/check_creds.py b/volatility3/framework/plugins/linux/check_creds.py index e2b84d679..6c2c6f3d5 100644 --- a/volatility3/framework/plugins/linux/check_creds.py +++ b/volatility3/framework/plugins/linux/check_creds.py @@ -1,71 +1,20 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # +import logging +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import check_creds -from volatility3.framework import interfaces, renderers -from volatility3.framework.renderers import format_hints -from volatility3.framework.configuration import requirements -from volatility3.plugins.linux import pslist +vollog = logging.getLogger(__name__) -class Check_creds(interfaces.plugins.PluginInterface): - """Checks if any processes are sharing credential structures""" +class Check_creds( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=check_creds.Check_creds, + removal_date="2026-06-07", +): + """Checks if any processes are sharing credential structures (deprecated).""" _required_framework_version = (2, 0, 0) _version = (2, 0, 2) - - @classmethod - def get_requirements(cls): - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(4, 0, 0) - ), - ] - - def _generator(self): - vmlinux = self.context.modules[self.config["kernel"]] - - type_task = vmlinux.get_type("task_struct") - - if not type_task.has_member("cred"): - raise TypeError( - "This plugin requires the task_struct structure to have a cred member. " - "This member is not present in the supplied symbol table. " - "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." - ) - - creds = {} - - tasks = pslist.PsList.list_tasks(self.context, vmlinux.name) - - for task in tasks: - task_cred_ptr = task.cred - if not (task_cred_ptr and task_cred_ptr.is_readable()): - continue - - cred_addr = task_cred_ptr.dereference().vol.offset - - creds.setdefault(cred_addr, []) - creds[cred_addr].append(task.pid) - - for cred_addr, pids in creds.items(): - if len(pids) > 1: - pid_str = ", ".join(str(pid) for pid in pids) - - fields = [ - format_hints.Hex(cred_addr), - pid_str, - ] - yield (0, fields) - - def run(self): - headers = [ - ("CredVAddr", format_hints.Hex), - ("PIDs", str), - ] - return renderers.TreeGrid(headers, self._generator()) diff --git a/volatility3/framework/plugins/linux/malware/check_creds.py b/volatility3/framework/plugins/linux/malware/check_creds.py new file mode 100644 index 000000000..e2b84d679 --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/check_creds.py @@ -0,0 +1,71 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +from volatility3.framework import interfaces, renderers +from volatility3.framework.renderers import format_hints +from volatility3.framework.configuration import requirements +from volatility3.plugins.linux import pslist + + +class Check_creds(interfaces.plugins.PluginInterface): + """Checks if any processes are sharing credential structures""" + + _required_framework_version = (2, 0, 0) + _version = (2, 0, 2) + + @classmethod + def get_requirements(cls): + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) + ), + ] + + def _generator(self): + vmlinux = self.context.modules[self.config["kernel"]] + + type_task = vmlinux.get_type("task_struct") + + if not type_task.has_member("cred"): + raise TypeError( + "This plugin requires the task_struct structure to have a cred member. " + "This member is not present in the supplied symbol table. " + "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." + ) + + creds = {} + + tasks = pslist.PsList.list_tasks(self.context, vmlinux.name) + + for task in tasks: + task_cred_ptr = task.cred + if not (task_cred_ptr and task_cred_ptr.is_readable()): + continue + + cred_addr = task_cred_ptr.dereference().vol.offset + + creds.setdefault(cred_addr, []) + creds[cred_addr].append(task.pid) + + for cred_addr, pids in creds.items(): + if len(pids) > 1: + pid_str = ", ".join(str(pid) for pid in pids) + + fields = [ + format_hints.Hex(cred_addr), + pid_str, + ] + yield (0, fields) + + def run(self): + headers = [ + ("CredVAddr", format_hints.Hex), + ("PIDs", str), + ] + return renderers.TreeGrid(headers, self._generator()) From 85a5eb5d41ff04b728cacc1cedb4b8a95f4da6cb Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 18:42:42 +0300 Subject: [PATCH 1150/1352] linux.malware.check_creds - fix deps in: test, doc --- doc/source/getting-started-linux-tutorial.rst | 2 +- test/plugins/linux/linux.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 031b49636..4c442c938 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -37,7 +37,7 @@ For plugin requests, please create an issue with a description of the requested banners.Banners Attempts to identify potential linux banners in an linux.bash.Bash Recovers bash command history from memory. linux.check_afinfo.Check_afinfo - linux.check_creds.Check_creds + linux.malware.check_creds.Check_creds linux.check_idt.Check_idt .. note:: Here the command is piped to grep and head to provide the start of the list of linux plugins. diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index e39c1d15d..abac11278 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -200,7 +200,7 @@ class TestLinuxCapabilities: class TestLinuxCheckCreds: def test_linux_generic_check_creds(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.check_creds.Check_creds", image, volatility, python + "linux.malware.check_creds.Check_creds", image, volatility, python ) # linux-sample-1.bin has no processes sharing credentials. From c36fdd69f6270b449e3d0f32e9f266cdc06813b2 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:22:58 +0300 Subject: [PATCH 1151/1352] Plugins: categorize linux.check_idt as a malware plugin --- .../framework/plugins/linux/check_idt.py | 166 +---------------- .../plugins/linux/malware/check_idt.py | 168 ++++++++++++++++++ 2 files changed, 177 insertions(+), 157 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/check_idt.py diff --git a/volatility3/framework/plugins/linux/check_idt.py b/volatility3/framework/plugins/linux/check_idt.py index e199d98d3..449f85e1e 100644 --- a/volatility3/framework/plugins/linux/check_idt.py +++ b/volatility3/framework/plugins/linux/check_idt.py @@ -1,168 +1,20 @@ # This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - import logging -from typing import List, Optional - -import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, renderers, symbols -from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols import linux +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import check_idt vollog = logging.getLogger(__name__) -class Check_idt(interfaces.plugins.PluginInterface): - """Checks if the IDT has been altered""" +class Check_idt( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=check_idt.Check_idt, + removal_date="2026-06-07", +): + """Checks if the IDT has been altered (deprecated).""" _required_framework_version = (2, 0, 0) - - # 2.0.0 - Add versioning at all, add `get_idt_type` _version = (2, 0, 0) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 0), - ), - requirements.VersionRequirement( - name="linux_utilities_module_gatherers", - component=linux_utilities_modules.ModuleGatherers, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) - ), - ] - - @staticmethod - def get_idt_type(context, vmlinux_name) -> Optional[str]: - """ - Determines the IDT type for this symbol table or returns None - - The original version ended clauses with an `else` leading to bad fall through - of returning a type that did not exist in the symbol table. - - Future updates should not leave fall through cases to avoid this repeating. - """ - - vmlinux = context.modules[vmlinux_name] - - is_32bit = not symbols.symbol_table_is_64bit(context, vmlinux.symbol_table_name) - - # These are in a specific order. Only append to the lists going forward - # or ask Andrew to run tests before merging. - if is_32bit: - idt_types = ["gate_struct", "desc_struct", "gate_struct32"] - else: - idt_types = ["gate_struct64", "gate_struct", "idt_desc"] - - for idt_type in idt_types: - if vmlinux.has_type(idt_type): - return idt_type - - return None - - def _generator(self): - idt_type = self.get_idt_type(self.context, self.config["kernel"]) - if not idt_type: - vollog.error( - "Unable to determine the data structure type for IDT entries. Please file a bug on the GitHub tracker with your kernel version." - ) - return - - vmlinux = self.context.modules[self.config["kernel"]] - - known_modules = linux_utilities_modules.Modules.run_modules_scanners( - context=self.context, - kernel_module_name=self.config["kernel"], - caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, - ) - - idt_table_size = 256 - - kernel_layer = self.context.layers[vmlinux.layer_name] - - address_mask = kernel_layer.address_mask - - # hw handlers + system call - check_idxs = list(range(20)) + [128] - - addrs = vmlinux.object_from_symbol("idt_table") - - table = vmlinux.object( - object_type="array", - offset=addrs.vol.offset, - subtype=vmlinux.get_type(idt_type), - count=idt_table_size, - absolute=True, - ) - - for i in check_idxs: - ent = table[i] - - if not ent or not kernel_layer.is_valid(ent.vol.offset): - continue - - if hasattr(ent, "a"): - idt_addr = (ent.b & 0xFFFF0000) | (ent.a & 0x0000FFFF) - else: - low = ent.offset_low - middle = ent.offset_middle - - # offset_high is for 64bit systems - if hasattr(ent, "offset_high"): - high = ent.offset_high - else: - high = 0 - - idt_addr = (high << 32) | (middle << 16) | low - - idt_addr = idt_addr & address_mask - - # 0 means unintialized/unused, not a rootkit - if idt_addr == 0: - module_name = renderers.NotAvailableValue() - symbol_name = renderers.NotAvailableValue() - else: - module_info, symbol_name = ( - linux_utilities_modules.Modules.module_lookup_by_address( - self.context, vmlinux.name, known_modules, idt_addr - ) - ) - - if module_info: - module_name = module_info.name - else: - module_name = renderers.NotAvailableValue() - - yield ( - 0, - [ - format_hints.Hex(i), - format_hints.Hex(idt_addr), - module_name, - symbol_name or renderers.NotAvailableValue(), - ], - ) - - def run(self): - return renderers.TreeGrid( - [ - ("Index", format_hints.Hex), - ("Address", format_hints.Hex), - ("Module", str), - ("Symbol", str), - ], - self._generator(), - ) diff --git a/volatility3/framework/plugins/linux/malware/check_idt.py b/volatility3/framework/plugins/linux/malware/check_idt.py new file mode 100644 index 000000000..e199d98d3 --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/check_idt.py @@ -0,0 +1,168 @@ +# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +from typing import List, Optional + +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.framework import interfaces, renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux + +vollog = logging.getLogger(__name__) + + +class Check_idt(interfaces.plugins.PluginInterface): + """Checks if the IDT has been altered""" + + _required_framework_version = (2, 0, 0) + + # 2.0.0 - Add versioning at all, add `get_idt_type` + _version = (2, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) + ), + ] + + @staticmethod + def get_idt_type(context, vmlinux_name) -> Optional[str]: + """ + Determines the IDT type for this symbol table or returns None + + The original version ended clauses with an `else` leading to bad fall through + of returning a type that did not exist in the symbol table. + + Future updates should not leave fall through cases to avoid this repeating. + """ + + vmlinux = context.modules[vmlinux_name] + + is_32bit = not symbols.symbol_table_is_64bit(context, vmlinux.symbol_table_name) + + # These are in a specific order. Only append to the lists going forward + # or ask Andrew to run tests before merging. + if is_32bit: + idt_types = ["gate_struct", "desc_struct", "gate_struct32"] + else: + idt_types = ["gate_struct64", "gate_struct", "idt_desc"] + + for idt_type in idt_types: + if vmlinux.has_type(idt_type): + return idt_type + + return None + + def _generator(self): + idt_type = self.get_idt_type(self.context, self.config["kernel"]) + if not idt_type: + vollog.error( + "Unable to determine the data structure type for IDT entries. Please file a bug on the GitHub tracker with your kernel version." + ) + return + + vmlinux = self.context.modules[self.config["kernel"]] + + known_modules = linux_utilities_modules.Modules.run_modules_scanners( + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, + ) + + idt_table_size = 256 + + kernel_layer = self.context.layers[vmlinux.layer_name] + + address_mask = kernel_layer.address_mask + + # hw handlers + system call + check_idxs = list(range(20)) + [128] + + addrs = vmlinux.object_from_symbol("idt_table") + + table = vmlinux.object( + object_type="array", + offset=addrs.vol.offset, + subtype=vmlinux.get_type(idt_type), + count=idt_table_size, + absolute=True, + ) + + for i in check_idxs: + ent = table[i] + + if not ent or not kernel_layer.is_valid(ent.vol.offset): + continue + + if hasattr(ent, "a"): + idt_addr = (ent.b & 0xFFFF0000) | (ent.a & 0x0000FFFF) + else: + low = ent.offset_low + middle = ent.offset_middle + + # offset_high is for 64bit systems + if hasattr(ent, "offset_high"): + high = ent.offset_high + else: + high = 0 + + idt_addr = (high << 32) | (middle << 16) | low + + idt_addr = idt_addr & address_mask + + # 0 means unintialized/unused, not a rootkit + if idt_addr == 0: + module_name = renderers.NotAvailableValue() + symbol_name = renderers.NotAvailableValue() + else: + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self.context, vmlinux.name, known_modules, idt_addr + ) + ) + + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + + yield ( + 0, + [ + format_hints.Hex(i), + format_hints.Hex(idt_addr), + module_name, + symbol_name or renderers.NotAvailableValue(), + ], + ) + + def run(self): + return renderers.TreeGrid( + [ + ("Index", format_hints.Hex), + ("Address", format_hints.Hex), + ("Module", str), + ("Symbol", str), + ], + self._generator(), + ) From 4bc1bb818dfb2cb0ca8c2f694ba4f97fdab09208 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:23:13 +0300 Subject: [PATCH 1152/1352] linux.malware.check_idt - fix doc & test deps --- doc/source/getting-started-linux-tutorial.rst | 2 +- test/plugins/linux/linux.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 031b49636..9a04ddcc1 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -38,7 +38,7 @@ For plugin requests, please create an issue with a description of the requested linux.bash.Bash Recovers bash command history from memory. linux.check_afinfo.Check_afinfo linux.check_creds.Check_creds - linux.check_idt.Check_idt + linux.malware.check_idt.Check_idt .. note:: Here the command is piped to grep and head to provide the start of the list of linux plugins. diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index e39c1d15d..cecf6e80e 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -29,7 +29,7 @@ class TestLinuxPslist: class TestLinuxCheckIdt: def test_linux_generic_check_idt(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.check_idt.Check_idt", image, volatility, python + "linux.malware.check_idt.Check_idt", image, volatility, python ) assert rc == 0 From 832c997e20b7685f772e518d091fdca534a2e2d8 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:29:55 +0300 Subject: [PATCH 1153/1352] Plugins: categorize linux.check_modules as a malware plugin --- .../framework/plugins/linux/check_modules.py | 68 +++--------------- .../plugins/linux/malware/check_modules.py | 70 +++++++++++++++++++ 2 files changed, 79 insertions(+), 59 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/check_modules.py diff --git a/volatility3/framework/plugins/linux/check_modules.py b/volatility3/framework/plugins/linux/check_modules.py index 7805bbd8a..d8b3ddcf1 100644 --- a/volatility3/framework/plugins/linux/check_modules.py +++ b/volatility3/framework/plugins/linux/check_modules.py @@ -1,70 +1,20 @@ -# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - import logging -from typing import List, Dict, Generator - -import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3.framework import interfaces, deprecation -from volatility3.framework.configuration import requirements -from volatility3.framework.objects import utility -from volatility3.framework.symbols.linux import extensions -from volatility3.framework.interfaces import plugins +from volatility3.plugins.linux.malware import check_modules vollog = logging.getLogger(__name__) -class Check_modules(plugins.PluginInterface): - """Compares module list to sysfs info, if available""" +class Check_modules( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=check_modules.Check_modules, + removal_date="2026-06-07", +): + """Compares module list to sysfs info, if available (deprecated).""" _version = (3, 0, 1) _required_framework_version = (2, 0, 0) - - @classmethod - def compare_kset_and_lsmod( - cls, context: str, vmlinux_name: str - ) -> Generator[extensions.module, None, None]: - kset_modules = linux_utilities_modules.Modules.get_kset_modules( - context=context, vmlinux_name=vmlinux_name - ) - - lsmod_modules = set( - str(utility.array_to_string(modules.name)) - for modules in linux_utilities_modules.Modules.list_modules( - context=context, vmlinux_module_name=vmlinux_name - ) - ) - - for mod_name in set(kset_modules.keys()).difference(lsmod_modules): - yield kset_modules[mod_name] - - run = linux_utilities_modules.ModuleDisplayPlugin.run - _generator = linux_utilities_modules.ModuleDisplayPlugin.generator - implementation = compare_kset_and_lsmod - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.VersionRequirement( - name="modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 1), - ), - requirements.VersionRequirement( - name="linux_utilities_modules_module_display_plugin", - component=linux_utilities_modules.ModuleDisplayPlugin, - version=(1, 0, 0), - ), - ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() - - @classmethod - @deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.get_kset_modules, - removal_date="2025-09-25", - replacement_version=(3, 0, 0), - ) - def get_kset_modules( - cls, context: interfaces.context.ContextInterface, vmlinux_name: str - ) -> Dict[str, extensions.module]: - return linux_utilities_modules.Modules.get_kset_modules(context, vmlinux_name) diff --git a/volatility3/framework/plugins/linux/malware/check_modules.py b/volatility3/framework/plugins/linux/malware/check_modules.py new file mode 100644 index 000000000..7805bbd8a --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/check_modules.py @@ -0,0 +1,70 @@ +# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +from typing import List, Dict, Generator + +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.framework import interfaces, deprecation +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.interfaces import plugins + +vollog = logging.getLogger(__name__) + + +class Check_modules(plugins.PluginInterface): + """Compares module list to sysfs info, if available""" + + _version = (3, 0, 1) + _required_framework_version = (2, 0, 0) + + @classmethod + def compare_kset_and_lsmod( + cls, context: str, vmlinux_name: str + ) -> Generator[extensions.module, None, None]: + kset_modules = linux_utilities_modules.Modules.get_kset_modules( + context=context, vmlinux_name=vmlinux_name + ) + + lsmod_modules = set( + str(utility.array_to_string(modules.name)) + for modules in linux_utilities_modules.Modules.list_modules( + context=context, vmlinux_module_name=vmlinux_name + ) + ) + + for mod_name in set(kset_modules.keys()).difference(lsmod_modules): + yield kset_modules[mod_name] + + run = linux_utilities_modules.ModuleDisplayPlugin.run + _generator = linux_utilities_modules.ModuleDisplayPlugin.generator + implementation = compare_kset_and_lsmod + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.VersionRequirement( + name="modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 1), + ), + requirements.VersionRequirement( + name="linux_utilities_modules_module_display_plugin", + component=linux_utilities_modules.ModuleDisplayPlugin, + version=(1, 0, 0), + ), + ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() + + @classmethod + @deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.get_kset_modules, + removal_date="2025-09-25", + replacement_version=(3, 0, 0), + ) + def get_kset_modules( + cls, context: interfaces.context.ContextInterface, vmlinux_name: str + ) -> Dict[str, extensions.module]: + return linux_utilities_modules.Modules.get_kset_modules(context, vmlinux_name) From 4b279f96339f7d5b00af2abf2c8d7d6041777d75 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:30:04 +0300 Subject: [PATCH 1154/1352] linux.malware.check_modules - fix test --- test/plugins/linux/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index e39c1d15d..12309cc59 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -438,7 +438,7 @@ class TestLinuxCheckAfinfo: class TestLinuxCheckModules: def test_linux_generic_check_modules(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.check_modules.Check_modules", image, volatility, python + "linux.malware.check_modules.Check_modules", image, volatility, python ) # linux-sample-1.bin has no suspicious results. From 5b538d16866e8a173093c5934c493c58f0fb810b Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:35:19 +0300 Subject: [PATCH 1155/1352] Plugins: categorize linux.check_syscall as a malware plugin --- .../framework/plugins/linux/check_syscall.py | 216 +----------------- .../plugins/linux/malware/check_syscall.py | 215 +++++++++++++++++ 2 files changed, 226 insertions(+), 205 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/check_syscall.py diff --git a/volatility3/framework/plugins/linux/check_syscall.py b/volatility3/framework/plugins/linux/check_syscall.py index 724a67810..5e3e40cbb 100644 --- a/volatility3/framework/plugins/linux/check_syscall.py +++ b/volatility3/framework/plugins/linux/check_syscall.py @@ -1,214 +1,20 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -"""A module containing a plugin that checks the system call table for hooks.""" -import contextlib import logging -from typing import List - -from volatility3.framework import constants, exceptions, interfaces, renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins -from volatility3.framework.renderers import format_hints +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import check_syscall vollog = logging.getLogger(__name__) -try: - import capstone - has_capstone = True -except ImportError: - has_capstone = False - - -class Check_syscall(plugins.PluginInterface): - """Check system call table for hooks.""" +class Check_syscall( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=check_syscall.Check_syscall, + removal_date="2026-06-07", +): + """Check system call table for hooks (deprecated).""" _required_framework_version = (2, 0, 0) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - ] - - def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux): - """Returns the size of the table based on the next symbol.""" - ret = 0 - - symbol_list = [] - for sn in vmlinux.symbols: - with contextlib.suppress(exceptions.SymbolError): - # When requesting the symbol from the module, a full resolve is performed - symbol_list.append((vmlinux.get_symbol(sn).address, sn)) - sorted_symbols = sorted(symbol_list) - - sym_address = 0 - - for tmp_sym_address, sym_name in sorted_symbols: - if tmp_sym_address > table_addr: - sym_address = tmp_sym_address - break - - if sym_address > 0: - ret = int((sym_address - table_addr) / ptr_sz) - - return ret - - def _get_table_size_meta(self, vmlinux): - """returns the number of symbols that start with __syscall_meta__ this - is a fast way to determine the number of system calls, but not the most - accurate.""" - - return len( - [ - sym - for sym in self.context.symbol_space[vmlinux.symbol_table_name].symbols - if sym.startswith("__syscall_meta__") - ] - ) - - def _get_table_info_other(self, table_addr, ptr_sz, vmlinux): - table_size_meta = self._get_table_size_meta(vmlinux) - table_size_syms = self._get_table_size_next_symbol(table_addr, ptr_sz, vmlinux) - - sizes = [size for size in [table_size_meta, table_size_syms] if size > 0] - - table_size = min(sizes) - - return table_size - - def _get_table_info_disassembly(self, ptr_sz, vmlinux) -> int: - """Find the size of the system call table by disassembling functions - that immediately reference it in their first instruction This is in the - form 'cmp reg,NR_syscalls'.""" - table_size = 0 - - if not has_capstone: - return table_size - - if ptr_sz == 4: - syscall_entry_func = "sysenter_do_call" - mode = capstone.CS_MODE_32 - else: - syscall_entry_func = "system_call_fastpath" - mode = capstone.CS_MODE_64 - - md = capstone.Cs(capstone.CS_ARCH_X86, mode) - - try: - func_addr = vmlinux.get_symbol(syscall_entry_func).address - except exceptions.SymbolError: - # if we can't find the disassemble function then bail and rely on a different method - return 0 - - vmlinux = self.context.modules[self.config["kernel"]] - vmlinux_layer = self.context.layers[vmlinux.layer_name] - try: - data = vmlinux_layer.read(func_addr, 6) - except exceptions.InvalidAddressException: - return 0 - - for _address, _size, mnemonic, op_str in md.disasm_lite(data, func_addr): - if mnemonic == "CMP": - table_size = int(op_str.split(",")[1].strip()) & 0xFFFF - break - - return table_size - - def _get_table_info(self, vmlinux, table_name, ptr_sz): - table_sym = vmlinux.get_symbol(table_name) - - table_size = self._get_table_info_disassembly(ptr_sz, vmlinux) - - if table_size == 0: - table_size = self._get_table_info_other(table_sym.address, ptr_sz, vmlinux) - - if table_size == 0: - vollog.error("Unable to get system call table size") - return 0, 0 - - return table_sym.address, table_size - - # TODO - add finding and parsing unistd.h once cached file enumeration is added - def _generator(self): - vmlinux = self.context.modules[self.config["kernel"]] - - ptr_sz = vmlinux.get_type("pointer").size - if ptr_sz == 4: - table_name = "32bit" - else: - table_name = "64bit" - - try: - table_info = self._get_table_info(vmlinux, "sys_call_table", ptr_sz) - except exceptions.SymbolError: - vollog.error("Unable to find the system call table. Exiting.") - return None - - tables = [(table_name, table_info)] - - # this table is only present on 64 bit systems with 32 bit emulation - # enabled in order to support 32 bit programs and libraries - # if the symbol isn't there then the support isn't in the kernel and so we skip it - try: - ia32_symbol = vmlinux.get_symbol("ia32_sys_call_table") - except exceptions.SymbolError: - ia32_symbol = None - - if ia32_symbol is not None: - ia32_info = self._get_table_info(vmlinux, "ia32_sys_call_table", ptr_sz) - tables.append(("32bit", ia32_info)) - - for table_name, (tableaddr, tblsz) in tables: - table = vmlinux.object( - object_type="array", - subtype=vmlinux.get_type("pointer"), - offset=tableaddr, - count=tblsz, - ) - - for i in range(len(table)): - try: - call_addr = table[i] - except exceptions.InvalidAddressException: - vollog.debug(f"Failed to get system call table entry at index {i}") - continue - - symbols = list(vmlinux.get_symbols_by_absolute_location(call_addr)) - - if len(symbols) > 0: - sym_name = ( - str(symbols[0].split(constants.BANG)[1]) - if constants.BANG in symbols[0] - else str(symbols[0]) - ) - else: - sym_name = "UNKNOWN" - - yield ( - 0, - ( - format_hints.Hex(tableaddr), - table_name, - i, - format_hints.Hex(call_addr), - sym_name, - ), - ) - - def run(self): - return renderers.TreeGrid( - [ - ("Table Address", format_hints.Hex), - ("Table Name", str), - ("Index", int), - ("Handler Address", format_hints.Hex), - ("Handler Symbol", str), - ], - self._generator(), - ) + _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/linux/malware/check_syscall.py b/volatility3/framework/plugins/linux/malware/check_syscall.py new file mode 100644 index 000000000..1188bf250 --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/check_syscall.py @@ -0,0 +1,215 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +"""A module containing a plugin that checks the system call table for hooks.""" +import contextlib +import logging +from typing import List + +from volatility3.framework import constants, exceptions, interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints + +vollog = logging.getLogger(__name__) + +try: + import capstone + + has_capstone = True +except ImportError: + has_capstone = False + + +class Check_syscall(plugins.PluginInterface): + """Check system call table for hooks.""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + ] + + def _get_table_size_next_symbol(self, table_addr, ptr_sz, vmlinux): + """Returns the size of the table based on the next symbol.""" + ret = 0 + + symbol_list = [] + for sn in vmlinux.symbols: + with contextlib.suppress(exceptions.SymbolError): + # When requesting the symbol from the module, a full resolve is performed + symbol_list.append((vmlinux.get_symbol(sn).address, sn)) + sorted_symbols = sorted(symbol_list) + + sym_address = 0 + + for tmp_sym_address, sym_name in sorted_symbols: + if tmp_sym_address > table_addr: + sym_address = tmp_sym_address + break + + if sym_address > 0: + ret = int((sym_address - table_addr) / ptr_sz) + + return ret + + def _get_table_size_meta(self, vmlinux): + """returns the number of symbols that start with __syscall_meta__ this + is a fast way to determine the number of system calls, but not the most + accurate.""" + + return len( + [ + sym + for sym in self.context.symbol_space[vmlinux.symbol_table_name].symbols + if sym.startswith("__syscall_meta__") + ] + ) + + def _get_table_info_other(self, table_addr, ptr_sz, vmlinux): + table_size_meta = self._get_table_size_meta(vmlinux) + table_size_syms = self._get_table_size_next_symbol(table_addr, ptr_sz, vmlinux) + + sizes = [size for size in [table_size_meta, table_size_syms] if size > 0] + + table_size = min(sizes) + + return table_size + + def _get_table_info_disassembly(self, ptr_sz, vmlinux) -> int: + """Find the size of the system call table by disassembling functions + that immediately reference it in their first instruction This is in the + form 'cmp reg,NR_syscalls'.""" + table_size = 0 + + if not has_capstone: + return table_size + + if ptr_sz == 4: + syscall_entry_func = "sysenter_do_call" + mode = capstone.CS_MODE_32 + else: + syscall_entry_func = "system_call_fastpath" + mode = capstone.CS_MODE_64 + + md = capstone.Cs(capstone.CS_ARCH_X86, mode) + + try: + func_addr = vmlinux.get_symbol(syscall_entry_func).address + except exceptions.SymbolError: + # if we can't find the disassemble function then bail and rely on a different method + return 0 + + vmlinux = self.context.modules[self.config["kernel"]] + vmlinux_layer = self.context.layers[vmlinux.layer_name] + try: + data = vmlinux_layer.read(func_addr, 6) + except exceptions.InvalidAddressException: + return 0 + + for _address, _size, mnemonic, op_str in md.disasm_lite(data, func_addr): + if mnemonic == "CMP": + table_size = int(op_str.split(",")[1].strip()) & 0xFFFF + break + + return table_size + + def _get_table_info(self, vmlinux, table_name, ptr_sz): + table_sym = vmlinux.get_symbol(table_name) + + table_size = self._get_table_info_disassembly(ptr_sz, vmlinux) + + if table_size == 0: + table_size = self._get_table_info_other(table_sym.address, ptr_sz, vmlinux) + + if table_size == 0: + vollog.error("Unable to get system call table size") + return 0, 0 + + return table_sym.address, table_size + + # TODO - add finding and parsing unistd.h once cached file enumeration is added + def _generator(self): + vmlinux = self.context.modules[self.config["kernel"]] + + ptr_sz = vmlinux.get_type("pointer").size + if ptr_sz == 4: + table_name = "32bit" + else: + table_name = "64bit" + + try: + table_info = self._get_table_info(vmlinux, "sys_call_table", ptr_sz) + except exceptions.SymbolError: + vollog.error("Unable to find the system call table. Exiting.") + return None + + tables = [(table_name, table_info)] + + # this table is only present on 64 bit systems with 32 bit emulation + # enabled in order to support 32 bit programs and libraries + # if the symbol isn't there then the support isn't in the kernel and so we skip it + try: + ia32_symbol = vmlinux.get_symbol("ia32_sys_call_table") + except exceptions.SymbolError: + ia32_symbol = None + + if ia32_symbol is not None: + ia32_info = self._get_table_info(vmlinux, "ia32_sys_call_table", ptr_sz) + tables.append(("32bit", ia32_info)) + + for table_name, (tableaddr, tblsz) in tables: + table = vmlinux.object( + object_type="array", + subtype=vmlinux.get_type("pointer"), + offset=tableaddr, + count=tblsz, + ) + + for i in range(len(table)): + try: + call_addr = table[i] + except exceptions.InvalidAddressException: + vollog.debug(f"Failed to get system call table entry at index {i}") + continue + + symbols = list(vmlinux.get_symbols_by_absolute_location(call_addr)) + + if len(symbols) > 0: + sym_name = ( + str(symbols[0].split(constants.BANG)[1]) + if constants.BANG in symbols[0] + else str(symbols[0]) + ) + else: + sym_name = "UNKNOWN" + + yield ( + 0, + ( + format_hints.Hex(tableaddr), + table_name, + i, + format_hints.Hex(call_addr), + sym_name, + ), + ) + + def run(self): + return renderers.TreeGrid( + [ + ("Table Address", format_hints.Hex), + ("Table Name", str), + ("Index", int), + ("Handler Address", format_hints.Hex), + ("Handler Symbol", str), + ], + self._generator(), + ) From 70514396b307ca4f4b43bf1587d02cfe7f7dd1e9 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:35:26 +0300 Subject: [PATCH 1156/1352] linux.malware.check_syscall - fix test --- test/plugins/linux/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index e39c1d15d..639cad464 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -41,7 +41,7 @@ class TestLinuxCheckIdt: class TestLinuxCheckSyscall: def test_linux_generic_check_syscall(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.check_syscall.Check_syscall", image, volatility, python + "linux.malware.check_syscall.Check_syscall", image, volatility, python ) assert rc == 0 From 962665b412980b556d4b003659504a42ca7dda7e Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:44:50 +0300 Subject: [PATCH 1157/1352] Plugins: categorize linux.check_afinfo as a malware plugin + test fix --- doc/source/getting-started-linux-tutorial.rst | 2 +- test/plugins/linux/linux.py | 2 +- .../framework/plugins/linux/check_afinfo.py | 215 +----------------- .../plugins/linux/malware/check_afinfo.py | 215 ++++++++++++++++++ 4 files changed, 227 insertions(+), 207 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/check_afinfo.py diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 031b49636..267d3fc06 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -36,7 +36,7 @@ For plugin requests, please create an issue with a description of the requested $ python3 vol.py --help | grep -i linux. | head -n 5 banners.Banners Attempts to identify potential linux banners in an linux.bash.Bash Recovers bash command history from memory. - linux.check_afinfo.Check_afinfo + linux.malware.check_afinfo.Check_afinfo linux.check_creds.Check_creds linux.check_idt.Check_idt diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index e39c1d15d..6b4ae1363 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -426,7 +426,7 @@ class TestLinuxPageCacheInodepages: class TestLinuxCheckAfinfo: def test_linux_generic_check_afinfo(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.check_afinfo.Check_afinfo", image, volatility, python + "linux.malware.check_afinfo.Check_afinfo", image, volatility, python ) # linux-sample-1.bin has no suspicious results. diff --git a/volatility3/framework/plugins/linux/check_afinfo.py b/volatility3/framework/plugins/linux/check_afinfo.py index 47da21615..3f9e14161 100644 --- a/volatility3/framework/plugins/linux/check_afinfo.py +++ b/volatility3/framework/plugins/linux/check_afinfo.py @@ -1,215 +1,20 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -"""A module containing a plugin that verifies the operation function -pointers of network protocols.""" import logging -from typing import List, Tuple, Generator - -from volatility3.framework import exceptions, interfaces -from volatility3.framework import renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins -from volatility3.framework.renderers import format_hints +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import check_afinfo vollog = logging.getLogger(__name__) -class Check_afinfo(plugins.PluginInterface): - """Verifies the operation function pointers of network protocols.""" +class Check_afinfo( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=check_afinfo.Check_afinfo, + removal_date="2026-06-07", +): + """Verifies the operation function pointers of network protocols (deprecated).""" _version = (1, 0, 0) _required_framework_version = (2, 0, 0) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - ] - - @classmethod - def _check_members( - cls, - context: interfaces.context.ContextInterface, - vmlinux_name: str, - var_ops: interfaces.objects.ObjectInterface, - var_name: str, - members: List[str], - ) -> Generator[Tuple[str, str, int], None, None]: - """ - Yields any members that are not pointing inside the kernel - """ - - vmlinux = context.modules[vmlinux_name] - - for check in members: - # redhat-specific garbage - if check.startswith("__UNIQUE_ID_rh_kabi_hide"): - continue - - # These structures have members like `write` and `next`, which are built in Python functions - addr = var_ops.member(attr=check) - - # Unimplemented handlers are set to 0 - if not addr: - continue - - if len(vmlinux.get_symbols_by_absolute_location(addr)) == 0: - yield var_name, check, addr - - @classmethod - def _check_pre_4_18_ops( - cls, - context: interfaces.context.ContextInterface, - vmlinux_name: str, - var_name: str, - var: interfaces.objects.ObjectInterface, - op_members: List[str], - seq_members: List[str], - ): - """ - Finds the correct way to reference `op_members` - """ - vmlinux = context.modules[vmlinux_name] - - if var.has_member("seq_fops"): - yield from cls._check_members( - context, vmlinux_name, var.seq_fops, var_name, op_members - ) - # newer kernels - if var.has_member("seq_ops"): - yield from cls._check_members( - context, vmlinux_name, var.seq_ops, var_name, seq_members - ) - - # this is the most commonly hooked member by rootkits, so a force a check on it - elif var.has_member("seq_show"): - if len(vmlinux.get_symbols_by_location(var.seq_show)) == 0: - yield var_name, "show", var.seq_show - else: - raise exceptions.VolatilityException( - "_check_afinfo_pre_4_18: Unable to find sequence operations members for checking." - ) - - @classmethod - def _check_afinfo_pre_4_18( - cls, - context: interfaces.context.ContextInterface, - vmlinux_name: str, - seq_members: str, - ) -> Generator[Tuple[str, str, int], None, None]: - """ - Checks the operations structures for network protocols of < 4.18 systems - """ - tcp = ("tcp_seq_afinfo", ["tcp6_seq_afinfo", "tcp4_seq_afinfo"]) - udp = ( - "udp_seq_afinfo", - [ - "udplite6_seq_afinfo", - "udp6_seq_afinfo", - "udplite4_seq_afinfo", - "udp4_seq_afinfo", - ], - ) - protocols = [tcp, udp] - - vmlinux = context.modules[vmlinux_name] - - op_members = vmlinux.get_type("file_operations").members - - # loop through all symbols - for struct_type, global_vars in protocols: - for global_var_name in global_vars: - # this will lookup fail for the IPv6 protocols on kernels without IPv6 support - try: - global_var = vmlinux.object_from_symbol(global_var_name) - except exceptions.SymbolError: - continue - - yield from cls._check_pre_4_18_ops( - context, - vmlinux_name, - global_var_name, - global_var, - op_members, - seq_members, - ) - - @classmethod - def _check_afinfo_post_4_18( - cls, - context: interfaces.context.ContextInterface, - vmlinux_name: str, - seq_members: str, - ) -> Generator[Tuple[str, str, int], None, None]: - """ - Checks the operations structures for network protocols of >= 4.18 systems - """ - vmlinux = context.modules[vmlinux_name] - - ops_structs = [ - "raw_seq_ops", - "udp_seq_ops", - "arp_seq_ops", - "unix_seq_ops", - "udp6_seq_ops", - "raw6_seq_ops", - "tcp_seq_ops", - "tcp4_seq_ops", - "tcp6_seq_ops", - "packet_seq_ops", - ] - - for protocol_ops_var in ops_structs: - # These will fail if the particular kernel doesn't have support for a protocol like IPv6 - try: - protocol_ops = vmlinux.object_from_symbol(protocol_ops_var) - except exceptions.SymbolError: - continue - - yield from cls._check_members( - context, vmlinux_name, protocol_ops, protocol_ops_var, seq_members - ) - - @classmethod - def check_afinfo( - cls, context: interfaces.context.ContextInterface, vmlinux_name - ) -> Generator[Tuple[str, str, int], None, None]: - """ - Walks the network protocol operations structures for common network protocols. - Reports any initialized operations members that do not point inside the kernel. - """ - vmlinux = context.modules[vmlinux_name] - - type_check = vmlinux.get_type("tcp_seq_afinfo") - if type_check.has_member("seq_fops"): - checker = cls._check_afinfo_pre_4_18 - else: - checker = cls._check_afinfo_post_4_18 - - seq_members = vmlinux.get_type("seq_operations").members - - yield from checker(context, vmlinux_name, seq_members) - - def _generator(self): - """ - A simple wrapper around `check_afino` - """ - for name, member, address in self.check_afinfo( - self.context, self.config["kernel"] - ): - yield 0, (name, member, format_hints.Hex(address)) - - def run(self): - return renderers.TreeGrid( - [ - ("Symbol Name", str), - ("Member", str), - ("Handler Address", format_hints.Hex), - ], - self._generator(), - ) diff --git a/volatility3/framework/plugins/linux/malware/check_afinfo.py b/volatility3/framework/plugins/linux/malware/check_afinfo.py new file mode 100644 index 000000000..47da21615 --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/check_afinfo.py @@ -0,0 +1,215 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +"""A module containing a plugin that verifies the operation function +pointers of network protocols.""" +import logging +from typing import List, Tuple, Generator + +from volatility3.framework import exceptions, interfaces +from volatility3.framework import renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.renderers import format_hints + +vollog = logging.getLogger(__name__) + + +class Check_afinfo(plugins.PluginInterface): + """Verifies the operation function pointers of network protocols.""" + + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + ] + + @classmethod + def _check_members( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + var_ops: interfaces.objects.ObjectInterface, + var_name: str, + members: List[str], + ) -> Generator[Tuple[str, str, int], None, None]: + """ + Yields any members that are not pointing inside the kernel + """ + + vmlinux = context.modules[vmlinux_name] + + for check in members: + # redhat-specific garbage + if check.startswith("__UNIQUE_ID_rh_kabi_hide"): + continue + + # These structures have members like `write` and `next`, which are built in Python functions + addr = var_ops.member(attr=check) + + # Unimplemented handlers are set to 0 + if not addr: + continue + + if len(vmlinux.get_symbols_by_absolute_location(addr)) == 0: + yield var_name, check, addr + + @classmethod + def _check_pre_4_18_ops( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + var_name: str, + var: interfaces.objects.ObjectInterface, + op_members: List[str], + seq_members: List[str], + ): + """ + Finds the correct way to reference `op_members` + """ + vmlinux = context.modules[vmlinux_name] + + if var.has_member("seq_fops"): + yield from cls._check_members( + context, vmlinux_name, var.seq_fops, var_name, op_members + ) + # newer kernels + if var.has_member("seq_ops"): + yield from cls._check_members( + context, vmlinux_name, var.seq_ops, var_name, seq_members + ) + + # this is the most commonly hooked member by rootkits, so a force a check on it + elif var.has_member("seq_show"): + if len(vmlinux.get_symbols_by_location(var.seq_show)) == 0: + yield var_name, "show", var.seq_show + else: + raise exceptions.VolatilityException( + "_check_afinfo_pre_4_18: Unable to find sequence operations members for checking." + ) + + @classmethod + def _check_afinfo_pre_4_18( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + seq_members: str, + ) -> Generator[Tuple[str, str, int], None, None]: + """ + Checks the operations structures for network protocols of < 4.18 systems + """ + tcp = ("tcp_seq_afinfo", ["tcp6_seq_afinfo", "tcp4_seq_afinfo"]) + udp = ( + "udp_seq_afinfo", + [ + "udplite6_seq_afinfo", + "udp6_seq_afinfo", + "udplite4_seq_afinfo", + "udp4_seq_afinfo", + ], + ) + protocols = [tcp, udp] + + vmlinux = context.modules[vmlinux_name] + + op_members = vmlinux.get_type("file_operations").members + + # loop through all symbols + for struct_type, global_vars in protocols: + for global_var_name in global_vars: + # this will lookup fail for the IPv6 protocols on kernels without IPv6 support + try: + global_var = vmlinux.object_from_symbol(global_var_name) + except exceptions.SymbolError: + continue + + yield from cls._check_pre_4_18_ops( + context, + vmlinux_name, + global_var_name, + global_var, + op_members, + seq_members, + ) + + @classmethod + def _check_afinfo_post_4_18( + cls, + context: interfaces.context.ContextInterface, + vmlinux_name: str, + seq_members: str, + ) -> Generator[Tuple[str, str, int], None, None]: + """ + Checks the operations structures for network protocols of >= 4.18 systems + """ + vmlinux = context.modules[vmlinux_name] + + ops_structs = [ + "raw_seq_ops", + "udp_seq_ops", + "arp_seq_ops", + "unix_seq_ops", + "udp6_seq_ops", + "raw6_seq_ops", + "tcp_seq_ops", + "tcp4_seq_ops", + "tcp6_seq_ops", + "packet_seq_ops", + ] + + for protocol_ops_var in ops_structs: + # These will fail if the particular kernel doesn't have support for a protocol like IPv6 + try: + protocol_ops = vmlinux.object_from_symbol(protocol_ops_var) + except exceptions.SymbolError: + continue + + yield from cls._check_members( + context, vmlinux_name, protocol_ops, protocol_ops_var, seq_members + ) + + @classmethod + def check_afinfo( + cls, context: interfaces.context.ContextInterface, vmlinux_name + ) -> Generator[Tuple[str, str, int], None, None]: + """ + Walks the network protocol operations structures for common network protocols. + Reports any initialized operations members that do not point inside the kernel. + """ + vmlinux = context.modules[vmlinux_name] + + type_check = vmlinux.get_type("tcp_seq_afinfo") + if type_check.has_member("seq_fops"): + checker = cls._check_afinfo_pre_4_18 + else: + checker = cls._check_afinfo_post_4_18 + + seq_members = vmlinux.get_type("seq_operations").members + + yield from checker(context, vmlinux_name, seq_members) + + def _generator(self): + """ + A simple wrapper around `check_afino` + """ + for name, member, address in self.check_afinfo( + self.context, self.config["kernel"] + ): + yield 0, (name, member, format_hints.Hex(address)) + + def run(self): + return renderers.TreeGrid( + [ + ("Symbol Name", str), + ("Member", str), + ("Handler Address", format_hints.Hex), + ], + self._generator(), + ) From 1d2b78976a9fe0bbe201dba1df810afe837e8863 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:54:44 +0300 Subject: [PATCH 1158/1352] Plugins: categorize linux.hidden_modules as a malware plugin --- test/plugins/linux/linux.py | 2 +- .../framework/plugins/linux/hidden_modules.py | 196 +---------------- .../plugins/linux/malware/hidden_modules.py | 197 ++++++++++++++++++ 3 files changed, 208 insertions(+), 187 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/hidden_modules.py diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index 6b4ae1363..63ccc3388 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -525,7 +525,7 @@ class TestLinuxHiddenModules: # TODO: this check should be specific, against a distinct infected sample image = LinuxSamples.LINUX_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( - "linux.hidden_modules.Hidden_modules", image, volatility, python + "linux.malware.hidden_modules.Hidden_modules", image, volatility, python ) # linux-sample-1.bin has no hidden modules. diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index dcd602c5d..eab3c19a2 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -1,197 +1,21 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Set, Tuple, Iterable -from volatility3.framework.symbols.linux.utilities import ( - modules as linux_utilities_modules, -) -from volatility3.framework import interfaces, exceptions, deprecation -from volatility3.framework.configuration import requirements -from volatility3.framework.symbols.linux import extensions -from volatility3.framework.interfaces import plugins +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import hidden_modules vollog = logging.getLogger(__name__) -class Hidden_modules(plugins.PluginInterface): - """Carves memory to find hidden kernel modules""" +class Hidden_modules( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=hidden_modules.Hidden_modules, + removal_date="2026-06-07", +): + """Carves memory to find hidden kernel modules (deprecated).""" _required_framework_version = (2, 25, 0) _version = (3, 0, 2) - @classmethod - def find_hidden_modules( - cls, context, vmlinux_module_name: str - ) -> extensions.module: - if context.symbol_space.verify_table_versions( - "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0) - ): - raise exceptions.SymbolSpaceError( - "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later" - ) - - known_module_addresses = cls.get_lsmod_module_addresses( - context, vmlinux_module_name - ) - modules_memory_boundaries = ( - linux_utilities_modules.Modules.get_modules_memory_boundaries( - context, vmlinux_module_name - ) - ) - - yield from linux_utilities_modules.Modules.get_hidden_modules( - context, - vmlinux_module_name, - known_module_addresses, - modules_memory_boundaries, - ) - - @classmethod - def get_hidden_modules( - cls, - context: interfaces.context.ContextInterface, - vmlinux_module_name: str, - known_module_addresses: Set[int], - modules_memory_boundaries: Tuple, - ) -> Iterable[interfaces.objects.ObjectInterface]: - """Enumerate hidden modules by taking advantage of memory address alignment patterns - - This technique is much faster and uses less memory than the traditional scan method - in Volatility2, but it doesn't work with older kernels. - - From kernels 4.2 struct module allocation are aligned to the L1 cache line size. - In i386/amd64/arm64 this is typically 64 bytes. However, this can be changed in - the Linux kernel configuration via CONFIG_X86_L1_CACHE_SHIFT. The alignment can - also be obtained from the DWARF info i.e. DW_AT_alignment<64>, but dwarf2json - doesn't support this feature yet. - In kernels < 4.2, alignment attributes are absent in the struct module, meaning - alignment cannot be guaranteed. Therefore, for older kernels, it's better to use - the traditional scan technique. - - Args: - context: The context to retrieve required elements (layers, symbol tables) from - vmlinux_module_name: The name of the kernel module on which to operate - known_module_addresses: Set with known module addresses - modules_memory_boundaries: Minimum and maximum address boundaries for module allocation. - Yields: - module objects - """ - return linux_utilities_modules.get_hidden_modules( - vmlinux_module_name, known_module_addresses, modules_memory_boundaries - ) - - run = linux_utilities_modules.ModuleDisplayPlugin.run - _generator = linux_utilities_modules.ModuleDisplayPlugin.generator - implementation = find_hidden_modules - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.VersionRequirement( - name="linux_utilities_modules_module_display_plugin", - component=linux_utilities_modules.ModuleDisplayPlugin, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 1), - ), - ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() - - @staticmethod - @deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, - removal_date="2025-09-25", - replacement_version=(3, 0, 0), - ) - def get_modules_memory_boundaries( - context: interfaces.context.ContextInterface, - vmlinux_module_name: str, - ) -> Tuple[int, int]: - return linux_utilities_modules.Modules.get_modules_memory_boundaries( - context, vmlinux_module_name - ) - - @deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.get_module_address_alignment, - removal_date="2025-09-25", - replacement_version=(3, 0, 0), - ) - @classmethod - def _get_module_address_alignment( - cls, - context: interfaces.context.ContextInterface, - vmlinux_module_name: str, - ) -> int: - """Obtain the module memory address alignment. - - struct module is aligned to the L1 cache line, which is typically 64 bytes for most - common i386/AMD64/ARM64 configurations. In some cases, it can be 128 bytes, but this - will still work. - - Args: - context: The context to retrieve required elements (layers, symbol tables) from - vmlinux_module_name: The name of the kernel module on which to operate - - Returns: - The struct module alignment - """ - return linux_utilities_modules.get_module_address_alignment( - context, vmlinux_module_name - ) - - @deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.get_hidden_modules, - removal_date="2025-09-25", - replacement_version=(3, 0, 0), - ) - @staticmethod - @deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.validate_alignment_patterns, - removal_date="2025-09-25", - replacement_version=(3, 0, 0), - ) - def _validate_alignment_patterns( - addresses: Iterable[int], - address_alignment: int, - ) -> bool: - """Check if the memory addresses meet our alignments patterns - - Args: - addresses: Iterable with the address values - address_alignment: Number of bytes for alignment validation - - Returns: - True if all the addresses meet the alignment - """ - return linux_utilities_modules.validate_alignment_patterns( - addresses, address_alignment - ) - - @classmethod - def get_lsmod_module_addresses( - cls, - context: interfaces.context.ContextInterface, - vmlinux_module_name: str, - ) -> Set[int]: - """Obtain a set the known module addresses from linux.lsmod plugin - - Args: - context: The context to retrieve required elements (layers, symbol tables) from - vmlinux_module_name: The name of the kernel module on which to operate - - Returns: - A set containing known kernel module addresses - """ - vmlinux = context.modules[vmlinux_module_name] - vmlinux_layer = context.layers[vmlinux.layer_name] - - known_module_addresses = { - vmlinux_layer.canonicalize(module.vol.offset) - for module in linux_utilities_modules.Modules.list_modules( - context, vmlinux_module_name - ) - } - return known_module_addresses diff --git a/volatility3/framework/plugins/linux/malware/hidden_modules.py b/volatility3/framework/plugins/linux/malware/hidden_modules.py new file mode 100644 index 000000000..dcd602c5d --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/hidden_modules.py @@ -0,0 +1,197 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List, Set, Tuple, Iterable +from volatility3.framework.symbols.linux.utilities import ( + modules as linux_utilities_modules, +) +from volatility3.framework import interfaces, exceptions, deprecation +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.interfaces import plugins + +vollog = logging.getLogger(__name__) + + +class Hidden_modules(plugins.PluginInterface): + """Carves memory to find hidden kernel modules""" + + _required_framework_version = (2, 25, 0) + _version = (3, 0, 2) + + @classmethod + def find_hidden_modules( + cls, context, vmlinux_module_name: str + ) -> extensions.module: + if context.symbol_space.verify_table_versions( + "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0) + ): + raise exceptions.SymbolSpaceError( + "Invalid symbol table, please ensure the ISF table produced by dwarf2json was created with version 0.8.0 or later" + ) + + known_module_addresses = cls.get_lsmod_module_addresses( + context, vmlinux_module_name + ) + modules_memory_boundaries = ( + linux_utilities_modules.Modules.get_modules_memory_boundaries( + context, vmlinux_module_name + ) + ) + + yield from linux_utilities_modules.Modules.get_hidden_modules( + context, + vmlinux_module_name, + known_module_addresses, + modules_memory_boundaries, + ) + + @classmethod + def get_hidden_modules( + cls, + context: interfaces.context.ContextInterface, + vmlinux_module_name: str, + known_module_addresses: Set[int], + modules_memory_boundaries: Tuple, + ) -> Iterable[interfaces.objects.ObjectInterface]: + """Enumerate hidden modules by taking advantage of memory address alignment patterns + + This technique is much faster and uses less memory than the traditional scan method + in Volatility2, but it doesn't work with older kernels. + + From kernels 4.2 struct module allocation are aligned to the L1 cache line size. + In i386/amd64/arm64 this is typically 64 bytes. However, this can be changed in + the Linux kernel configuration via CONFIG_X86_L1_CACHE_SHIFT. The alignment can + also be obtained from the DWARF info i.e. DW_AT_alignment<64>, but dwarf2json + doesn't support this feature yet. + In kernels < 4.2, alignment attributes are absent in the struct module, meaning + alignment cannot be guaranteed. Therefore, for older kernels, it's better to use + the traditional scan technique. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + vmlinux_module_name: The name of the kernel module on which to operate + known_module_addresses: Set with known module addresses + modules_memory_boundaries: Minimum and maximum address boundaries for module allocation. + Yields: + module objects + """ + return linux_utilities_modules.get_hidden_modules( + vmlinux_module_name, known_module_addresses, modules_memory_boundaries + ) + + run = linux_utilities_modules.ModuleDisplayPlugin.run + _generator = linux_utilities_modules.ModuleDisplayPlugin.generator + implementation = find_hidden_modules + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.VersionRequirement( + name="linux_utilities_modules_module_display_plugin", + component=linux_utilities_modules.ModuleDisplayPlugin, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 1), + ), + ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() + + @staticmethod + @deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, + removal_date="2025-09-25", + replacement_version=(3, 0, 0), + ) + def get_modules_memory_boundaries( + context: interfaces.context.ContextInterface, + vmlinux_module_name: str, + ) -> Tuple[int, int]: + return linux_utilities_modules.Modules.get_modules_memory_boundaries( + context, vmlinux_module_name + ) + + @deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.get_module_address_alignment, + removal_date="2025-09-25", + replacement_version=(3, 0, 0), + ) + @classmethod + def _get_module_address_alignment( + cls, + context: interfaces.context.ContextInterface, + vmlinux_module_name: str, + ) -> int: + """Obtain the module memory address alignment. + + struct module is aligned to the L1 cache line, which is typically 64 bytes for most + common i386/AMD64/ARM64 configurations. In some cases, it can be 128 bytes, but this + will still work. + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + vmlinux_module_name: The name of the kernel module on which to operate + + Returns: + The struct module alignment + """ + return linux_utilities_modules.get_module_address_alignment( + context, vmlinux_module_name + ) + + @deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.get_hidden_modules, + removal_date="2025-09-25", + replacement_version=(3, 0, 0), + ) + @staticmethod + @deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.validate_alignment_patterns, + removal_date="2025-09-25", + replacement_version=(3, 0, 0), + ) + def _validate_alignment_patterns( + addresses: Iterable[int], + address_alignment: int, + ) -> bool: + """Check if the memory addresses meet our alignments patterns + + Args: + addresses: Iterable with the address values + address_alignment: Number of bytes for alignment validation + + Returns: + True if all the addresses meet the alignment + """ + return linux_utilities_modules.validate_alignment_patterns( + addresses, address_alignment + ) + + @classmethod + def get_lsmod_module_addresses( + cls, + context: interfaces.context.ContextInterface, + vmlinux_module_name: str, + ) -> Set[int]: + """Obtain a set the known module addresses from linux.lsmod plugin + + Args: + context: The context to retrieve required elements (layers, symbol tables) from + vmlinux_module_name: The name of the kernel module on which to operate + + Returns: + A set containing known kernel module addresses + """ + vmlinux = context.modules[vmlinux_module_name] + vmlinux_layer = context.layers[vmlinux.layer_name] + + known_module_addresses = { + vmlinux_layer.canonicalize(module.vol.offset) + for module in linux_utilities_modules.Modules.list_modules( + context, vmlinux_module_name + ) + } + return known_module_addresses From 5144f26a8edbe99b90411bfbaa354d4afa1d0b47 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 19:58:12 +0300 Subject: [PATCH 1159/1352] CI --- volatility3/framework/plugins/linux/hidden_modules.py | 1 - 1 file changed, 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/hidden_modules.py b/volatility3/framework/plugins/linux/hidden_modules.py index eab3c19a2..f7bdd6b0b 100644 --- a/volatility3/framework/plugins/linux/hidden_modules.py +++ b/volatility3/framework/plugins/linux/hidden_modules.py @@ -18,4 +18,3 @@ class Hidden_modules( _required_framework_version = (2, 25, 0) _version = (3, 0, 2) - From 35c4e9f50b3b7dc09af0bb0c7bccbe884bf819db Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 21:52:22 +0300 Subject: [PATCH 1160/1352] Plugins: change class name to original --- volatility3/framework/plugins/windows/unhooked_system_calls.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index e6fb2fb6c..a0864e38d 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -8,7 +8,7 @@ from volatility3.plugins.windows.malware import unhooked_system_calls vollog = logging.getLogger(__name__) -class UnhookedSystemCalls( +class unhooked_system_calls( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=unhooked_system_calls.UnhookedSystemCalls, From 21d66839fe942aeb327572f7056850ea813d396d Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 21:56:36 +0300 Subject: [PATCH 1161/1352] use class name with module name? --- .../framework/plugins/windows/unhooked_system_calls.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index a0864e38d..fa88f5523 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -3,7 +3,7 @@ # import logging from volatility3.framework import interfaces, deprecation -from volatility3.plugins.windows.malware import unhooked_system_calls +from volatility3.plugins.windows import malware vollog = logging.getLogger(__name__) @@ -11,7 +11,7 @@ vollog = logging.getLogger(__name__) class unhooked_system_calls( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, - replacement_class=unhooked_system_calls.UnhookedSystemCalls, + replacement_class=malware.unhooked_system_calls.UnhookedSystemCalls, removal_date="2026-06-07", ): """Detects hooked ntdll.dll stub functions in Windows processes (deprecated).""" From c71fd30c8a4baa873b27044546822b7e9084ad62 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 21:58:43 +0300 Subject: [PATCH 1162/1352] shortcut class name --- .../framework/plugins/windows/unhooked_system_calls.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index fa88f5523..70219da13 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -3,7 +3,7 @@ # import logging from volatility3.framework import interfaces, deprecation -from volatility3.plugins.windows import malware +from volatility3.plugins.windows.malware import unhooked_system_calls as unhooked_syscalls vollog = logging.getLogger(__name__) @@ -11,7 +11,7 @@ vollog = logging.getLogger(__name__) class unhooked_system_calls( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, - replacement_class=malware.unhooked_system_calls.UnhookedSystemCalls, + replacement_class=unhooked_syscalls.UnhookedSystemCalls, removal_date="2026-06-07", ): """Detects hooked ntdll.dll stub functions in Windows processes (deprecated).""" From f9941b5b6ec67d79da687870d727c8ea082cd3e5 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 22:00:03 +0300 Subject: [PATCH 1163/1352] black --- .../framework/plugins/windows/unhooked_system_calls.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py index 70219da13..3827bbe6e 100644 --- a/volatility3/framework/plugins/windows/unhooked_system_calls.py +++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py @@ -3,7 +3,9 @@ # import logging from volatility3.framework import interfaces, deprecation -from volatility3.plugins.windows.malware import unhooked_system_calls as unhooked_syscalls +from volatility3.plugins.windows.malware import ( + unhooked_system_calls as unhooked_syscalls, +) vollog = logging.getLogger(__name__) From faf7d781be8f7b15d15d28126676dc7d11b2e12e Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 22:55:29 +0300 Subject: [PATCH 1164/1352] Plugins: categorize linux.keyboard_notifiers as a malware plugin --- test/plugins/linux/linux.py | 2 +- .../plugins/linux/keyboard_notifiers.py | 106 ++---------------- .../linux/malware/keyboard_notifiers.py | 105 +++++++++++++++++ 3 files changed, 117 insertions(+), 96 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/keyboard_notifiers.py diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index e39c1d15d..9a11d9c95 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -479,7 +479,7 @@ class TestLinuxIomem: class TestLinuxKeyboardNotifiers: def test_linux_generic_keyboard_notifiers(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.keyboard_notifiers.Keyboard_notifiers", image, volatility, python + "linux.malware.keyboard_notifiers.Keyboard_notifiers", image, volatility, python ) # linux-sample-1.bin has no suspicious results for this plugin. diff --git a/volatility3/framework/plugins/linux/keyboard_notifiers.py b/volatility3/framework/plugins/linux/keyboard_notifiers.py index 215704350..72dcc7bad 100644 --- a/volatility3/framework/plugins/linux/keyboard_notifiers.py +++ b/volatility3/framework/plugins/linux/keyboard_notifiers.py @@ -1,104 +1,20 @@ -# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - import logging - -import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, renderers, exceptions -from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols import linux +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import keyboard_notifiers vollog = logging.getLogger(__name__) -class Keyboard_notifiers(interfaces.plugins.PluginInterface): - """Parses the keyboard notifier call chain""" +class Keyboard_notifiers( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=keyboard_notifiers.Keyboard_notifiers, + removal_date="2026-06-07", +): + """Parses the keyboard notifier call chain (deprecated).""" _required_framework_version = (2, 0, 0) - - @classmethod - def get_requirements(cls): - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 0), - ), - requirements.VersionRequirement( - name="linux_utilities_module_gatherers", - component=linux_utilities_modules.ModuleGatherers, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) - ), - ] - - def _generator(self): - vmlinux = self.context.modules[self.config["kernel"]] - - try: - knl_addr = vmlinux.object_from_symbol("keyboard_notifier_list") - except exceptions.SymbolError: - knl_addr = None - - if not knl_addr: - raise TypeError( - "This plugin requires the keyboard_notifier_list structure. " - "This structure is not present in the supplied symbol table. " - "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." - ) - - if not self.context.layers[vmlinux.layer_name].is_valid(knl_addr.vol.offset): - vollog.error("The head of the keyboard notifier list is paged out.") - return - - known_modules = linux_utilities_modules.Modules.run_modules_scanners( - context=self.context, - kernel_module_name=self.config["kernel"], - caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, - ) - - knl = vmlinux.object( - object_type="atomic_notifier_head", - offset=knl_addr.vol.offset, - absolute=True, - ) - - for call_back in linux.LinuxUtilities.walk_internal_list( - vmlinux, "notifier_block", "next", knl.head - ): - call_addr = call_back.notifier_call - - module_info, symbol_name = ( - linux_utilities_modules.Modules.module_lookup_by_address( - self.context, vmlinux.name, known_modules, call_addr - ) - ) - - if module_info: - module_name = module_info.name - else: - module_name = renderers.NotAvailableValue() - - yield ( - 0, - [ - format_hints.Hex(call_addr), - module_name, - symbol_name or renderers.NotAvailableValue(), - ], - ) - - def run(self): - return renderers.TreeGrid( - [("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], - self._generator(), - ) + _version = (1, 0, 0) diff --git a/volatility3/framework/plugins/linux/malware/keyboard_notifiers.py b/volatility3/framework/plugins/linux/malware/keyboard_notifiers.py new file mode 100644 index 000000000..9e99809b2 --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/keyboard_notifiers.py @@ -0,0 +1,105 @@ +# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging + +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux + +vollog = logging.getLogger(__name__) + + +class Keyboard_notifiers(interfaces.plugins.PluginInterface): + """Parses the keyboard notifier call chain""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls): + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) + ), + ] + + def _generator(self): + vmlinux = self.context.modules[self.config["kernel"]] + + try: + knl_addr = vmlinux.object_from_symbol("keyboard_notifier_list") + except exceptions.SymbolError: + knl_addr = None + + if not knl_addr: + raise TypeError( + "This plugin requires the keyboard_notifier_list structure. " + "This structure is not present in the supplied symbol table. " + "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." + ) + + if not self.context.layers[vmlinux.layer_name].is_valid(knl_addr.vol.offset): + vollog.error("The head of the keyboard notifier list is paged out.") + return + + known_modules = linux_utilities_modules.Modules.run_modules_scanners( + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, + ) + + knl = vmlinux.object( + object_type="atomic_notifier_head", + offset=knl_addr.vol.offset, + absolute=True, + ) + + for call_back in linux.LinuxUtilities.walk_internal_list( + vmlinux, "notifier_block", "next", knl.head + ): + call_addr = call_back.notifier_call + + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self.context, vmlinux.name, known_modules, call_addr + ) + ) + + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + + yield ( + 0, + [ + format_hints.Hex(call_addr), + module_name, + symbol_name or renderers.NotAvailableValue(), + ], + ) + + def run(self): + return renderers.TreeGrid( + [("Address", format_hints.Hex), ("Module", str), ("Symbol", str)], + self._generator(), + ) From a06d59bc52d670ba3ba9ccef11c0fdd9d4e88d0c Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 22:58:46 +0300 Subject: [PATCH 1165/1352] Plugins: categorize linux.malfind as a malware plugin --- test/plugins/linux/linux.py | 7 +- .../framework/plugins/linux/malfind.py | 114 ++---------------- .../plugins/linux/malware/malfind.py | 114 ++++++++++++++++++ 3 files changed, 129 insertions(+), 106 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/malfind.py diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index 9a11d9c95..69aeb8a6c 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -251,7 +251,7 @@ class TestLinuxKthreads: class TestLinuxMalfind: def test_linux_generic_malfind(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.malfind.Malfind", image, volatility, python + "linux.malware.malfind.Malfind", image, volatility, python ) # linux-sample-1.bin has no process memory ranges with potential injected code. @@ -479,7 +479,10 @@ class TestLinuxIomem: class TestLinuxKeyboardNotifiers: def test_linux_generic_keyboard_notifiers(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.malware.keyboard_notifiers.Keyboard_notifiers", image, volatility, python + "linux.malware.keyboard_notifiers.Keyboard_notifiers", + image, + volatility, + python, ) # linux-sample-1.bin has no suspicious results for this plugin. diff --git a/volatility3/framework/plugins/linux/malfind.py b/volatility3/framework/plugins/linux/malfind.py index c7e141c02..647e1531a 100644 --- a/volatility3/framework/plugins/linux/malfind.py +++ b/volatility3/framework/plugins/linux/malfind.py @@ -1,114 +1,20 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - -from typing import List, Tuple, Optional import logging -from volatility3.framework import interfaces -from volatility3.framework import renderers, symbols -from volatility3.framework.configuration import requirements -from volatility3.framework.objects import utility -from volatility3.framework.renderers import format_hints -from volatility3.plugins.linux import pslist +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import malfind vollog = logging.getLogger(__name__) -class Malfind(interfaces.plugins.PluginInterface): - """Lists process memory ranges that potentially contain injected code.""" +class Malfind( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=malfind.Malfind, + removal_date="2026-06-07", +): + """Lists process memory ranges that potentially contain injected code (deprecated).""" _required_framework_version = (2, 0, 0) _version = (1, 0, 3) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(4, 0, 0) - ), - requirements.ListRequirement( - name="pid", - description="Filter on specific process IDs", - element_type=int, - optional=True, - ), - ] - - def _list_injections( - self, task - ) -> Tuple[interfaces.objects.ObjectInterface, Optional[str], bytes]: - """Generate memory regions for a process that may contain injected - code.""" - - proc_layer_name = task.add_process_layer() - if not proc_layer_name: - return None - - proc_layer = self.context.layers[proc_layer_name] - - for vma in task.mm.get_vma_iter(): - vma_name = vma.get_name(self.context, task) - vollog.debug( - f"Injections : processing PID {task.pid} : VMA {vma_name} : {hex(vma.vm_start)}-{hex(vma.vm_end)}" - ) - if vma.is_suspicious(proc_layer) and vma_name != "[vdso]": - data = proc_layer.read(vma.vm_start, 64, pad=True) - yield vma, vma_name, data - - def _generator(self, tasks): - # determine if we're on a 32 or 64 bit kernel - vmlinux = self.context.modules[self.config["kernel"]] - is_32bit_arch = not symbols.symbol_table_is_64bit( - context=self.context, symbol_table_name=vmlinux.symbol_table_name - ) - - for task in tasks: - process_name = utility.array_to_string(task.comm) - - for vma, vma_name, data in self._list_injections(task): - if is_32bit_arch: - architecture = "intel" - else: - architecture = "intel64" - - disasm = renderers.Disassembly(data, vma.vm_start, architecture) - - yield ( - 0, - ( - task.pid, - process_name, - format_hints.Hex(vma.vm_start), - format_hints.Hex(vma.vm_end), - vma_name or renderers.NotAvailableValue(), - vma.get_protection(), - format_hints.HexBytes(data), - disasm, - ), - ) - - def run(self): - filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - - return renderers.TreeGrid( - [ - ("PID", int), - ("Process", str), - ("Start", format_hints.Hex), - ("End", format_hints.Hex), - ("Path", str), - ("Protection", str), - ("Hexdump", format_hints.HexBytes), - ("Disasm", renderers.Disassembly), - ], - self._generator( - pslist.PsList.list_tasks( - self.context, self.config["kernel"], filter_func=filter_func - ) - ), - ) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py new file mode 100644 index 000000000..c7e141c02 --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -0,0 +1,114 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +from typing import List, Tuple, Optional +import logging +from volatility3.framework import interfaces +from volatility3.framework import renderers, symbols +from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.plugins.linux import pslist + +vollog = logging.getLogger(__name__) + + +class Malfind(interfaces.plugins.PluginInterface): + """Lists process memory ranges that potentially contain injected code.""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 3) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) + ), + requirements.ListRequirement( + name="pid", + description="Filter on specific process IDs", + element_type=int, + optional=True, + ), + ] + + def _list_injections( + self, task + ) -> Tuple[interfaces.objects.ObjectInterface, Optional[str], bytes]: + """Generate memory regions for a process that may contain injected + code.""" + + proc_layer_name = task.add_process_layer() + if not proc_layer_name: + return None + + proc_layer = self.context.layers[proc_layer_name] + + for vma in task.mm.get_vma_iter(): + vma_name = vma.get_name(self.context, task) + vollog.debug( + f"Injections : processing PID {task.pid} : VMA {vma_name} : {hex(vma.vm_start)}-{hex(vma.vm_end)}" + ) + if vma.is_suspicious(proc_layer) and vma_name != "[vdso]": + data = proc_layer.read(vma.vm_start, 64, pad=True) + yield vma, vma_name, data + + def _generator(self, tasks): + # determine if we're on a 32 or 64 bit kernel + vmlinux = self.context.modules[self.config["kernel"]] + is_32bit_arch = not symbols.symbol_table_is_64bit( + context=self.context, symbol_table_name=vmlinux.symbol_table_name + ) + + for task in tasks: + process_name = utility.array_to_string(task.comm) + + for vma, vma_name, data in self._list_injections(task): + if is_32bit_arch: + architecture = "intel" + else: + architecture = "intel64" + + disasm = renderers.Disassembly(data, vma.vm_start, architecture) + + yield ( + 0, + ( + task.pid, + process_name, + format_hints.Hex(vma.vm_start), + format_hints.Hex(vma.vm_end), + vma_name or renderers.NotAvailableValue(), + vma.get_protection(), + format_hints.HexBytes(data), + disasm, + ), + ) + + def run(self): + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + + return renderers.TreeGrid( + [ + ("PID", int), + ("Process", str), + ("Start", format_hints.Hex), + ("End", format_hints.Hex), + ("Path", str), + ("Protection", str), + ("Hexdump", format_hints.HexBytes), + ("Disasm", renderers.Disassembly), + ], + self._generator( + pslist.PsList.list_tasks( + self.context, self.config["kernel"], filter_func=filter_func + ) + ), + ) From b2e836464694b8cf0e069e26430b767873e4cba6 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 10 Jun 2025 15:59:22 +0100 Subject: [PATCH 1166/1352] Windows: Fix pe_symbols type checking --- volatility3/framework/plugins/windows/pe_symbols.py | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/pe_symbols.py b/volatility3/framework/plugins/windows/pe_symbols.py index 00c6fd868..b21e39a8c 100644 --- a/volatility3/framework/plugins/windows/pe_symbols.py +++ b/volatility3/framework/plugins/windows/pe_symbols.py @@ -709,17 +709,15 @@ class PESymbols(interfaces.plugins.PluginInterface): # symbol_info will be a symbol name or address requested for symbol_info in wanted_symbols: - if ( - wanted_type == wanted_names_identifier - and type(symbol_info) not in valid_name_types + if wanted_type == wanted_names_identifier and not isinstance( + symbol_info, tuple(valid_name_types) ): raise ValueError( f"The requested symbol name has a type of {type(symbol_info)} which is not in the allowed set of {valid_name_types}" ) - elif ( - wanted_type == wanted_addresses_identifier - and type(symbol_info) not in valid_address_types + elif wanted_type == wanted_addresses_identifier and not isinstance( + symbol_info, tuple(valid_address_types) ): raise ValueError( f"The requested address has a type of {type(symbol_info)} which is not in the allowed set of {valid_address_types}" From 6c35bc3fa0135c7c4124b327d536f7ea4cba11ca Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 10 Jun 2025 19:12:09 +0300 Subject: [PATCH 1167/1352] Plugins: categorize linux.modxview as a malware plugin --- .../plugins/linux/malware/modxview.py | 181 ++++++++++++++++++ .../framework/plugins/linux/modxview.py | 181 ++---------------- 2 files changed, 192 insertions(+), 170 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/modxview.py diff --git a/volatility3/framework/plugins/linux/malware/modxview.py b/volatility3/framework/plugins/linux/malware/modxview.py new file mode 100644 index 000000000..c1707d26f --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/modxview.py @@ -0,0 +1,181 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import logging +from typing import List, Dict, Iterator + +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules + +from volatility3.framework import interfaces, deprecation, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.constants import architectures +from volatility3.framework.symbols.linux.utilities import tainting + +vollog = logging.getLogger(__name__) + + +class Modxview(interfaces.plugins.PluginInterface): + """Centralize lsmod, check_modules and hidden_modules results to efficiently \ +spot modules presence and taints.""" + + _version = (1, 0, 0) + _required_framework_version = (2, 17, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=architectures.LINUX_ARCHS, + ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherer_lsmod", + component=linux_utilities_modules.ModuleGathererLsmod, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherer_sysfs", + component=linux_utilities_modules.ModuleGathererSysFs, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherer_scanner", + component=linux_utilities_modules.ModuleGathererScanner, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) + ), + requirements.BooleanRequirement( + name="plain_taints", + description="Display the plain taints string for each module.", + optional=True, + default=False, + ), + ] + + @classmethod + @deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.flatten_run_modules_results, + replacement_version=(3, 0, 0), + removal_date="2025-09-25", + ) + def flatten_run_modules_results( + cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True + ) -> Iterator[extensions.module]: + """Flatten a dictionary mapping plugin names and modules list, to a single merged list. + This is useful to get a generic lookup list of all the detected modules. + + Args: + run_results: dictionary of plugin names mapping a list of detected modules + deduplicate: remove duplicate modules, based on their offsets + + Returns: + Iterator of modules objects + """ + return linux_utilities_modules.Modules.flatten_run_modules_results( + run_results, deduplicate + ) + + @classmethod + @deprecation.deprecated_method( + replacement=linux_utilities_modules.Modules.run_modules_scanners, + replacement_version=(3, 0, 0), + removal_date="2025-09-25", + ) + def run_modules_scanners( + cls, + context: interfaces.context.ContextInterface, + kernel_name: str, + run_hidden_modules: bool = True, + ) -> Dict[str, List[extensions.module]]: + """Run module scanning plugins and aggregate the results. It is designed + to not operate any inter-plugin results triage.""" + return linux_utilities_modules.Modules.run_modules_scanners( + context, kernel_name, run_hidden_modules + ) + + def _generator(self): + kernel = self.context.modules[self.config["kernel"]] + + wanted_gatherers = [ + linux_utilities_modules.ModuleGathererLsmod, + linux_utilities_modules.ModuleGathererSysFs, + linux_utilities_modules.ModuleGathererScanner, + ] + + run_results = linux_utilities_modules.Modules.run_modules_scanners( + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_gatherers=wanted_gatherers, + flatten=False, + ) + + aggregated_modules = {} + # We want to be explicit on the plugins results we are interested in + for gatherer in wanted_gatherers: + # Iterate over each recovered module + for mod_info in run_results[gatherer.name]: + # Use offsets as unique keys, whether a module + # appears in many plugin runs or not + if aggregated_modules.get(mod_info.offset, None) is not None: + # Append the plugin to the list of originating plugins + aggregated_modules[mod_info.offset].append(gatherer.name) + else: + aggregated_modules[mod_info.offset] = [gatherer.name] + + for module_offset, gatherers in aggregated_modules.items(): + module = kernel.object("module", offset=module_offset, absolute=True) + + # Tainting parsing capabilities applied to the module + if self.config.get("plain_taints"): + taints = tainting.Tainting.get_taints_as_plain_string( + self.context, + self.config["kernel"], + module.taints, + True, + ) + else: + taints = ",".join( + tainting.Tainting.get_taints_parsed( + self.context, + self.config["kernel"], + module.taints, + True, + ) + ) + + yield ( + 0, + ( + module.get_name() or renderers.NotAvailableValue(), + format_hints.Hex(module_offset), + linux_utilities_modules.ModuleGathererLsmod.name in gatherers, + linux_utilities_modules.ModuleGathererSysFs.name in gatherers, + linux_utilities_modules.ModuleGathererScanner.name in gatherers, + taints or renderers.NotAvailableValue(), + ), + ) + + def run(self): + columns = [ + ("Name", str), + ("Address", format_hints.Hex), + ("In procfs", bool), + ("In sysfs", bool), + ("In scan", bool), + ("Taints", str), + ] + + return renderers.TreeGrid( + columns, + self._generator(), + ) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index c1707d26f..f710b1291 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -1,181 +1,22 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Dict, Iterator - -import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules - -from volatility3.framework import interfaces, deprecation, renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols.linux import extensions -from volatility3.framework.constants import architectures -from volatility3.framework.symbols.linux.utilities import tainting +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import modxview vollog = logging.getLogger(__name__) -class Modxview(interfaces.plugins.PluginInterface): +class Modxview( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=modxview.Modxview, + removal_date="2026-06-07", +): + """Centralize lsmod, check_modules and hidden_modules results to efficiently \ -spot modules presence and taints.""" +spot modules presence and taints (deprecated).""" _version = (1, 0, 0) _required_framework_version = (2, 17, 0) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=architectures.LINUX_ARCHS, - ), - requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 0), - ), - requirements.VersionRequirement( - name="linux_utilities_module_gatherer_lsmod", - component=linux_utilities_modules.ModuleGathererLsmod, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="linux_utilities_module_gatherer_sysfs", - component=linux_utilities_modules.ModuleGathererSysFs, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="linux_utilities_module_gatherer_scanner", - component=linux_utilities_modules.ModuleGathererScanner, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) - ), - requirements.BooleanRequirement( - name="plain_taints", - description="Display the plain taints string for each module.", - optional=True, - default=False, - ), - ] - - @classmethod - @deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.flatten_run_modules_results, - replacement_version=(3, 0, 0), - removal_date="2025-09-25", - ) - def flatten_run_modules_results( - cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True - ) -> Iterator[extensions.module]: - """Flatten a dictionary mapping plugin names and modules list, to a single merged list. - This is useful to get a generic lookup list of all the detected modules. - - Args: - run_results: dictionary of plugin names mapping a list of detected modules - deduplicate: remove duplicate modules, based on their offsets - - Returns: - Iterator of modules objects - """ - return linux_utilities_modules.Modules.flatten_run_modules_results( - run_results, deduplicate - ) - - @classmethod - @deprecation.deprecated_method( - replacement=linux_utilities_modules.Modules.run_modules_scanners, - replacement_version=(3, 0, 0), - removal_date="2025-09-25", - ) - def run_modules_scanners( - cls, - context: interfaces.context.ContextInterface, - kernel_name: str, - run_hidden_modules: bool = True, - ) -> Dict[str, List[extensions.module]]: - """Run module scanning plugins and aggregate the results. It is designed - to not operate any inter-plugin results triage.""" - return linux_utilities_modules.Modules.run_modules_scanners( - context, kernel_name, run_hidden_modules - ) - - def _generator(self): - kernel = self.context.modules[self.config["kernel"]] - - wanted_gatherers = [ - linux_utilities_modules.ModuleGathererLsmod, - linux_utilities_modules.ModuleGathererSysFs, - linux_utilities_modules.ModuleGathererScanner, - ] - - run_results = linux_utilities_modules.Modules.run_modules_scanners( - context=self.context, - kernel_module_name=self.config["kernel"], - caller_wanted_gatherers=wanted_gatherers, - flatten=False, - ) - - aggregated_modules = {} - # We want to be explicit on the plugins results we are interested in - for gatherer in wanted_gatherers: - # Iterate over each recovered module - for mod_info in run_results[gatherer.name]: - # Use offsets as unique keys, whether a module - # appears in many plugin runs or not - if aggregated_modules.get(mod_info.offset, None) is not None: - # Append the plugin to the list of originating plugins - aggregated_modules[mod_info.offset].append(gatherer.name) - else: - aggregated_modules[mod_info.offset] = [gatherer.name] - - for module_offset, gatherers in aggregated_modules.items(): - module = kernel.object("module", offset=module_offset, absolute=True) - - # Tainting parsing capabilities applied to the module - if self.config.get("plain_taints"): - taints = tainting.Tainting.get_taints_as_plain_string( - self.context, - self.config["kernel"], - module.taints, - True, - ) - else: - taints = ",".join( - tainting.Tainting.get_taints_parsed( - self.context, - self.config["kernel"], - module.taints, - True, - ) - ) - - yield ( - 0, - ( - module.get_name() or renderers.NotAvailableValue(), - format_hints.Hex(module_offset), - linux_utilities_modules.ModuleGathererLsmod.name in gatherers, - linux_utilities_modules.ModuleGathererSysFs.name in gatherers, - linux_utilities_modules.ModuleGathererScanner.name in gatherers, - taints or renderers.NotAvailableValue(), - ), - ) - - def run(self): - columns = [ - ("Name", str), - ("Address", format_hints.Hex), - ("In procfs", bool), - ("In sysfs", bool), - ("In scan", bool), - ("Taints", str), - ] - - return renderers.TreeGrid( - columns, - self._generator(), - ) From 77801e4cb09ce54ca576bc2ee11ad009d6ce42fa Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 10 Jun 2025 19:22:12 +0300 Subject: [PATCH 1168/1352] Plugins: categorize linux.netfilter as a malware plugin --- test/plugins/linux/linux.py | 2 +- .../plugins/linux/malware/netfilter.py | 806 +++++++++++++++++ .../framework/plugins/linux/modxview.py | 1 - .../framework/plugins/linux/netfilter.py | 808 +----------------- 4 files changed, 818 insertions(+), 799 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/netfilter.py diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index e39c1d15d..c7f1df9c6 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -501,7 +501,7 @@ class TestLinuxKmesg: class TestLinuxNetfilter: def test_linux_generic_netfilter(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.netfilter.Netfilter", image, volatility, python + "linux.malware.netfilter.Netfilter", image, volatility, python ) # linux-sample-1.bin has no suspicious results for this plugin. diff --git a/volatility3/framework/plugins/linux/malware/netfilter.py b/volatility3/framework/plugins/linux/malware/netfilter.py new file mode 100644 index 000000000..d724d4296 --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/netfilter.py @@ -0,0 +1,806 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +from dataclasses import dataclass, field +from abc import ABC, abstractmethod +import logging + +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from typing import Iterator, List, Tuple, Optional +from volatility3 import framework +from volatility3.framework import ( + constants, + interfaces, + renderers, + exceptions, + deprecation, +) +from volatility3.framework.renderers import format_hints +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.linux import network + +vollog = logging.getLogger(__name__) + + +@dataclass +class Proto: + name: str + hooks: Tuple[str] = field(default_factory=tuple) + + +PROTO_NOT_IMPLEMENTED = Proto(name="UNSPEC") + +NF_INET_HOOKS = ("PRE_ROUTING", "LOCAL_IN", "FORWARD", "LOCAL_OUT", "POST_ROUTING") +NF_DEC_HOOKS = ( + "PRE_ROUTING", + "LOCAL_IN", + "FORWARD", + "LOCAL_OUT", + "POST_ROUTING", + "HELLO", + "ROUTE", +) +NF_ARP_HOOKS = ("IN", "OUT", "FORWARD") +NF_NETDEV_HOOKS = ("INGRESS", "EGRESS") +LARGEST_HOOK_NUMBER = max( + len(NF_INET_HOOKS), len(NF_DEC_HOOKS), len(NF_ARP_HOOKS), len(NF_NETDEV_HOOKS) +) + + +class AbstractNetfilter(ABC): + """Netfilter Abstract Base Classes handling details across various + Netfilter implementations, including constants, helpers, and common + routines. + """ + + PROTO_HOOKS = ( + PROTO_NOT_IMPLEMENTED, # NFPROTO_UNSPEC + Proto(name="INET", hooks=NF_INET_HOOKS), # From kernels 3.14 + Proto(name="IPV4", hooks=NF_INET_HOOKS), + Proto(name="ARP", hooks=NF_ARP_HOOKS), + PROTO_NOT_IMPLEMENTED, + Proto(name="NETDEV", hooks=NF_NETDEV_HOOKS), + PROTO_NOT_IMPLEMENTED, + Proto(name="BRIDGE", hooks=NF_INET_HOOKS), + PROTO_NOT_IMPLEMENTED, + PROTO_NOT_IMPLEMENTED, + Proto(name="IPV6", hooks=NF_INET_HOOKS), + PROTO_NOT_IMPLEMENTED, + Proto(name="DECNET", hooks=NF_DEC_HOOKS), # Removed in kernel 6.1 + ) + NF_MAX_HOOKS = LARGEST_HOOK_NUMBER + 1 + + def __init__( + self, context: interfaces.context.ContextInterface, kernel_module_name: str + ): + self._context = context + self.vmlinux = context.modules[kernel_module_name] + self.layer_name = self.vmlinux.layer_name + + # Set data sizes + self.ptr_size = self.vmlinux.get_type("pointer").size + self.list_head_size = self.vmlinux.get_type("list_head").size + + linuxutils_modulegatherers_required_version = ( + Netfilter._required_linuxutils_gatherers_version + ) + linuxutils_modulegatherers_current_version = ( + linux_utilities_modules.ModuleGatherers.version + ) + if not requirements.VersionRequirement.matches_required( + linuxutils_modulegatherers_required_version, + linuxutils_modulegatherers_current_version, + ): + raise exceptions.PluginRequirementException( + f"linux_utilities_modules.ModuleGatherer version not suitable: required {linuxutils_modulegatherers_required_version} found {linuxutils_modulegatherers_current_version}" + ) + + linux_net_required_version = Netfilter._required_linuxnet_version + linux_net_current_version = network.NetSymbols.version + if not requirements.VersionRequirement.matches_required( + linux_net_required_version, linux_net_current_version + ): + raise exceptions.PluginRequirementException( + f"symbols.linux.net.NetSymbols version not suitable: required {linux_net_required_version} found {linux_net_current_version}" + ) + + linux_utilities_modules_required_version = ( + Netfilter._required_linux_utilities_modules_version + ) + linux_utilities_modules_current_version = ( + linux_utilities_modules.Modules.version + ) + if not requirements.VersionRequirement.matches_required( + linux_utilities_modules_required_version, + linux_utilities_modules_current_version, + ): + raise exceptions.PluginRequirementException( + f"linux_utilities_modules.Modules version not suitable: required {linux_utilities_modules_required_version} found {linux_utilities_modules_current_version}" + ) + + symbol_table = context.symbol_space[self.vmlinux.symbol_table_name] + network.NetSymbols.apply(symbol_table) + + self.handlers = linux_utilities_modules.Modules.run_modules_scanners( + context=context, + kernel_module_name=kernel_module_name, + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, + ) + + @classmethod + def run_all( + cls, context: interfaces.context.ContextInterface, kernel_module_name: str + ) -> Iterator[Tuple[int, str, str, int, int, str, bool]]: + """It calls each subclass symtab_checks() to test the required + conditions to that specific kernel implementation. + + Args: + context: The volatility3 context on which to operate + kernel_module_name: The name of the table containing the kernel symbols + + Yields: + The kmsg records. Same as _run() + """ + vmlinux = context.modules[kernel_module_name] + + implementation_inst = None # type: ignore + for subclass in framework.class_subclasses(cls): + if not subclass.symtab_checks(vmlinux=vmlinux): + vollog.log( + constants.LOGLEVEL_VVVV, + "Netfilter implementation '%s' doesn't match this memory dump", + subclass.__name__, + ) + continue + + vollog.log( + constants.LOGLEVEL_VVVV, + "Netfilter implementation '%s' matches!", + subclass.__name__, + ) + implementation_inst = subclass( + context=context, kernel_module_name=kernel_module_name + ) + # More than one class could be executed for an specific kernel version + # For instance: Netfilter Ingress hooks + yield from implementation_inst._run() + + if implementation_inst is None: + vollog.error("Unsupported Netfilter kernel implementation") + + def _run(self) -> Iterator[Tuple[int, str, str, int, int, str, bool]]: + """Iterates over namespaces and protocols, executing various callbacks that + allow customization of the code to the specific data structure used in a + particular kernel implementation + + get_hooks_container(net, proto_name, hook_name) + It returns the data structure used in a specific kernel implementation + to store the hooks for a respective namespace and protocol, basically: + For Ingress hooks: + network_namespace[] -> net_device[] -> nf_hooks_ingress[] + For egress hooks: + network_namespace[] -> net_device[] -> nf_hooks_egress[] + For all the other Netfilter hooks: + <= 4.2.8 + nf_hooks[] + >= 4.3 + network_namespace[] -> nf.hooks[] + + get_hook_ops(hook_container, proto_idx, hook_idx) + Give the 'hook_container' got in get_hooks_container(), it + returns an iterable of 'nf_hook_ops' elements for a respective protocol + and hook type. + + Returns: + netns [int]: Network namespace id + proto_name [str]: Protocol name + hook_name [str]: Hook name + priority [int]: Priority + hook_ops_hook [int]: Hook address + module_name [str]: Linux kernel module name + hooked [bool]: "True" if the network stack has been hijacked + """ + for netns, net in self.get_net_namespaces(): + for proto_idx, proto_name, hook_idx, hook_name in self._proto_hook_loop(): + hooks_container = self.get_hooks_container(net, proto_name, hook_name) + + for hook_container in hooks_container: + for hook_ops in self.get_hook_ops( + hook_container, proto_idx, hook_idx + ): + if not hook_ops: + continue + + priority = int(hook_ops.priority) + hook_ops_hook = hook_ops.hook + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self._context, + self.vmlinux.name, + self.handlers, + hook_ops_hook, + ) + ) + hooked = module_info is None + + yield netns, proto_name, hook_name, priority, hook_ops_hook, module_info, symbol_name, hooked + + @classmethod + @abstractmethod + def symtab_checks(cls, vmlinux: interfaces.context.ModuleInterface) -> bool: + """This method on each sublasss will be called to evaluate if the kernel + being analyzed fulfill the type & symbols requirements for the implementation. + The first class returning True will be instantiated and called via the + run() method. + + Returns: + bool: True if the kernel being analyzed fulfill the class requirements. + """ + + def _proto_hook_loop(self) -> Iterator[Tuple[int, str, int, str]]: + """Flattens the protocol families and hooks""" + for proto_idx, proto in enumerate(AbstractNetfilter.PROTO_HOOKS): + if proto == PROTO_NOT_IMPLEMENTED: + continue + if proto.name not in self.subscribed_protocols(): + # This protocol is not managed in this object + continue + for hook_idx, hook_name in enumerate(proto.hooks): + yield proto_idx, proto.name, hook_idx, hook_name + + def build_nf_hook_ops_array( + self, nf_hook_entries + ) -> Optional[interfaces.objects.ObjectInterface]: + """Function helper to build the nf_hook_ops array when it is not part of the + struct 'nf_hook_entries' definition. + + nf_hook_ops was stored adjacent in memory to the nf_hook_entry array, in the + new struct 'nf_hook_entries'. However, this 'nf_hooks_ops' array 'orig_ops' is + not part of the 'nf_hook_entries' struct. So, we need to calculate the offset. + + struct nf_hook_entries { + u16 num_hook_entries; /* plus padding */ + struct nf_hook_entry hooks[]; + //const struct nf_hook_ops *orig_ops[]; + } + """ + nf_hook_entry_size = self.vmlinux.get_type("nf_hook_entry").size + + try: + num_hook_entries = nf_hook_entries.num_hook_entries + except exceptions.InvalidAddressException: + return None + + orig_ops_addr = ( + nf_hook_entries.hooks.vol.offset + nf_hook_entry_size * num_hook_entries + ) + + if not self.vmlinux._context.layers[self.vmlinux.layer_name].is_valid( + orig_ops_addr + ): + return None + + orig_ops = self._context.object( + object_type=self.get_symbol_fullname("array"), + offset=orig_ops_addr, + subtype=self.vmlinux.get_type("pointer"), + layer_name=self.layer_name, + count=num_hook_entries, + ) + + return orig_ops + + def subscribed_protocols(self) -> Tuple[str]: + """Allows to select which PROTO_HOOKS protocols will be processed by the + Netfiler subclass. + """ + + # Most implementation handlers respond to these protocols, except for + # the ingress hook, which specifically handles the 'NETDEV' protocol. + # However, there is no corresponding Netfilter hook implementation for + # the INET protocol in the kernel. AFAIU, this is used as + # 'NFPROTO_INET = NFPROTO_IPV4 || NFPROTO_IPV6' + # in other parts of the kernel source code. + return ("IPV4", "ARP", "BRIDGE", "IPV6", "DECNET") + + @deprecation.method_being_removed( + removal_date="2025-09-25", + message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`", + ) + def get_module_name_for_address(self, addr) -> str: + """Helper to obtain the module and symbol name in the format needed for the + output of this plugin. + """ + module_name, symbol_name = ( + linux_utilities_modules.Modules.lookup_module_address( + self._context, self.vmlinux.name, self.handlers, addr + ) + ) + + if module_name == "UNKNOWN": + module_name = None + + if symbol_name != "N/A": + module_name = f"[{symbol_name}]" + + return module_name + + def get_net_namespaces(self): + """Common function to retrieve the different namespaces. + From 4.3 on, all the implementations use network namespaces. + """ + nethead = self.vmlinux.object_from_symbol("net_namespace_list") + symbol_net_name = self.get_symbol_fullname("net") + for net in nethead.to_list(symbol_net_name, "list"): + net_ns_id = net.ns.inum + yield net_ns_id, net + + def get_hooks_container(self, net, proto_name, hook_name): + """Returns the data structure used in a specific kernel implementation to store + the hooks for a respective namespace and protocol. + + Except for kernels < 4.3, all the implementations use network namespaces. + Also the data structure which contains the hooks, even though it changes its + implementation and/or data type, it is always in this location. + """ + yield net.nf.hooks + + def get_hook_ops(self, hook_container, proto_idx, hook_idx): + """Given the hook_container obtained from get_hooks_container(), it + returns an iterable of 'nf_hook_ops' elements for a corresponding protocol + and hook type. + + This is the most variable/unstable part of all Netfilter hook designs, it + changes almost in every single implementation. + """ + raise NotImplementedError("You must implement this method") + + def get_symbol_fullname(self, symbol_basename: str) -> str: + """Given a short symbol or type name, it returns its full name""" + return self.vmlinux.symbol_table_name + constants.BANG + symbol_basename + + @staticmethod + def get_member_type( + vol_type: interfaces.objects.Template, member_name: str + ) -> List[str]: + """Returns a list of types/subtypes belonging to the given type member. + + Args: + vol_type (interfaces.objects.Template): A vol3 type object + member_name (str): The member name + + Returns: + list: A list of types/subtypes + """ + _size, vol_obj = vol_type.vol.members[member_name] + type_name = vol_obj.type_name + type_basename = type_name.split(constants.BANG)[1] + member_type = [type_basename] + cur_type = vol_obj + while hasattr(cur_type, "subtype"): + subtype_name = cur_type.subtype.type_name + subtype_basename = subtype_name.split(constants.BANG)[1] + member_type.append(subtype_basename) + cur_type = cur_type.subtype + + return member_type + + +class NetfilterImp_to_4_3(AbstractNetfilter): + """At this point, Netfilter hooks were implemented as a linked list of struct + 'nf_hook_ops' type. One linked list per protocol per hook type. + It was like that until 4.2.8. + + struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + return vmlinux.has_symbol("nf_hooks") + + def get_net_namespaces(self): + # In kernels <= 4.2.8 netfilter hooks are not implemented per namespaces + netns, net = renderers.NotAvailableValue(), renderers.NotAvailableValue() + yield netns, net + + def get_hooks_container(self, net, proto_name, hook_name): + nf_hooks = self.vmlinux.object_from_symbol("nf_hooks") + if not nf_hooks: + return + + yield nf_hooks + + def get_hook_ops(self, hook_container, proto_idx, hook_idx): + list_head = hook_container[proto_idx][hook_idx] + nf_hooks_ops_name = self.get_symbol_fullname("nf_hook_ops") + return list_head.to_list(nf_hooks_ops_name, "list") + + +class NetfilterImp_4_3_to_4_9(AbstractNetfilter): + """Netfilter hooks were added to network namespaces in 4.3. + It is still implemented as a linked list of 'struct nf_hook_ops' type but inside a + network namespace. One linked list per protocol per hook type. + + struct net { ... struct netns_nf nf; ... } + struct netns_nf { ... + struct list_head hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; ... } + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + return ( + vmlinux.has_symbol("net_namespace_list") + and vmlinux.has_type("netns_nf") + and vmlinux.get_type("netns_nf").has_member("hooks") + and cls.get_member_type(vmlinux.get_type("netns_nf"), "hooks") + == ["array", "array", "list_head"] + ) + + def get_hook_ops(self, hook_container, proto_idx, hook_idx): + list_head = hook_container[proto_idx][hook_idx] + nf_hooks_ops_name = self.get_symbol_fullname("nf_hook_ops") + return list_head.to_list(nf_hooks_ops_name, "list") + + +class NetfilterImp_4_9_to_4_14(AbstractNetfilter): + """In this range of kernel versions, the doubly-linked lists of netfilter hooks were + replaced by an array of arrays of 'nf_hook_entry' pointers in a singly-linked lists. + struct net { ... struct netns_nf nf; ... } + struct netns_nf { .. + struct nf_hook_entry __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; ... } + + Also in v4.10 the struct nf_hook_entry changed, a hook function pointer was added to + it. However, for simplicity of this design, we will still take the hook address from + the 'nf_hook_ops'. As per v5.0-rc2, the hook address is duplicated in both sides. + - v4.9: + struct nf_hook_entry { + struct nf_hook_entry *next; + struct nf_hook_ops ops; + const struct nf_hook_ops *orig_ops; }; + - v4.10: + struct nf_hook_entry { + struct nf_hook_entry *next; + nf_hookfn *hook; + void *priv; + const struct nf_hook_ops *orig_ops; }; + (*) Even though the hook address is in the struct 'nf_hook_entry', we use the + original 'nf_hook_ops' hook address value, the one which was filled by the user, to + make it uniform to all the implementations. + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + hooks_type = ["array", "array", "pointer", "nf_hook_entry"] + return ( + vmlinux.has_symbol("net_namespace_list") + and vmlinux.has_type("netns_nf") + and vmlinux.get_type("netns_nf").has_member("hooks") + and cls.get_member_type(vmlinux.get_type("netns_nf"), "hooks") == hooks_type + ) + + def _get_hook_ops(self, hook_container, proto_idx, hook_idx): + list_head = hook_container[proto_idx][hook_idx] + nf_hooks_ops_name = self.get_symbol_fullname("nf_hook_ops") + return list_head.to_list(nf_hooks_ops_name, "list") + + def get_hook_ops(self, hook_container, proto_idx, hook_idx): + nf_hook_entry_list = hook_container[proto_idx][hook_idx] + while nf_hook_entry_list: + yield nf_hook_entry_list.orig_ops + nf_hook_entry_list = nf_hook_entry_list.next + + +class NetfilterImp_4_14_to_4_16(AbstractNetfilter): + """'nf_hook_ops' was removed from struct 'nf_hook_entry'. Instead, it was stored + adjacent in memory to the 'nf_hook_entry' array, in the new struct 'nf_hook_entries' + However, 'orig_ops' is not part of the 'nf_hook_entries' struct definition. So, we + have to craft it by hand. + + struct net { ... struct netns_nf nf; ... } + struct netns_nf { + struct nf_hook_entries *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; ... } + struct nf_hook_entries { + u16 num_hook_entries; /* plus padding */ + struct nf_hook_entry hooks[]; + //const struct nf_hook_ops *orig_ops[]; } + struct nf_hook_entry { + nf_hookfn *hook; + void *priv; } + + (*) Even though the hook address is in the struct 'nf_hook_entry', we use the + original 'nf_hook_ops' hook address value, the one which was filled by the user, to + make it uniform to all the implementations. + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + hooks_type = ["array", "array", "pointer", "nf_hook_entries"] + return ( + vmlinux.has_symbol("net_namespace_list") + and vmlinux.has_type("netns_nf") + and vmlinux.get_type("netns_nf").has_member("hooks") + and cls.get_member_type(vmlinux.get_type("netns_nf"), "hooks") == hooks_type + ) + + def get_nf_hook_entries(self, nf_hooks_addr, proto_idx, hook_idx): + """This allows to support different hook array implementations from this version + on. For instance, in kernels >= 4.16 this multi-dimensional array is split in + one-dimensional array of pointers to 'nf_hooks_entries' per each protocol.""" + return nf_hooks_addr[proto_idx][hook_idx] + + def get_hook_ops(self, hook_container, proto_idx, hook_idx): + nf_hook_entries = self.get_nf_hook_entries(hook_container, proto_idx, hook_idx) + if not nf_hook_entries: + return + + nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") + nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries) + if not nf_hook_ops_ptr_arr: + return + + for nf_hook_ops_ptr in nf_hook_ops_ptr_arr: + nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name) + yield nf_hook_ops + + +class NetfilterImp_4_16_to_latest(NetfilterImp_4_14_to_4_16): + """The multidimensional array of nf_hook_entries was split in a one-dimensional + array per each protocol. + + struct net { + struct netns_nf nf; ... } + struct netns_nf { + struct nf_hook_entries * hooks_ipv4[NF_INET_NUMHOOKS]; + struct nf_hook_entries * hooks_ipv6[NF_INET_NUMHOOKS]; + struct nf_hook_entries * hooks_arp[NF_ARP_NUMHOOKS]; + struct nf_hook_entries * hooks_bridge[NF_INET_NUMHOOKS]; + struct nf_hook_entries * hooks_decnet[NF_DN_NUMHOOKS]; ... } + struct nf_hook_entries { + u16 num_hook_entries; /* plus padding */ + struct nf_hook_entry hooks[]; + //const struct nf_hook_ops *orig_ops[]; } + struct nf_hook_entry { + nf_hookfn *hook; + void *priv; } + + (*) Even though the hook address is in the struct nf_hook_entry, we use the original + nf_hook_ops hook address value, the one which was filled by the user, to make it + uniform to all the implementations. + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + return ( + vmlinux.has_symbol("net_namespace_list") + and vmlinux.has_type("netns_nf") + and vmlinux.get_type("netns_nf").has_member("hooks_ipv4") + ) + + def get_hooks_container(self, net, proto_name, hook_name): + try: + if proto_name == "IPV4": + net_nf_hooks = net.nf.hooks_ipv4 + elif proto_name == "ARP": + net_nf_hooks = net.nf.hooks_arp + elif proto_name == "BRIDGE": + net_nf_hooks = net.nf.hooks_bridge + elif proto_name == "IPV6": + net_nf_hooks = net.nf.hooks_ipv6 + elif proto_name == "DECNET": + net_nf_hooks = net.nf.hooks_decnet + else: + return + + yield net_nf_hooks + + except AttributeError: + # Protocol family disabled at kernel compilation + # CONFIG_NETFILTER_FAMILY_ARP=n || + # CONFIG_NETFILTER_FAMILY_BRIDGE=n || + # CONFIG_DECNET=n + pass + + def _get_nf_hook_entries_ptr(self, nf_hooks_addr, proto_idx, hook_idx): + nf_hook_entries_ptr = nf_hooks_addr[hook_idx] + return nf_hook_entries_ptr + + def get_nf_hook_entries(self, nf_hooks_addr, proto_idx, hook_idx): + return nf_hooks_addr[hook_idx] + + +class AbstractNetfilterNetDev(AbstractNetfilter): + """Base class to handle the Netfilter NetDev hooks. + It won't be executed. It has some common functions to all Netfilter NetDev hook + implementations. + + Netfilter NetDev hooks are set per network device which belongs to a network + namespace. + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + return False + + def subscribed_protocols(self): + return ("NETDEV",) + + def get_hooks_container(self, net, proto_name, hook_name): + net_device_type = self.vmlinux.get_type("net_device") + net_device_name = self.get_symbol_fullname("net_device") + for net_device in net.dev_base_head.to_list(net_device_name, "dev_list"): + if hook_name == "INGRESS": + if net_device_type.has_member("nf_hooks_ingress"): + # CONFIG_NETFILTER_INGRESS=y + yield net_device.nf_hooks_ingress + + elif hook_name == "EGRESS": + if net_device_type.has_member("nf_hooks_egress"): + # CONFIG_NETFILTER_EGRESS=y + yield net_device.nf_hooks_egress + + +class NetfilterNetDevImp_4_2_to_4_9(AbstractNetfilterNetDev): + """This is the first version of Netfilter Ingress hooks which was implemented using + a doubly-linked list of 'nf_hook_ops'. + struct list_head nf_hooks_ingress; + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + hooks_type = ["list_head"] + return ( + vmlinux.has_symbol("net_namespace_list") + and vmlinux.has_type("net_device") + and vmlinux.get_type("net_device").has_member("nf_hooks_ingress") + and cls.get_member_type(vmlinux.get_type("net_device"), "nf_hooks_ingress") + == hooks_type + ) + + def get_hook_ops(self, hook_container, proto_idx, hook_idx): + nf_hooks_ingress = hook_container + nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") + return nf_hooks_ingress.to_list(nf_hook_ops_name, "list") + + +class NetfilterNetDevImp_4_9_to_4_14(AbstractNetfilterNetDev): + """In 4.9 it was changed to a simple singly-linked list. + struct nf_hook_entry * nf_hooks_ingress; + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + hooks_type = ["pointer", "nf_hook_entry"] + return ( + vmlinux.has_symbol("net_namespace_list") + and vmlinux.has_type("net_device") + and vmlinux.get_type("net_device").has_member("nf_hooks_ingress") + and cls.get_member_type(vmlinux.get_type("net_device"), "nf_hooks_ingress") + == hooks_type + ) + + def get_hook_ops(self, hook_container, proto_idx, hook_idx): + nf_hooks_ingress_ptr = hook_container + if not nf_hooks_ingress_ptr: + return + + while nf_hooks_ingress_ptr: + nf_hook_entry = nf_hooks_ingress_ptr.dereference() + orig_ops = nf_hook_entry.orig_ops.dereference() + yield orig_ops + nf_hooks_ingress_ptr = nf_hooks_ingress_ptr.next + + +class NetfilterNetDevImp_4_14_to_latest(AbstractNetfilterNetDev): + """In 4.14 the hook list was converted to an array of pointers inside the struct + 'nf_hook_entries': + struct nf_hook_entries * nf_hooks_ingress; + struct nf_hook_entries { + u16 num_hook_entries; + struct nf_hook_entry hooks[]; + //const struct nf_hook_ops *orig_ops[]; } + """ + + @classmethod + def symtab_checks(cls, vmlinux) -> bool: + hooks_type = ["pointer", "nf_hook_entries"] + return ( + vmlinux.has_symbol("net_namespace_list") + and vmlinux.has_type("net_device") + and vmlinux.get_type("net_device").has_member("nf_hooks_ingress") + and cls.get_member_type(vmlinux.get_type("net_device"), "nf_hooks_ingress") + == hooks_type + ) + + def get_hook_ops(self, hook_container, proto_idx, hook_idx): + nf_hook_entries = hook_container + if not nf_hook_entries: + return + + nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") + nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries) + if not nf_hook_ops_ptr_arr: + return + + for nf_hook_ops_ptr in nf_hook_ops_ptr_arr: + nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name) + yield nf_hook_ops + + +class Netfilter(interfaces.plugins.PluginInterface): + """Lists Netfilter hooks.""" + + _required_framework_version = (2, 22, 0) + + _version = (2, 0, 0) + + _required_linux_utilities_modules_version = (3, 0, 0) + _required_linuxutils_gatherers_version = (1, 0, 0) + _required_linuxnet_version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=cls._required_linuxutils_gatherers_version, + ), + requirements.VersionRequirement( + name="linuxnet", + component=network.NetSymbols, + version=cls._required_linuxnet_version, + ), + ] + + def _format_fields(self, fields): + ( + netns, + proto_name, + hook_name, + priority, + hook_func, + module_info, + symbol_name, + hooked, + ) = fields + + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + + return ( + netns, + proto_name, + hook_name, + priority, + format_hints.Hex(hook_func), + module_name, + symbol_name or renderers.NotAvailableValue(), + str(hooked), + ) + + def _generator(self): + kernel_module_name = self.config["kernel"] + for fields in AbstractNetfilter.run_all( + context=self.context, kernel_module_name=kernel_module_name + ): + yield (0, self._format_fields(fields)) + + def run(self): + headers = [ + ("Net NS", int), + ("Proto", str), + ("Hook", str), + ("Priority", int), + ("Handler", format_hints.Hex), + ("Module", str), + ("Symbol", str), + ("Is Hooked", str), + ] + return renderers.TreeGrid(headers, self._generator()) diff --git a/volatility3/framework/plugins/linux/modxview.py b/volatility3/framework/plugins/linux/modxview.py index f710b1291..d91f37587 100644 --- a/volatility3/framework/plugins/linux/modxview.py +++ b/volatility3/framework/plugins/linux/modxview.py @@ -14,7 +14,6 @@ class Modxview( replacement_class=modxview.Modxview, removal_date="2026-06-07", ): - """Centralize lsmod, check_modules and hidden_modules results to efficiently \ spot modules presence and taints (deprecated).""" diff --git a/volatility3/framework/plugins/linux/netfilter.py b/volatility3/framework/plugins/linux/netfilter.py index d724d4296..741241039 100644 --- a/volatility3/framework/plugins/linux/netfilter.py +++ b/volatility3/framework/plugins/linux/netfilter.py @@ -1,806 +1,20 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from dataclasses import dataclass, field -from abc import ABC, abstractmethod import logging - -import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from typing import Iterator, List, Tuple, Optional -from volatility3 import framework -from volatility3.framework import ( - constants, - interfaces, - renderers, - exceptions, - deprecation, -) -from volatility3.framework.renderers import format_hints -from volatility3.framework.configuration import requirements -from volatility3.framework.symbols.linux import network +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import netfilter vollog = logging.getLogger(__name__) -@dataclass -class Proto: - name: str - hooks: Tuple[str] = field(default_factory=tuple) - - -PROTO_NOT_IMPLEMENTED = Proto(name="UNSPEC") - -NF_INET_HOOKS = ("PRE_ROUTING", "LOCAL_IN", "FORWARD", "LOCAL_OUT", "POST_ROUTING") -NF_DEC_HOOKS = ( - "PRE_ROUTING", - "LOCAL_IN", - "FORWARD", - "LOCAL_OUT", - "POST_ROUTING", - "HELLO", - "ROUTE", -) -NF_ARP_HOOKS = ("IN", "OUT", "FORWARD") -NF_NETDEV_HOOKS = ("INGRESS", "EGRESS") -LARGEST_HOOK_NUMBER = max( - len(NF_INET_HOOKS), len(NF_DEC_HOOKS), len(NF_ARP_HOOKS), len(NF_NETDEV_HOOKS) -) - - -class AbstractNetfilter(ABC): - """Netfilter Abstract Base Classes handling details across various - Netfilter implementations, including constants, helpers, and common - routines. - """ - - PROTO_HOOKS = ( - PROTO_NOT_IMPLEMENTED, # NFPROTO_UNSPEC - Proto(name="INET", hooks=NF_INET_HOOKS), # From kernels 3.14 - Proto(name="IPV4", hooks=NF_INET_HOOKS), - Proto(name="ARP", hooks=NF_ARP_HOOKS), - PROTO_NOT_IMPLEMENTED, - Proto(name="NETDEV", hooks=NF_NETDEV_HOOKS), - PROTO_NOT_IMPLEMENTED, - Proto(name="BRIDGE", hooks=NF_INET_HOOKS), - PROTO_NOT_IMPLEMENTED, - PROTO_NOT_IMPLEMENTED, - Proto(name="IPV6", hooks=NF_INET_HOOKS), - PROTO_NOT_IMPLEMENTED, - Proto(name="DECNET", hooks=NF_DEC_HOOKS), # Removed in kernel 6.1 - ) - NF_MAX_HOOKS = LARGEST_HOOK_NUMBER + 1 - - def __init__( - self, context: interfaces.context.ContextInterface, kernel_module_name: str - ): - self._context = context - self.vmlinux = context.modules[kernel_module_name] - self.layer_name = self.vmlinux.layer_name - - # Set data sizes - self.ptr_size = self.vmlinux.get_type("pointer").size - self.list_head_size = self.vmlinux.get_type("list_head").size - - linuxutils_modulegatherers_required_version = ( - Netfilter._required_linuxutils_gatherers_version - ) - linuxutils_modulegatherers_current_version = ( - linux_utilities_modules.ModuleGatherers.version - ) - if not requirements.VersionRequirement.matches_required( - linuxutils_modulegatherers_required_version, - linuxutils_modulegatherers_current_version, - ): - raise exceptions.PluginRequirementException( - f"linux_utilities_modules.ModuleGatherer version not suitable: required {linuxutils_modulegatherers_required_version} found {linuxutils_modulegatherers_current_version}" - ) - - linux_net_required_version = Netfilter._required_linuxnet_version - linux_net_current_version = network.NetSymbols.version - if not requirements.VersionRequirement.matches_required( - linux_net_required_version, linux_net_current_version - ): - raise exceptions.PluginRequirementException( - f"symbols.linux.net.NetSymbols version not suitable: required {linux_net_required_version} found {linux_net_current_version}" - ) - - linux_utilities_modules_required_version = ( - Netfilter._required_linux_utilities_modules_version - ) - linux_utilities_modules_current_version = ( - linux_utilities_modules.Modules.version - ) - if not requirements.VersionRequirement.matches_required( - linux_utilities_modules_required_version, - linux_utilities_modules_current_version, - ): - raise exceptions.PluginRequirementException( - f"linux_utilities_modules.Modules version not suitable: required {linux_utilities_modules_required_version} found {linux_utilities_modules_current_version}" - ) - - symbol_table = context.symbol_space[self.vmlinux.symbol_table_name] - network.NetSymbols.apply(symbol_table) - - self.handlers = linux_utilities_modules.Modules.run_modules_scanners( - context=context, - kernel_module_name=kernel_module_name, - caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, - ) - - @classmethod - def run_all( - cls, context: interfaces.context.ContextInterface, kernel_module_name: str - ) -> Iterator[Tuple[int, str, str, int, int, str, bool]]: - """It calls each subclass symtab_checks() to test the required - conditions to that specific kernel implementation. - - Args: - context: The volatility3 context on which to operate - kernel_module_name: The name of the table containing the kernel symbols - - Yields: - The kmsg records. Same as _run() - """ - vmlinux = context.modules[kernel_module_name] - - implementation_inst = None # type: ignore - for subclass in framework.class_subclasses(cls): - if not subclass.symtab_checks(vmlinux=vmlinux): - vollog.log( - constants.LOGLEVEL_VVVV, - "Netfilter implementation '%s' doesn't match this memory dump", - subclass.__name__, - ) - continue - - vollog.log( - constants.LOGLEVEL_VVVV, - "Netfilter implementation '%s' matches!", - subclass.__name__, - ) - implementation_inst = subclass( - context=context, kernel_module_name=kernel_module_name - ) - # More than one class could be executed for an specific kernel version - # For instance: Netfilter Ingress hooks - yield from implementation_inst._run() - - if implementation_inst is None: - vollog.error("Unsupported Netfilter kernel implementation") - - def _run(self) -> Iterator[Tuple[int, str, str, int, int, str, bool]]: - """Iterates over namespaces and protocols, executing various callbacks that - allow customization of the code to the specific data structure used in a - particular kernel implementation - - get_hooks_container(net, proto_name, hook_name) - It returns the data structure used in a specific kernel implementation - to store the hooks for a respective namespace and protocol, basically: - For Ingress hooks: - network_namespace[] -> net_device[] -> nf_hooks_ingress[] - For egress hooks: - network_namespace[] -> net_device[] -> nf_hooks_egress[] - For all the other Netfilter hooks: - <= 4.2.8 - nf_hooks[] - >= 4.3 - network_namespace[] -> nf.hooks[] - - get_hook_ops(hook_container, proto_idx, hook_idx) - Give the 'hook_container' got in get_hooks_container(), it - returns an iterable of 'nf_hook_ops' elements for a respective protocol - and hook type. - - Returns: - netns [int]: Network namespace id - proto_name [str]: Protocol name - hook_name [str]: Hook name - priority [int]: Priority - hook_ops_hook [int]: Hook address - module_name [str]: Linux kernel module name - hooked [bool]: "True" if the network stack has been hijacked - """ - for netns, net in self.get_net_namespaces(): - for proto_idx, proto_name, hook_idx, hook_name in self._proto_hook_loop(): - hooks_container = self.get_hooks_container(net, proto_name, hook_name) - - for hook_container in hooks_container: - for hook_ops in self.get_hook_ops( - hook_container, proto_idx, hook_idx - ): - if not hook_ops: - continue - - priority = int(hook_ops.priority) - hook_ops_hook = hook_ops.hook - module_info, symbol_name = ( - linux_utilities_modules.Modules.module_lookup_by_address( - self._context, - self.vmlinux.name, - self.handlers, - hook_ops_hook, - ) - ) - hooked = module_info is None - - yield netns, proto_name, hook_name, priority, hook_ops_hook, module_info, symbol_name, hooked - - @classmethod - @abstractmethod - def symtab_checks(cls, vmlinux: interfaces.context.ModuleInterface) -> bool: - """This method on each sublasss will be called to evaluate if the kernel - being analyzed fulfill the type & symbols requirements for the implementation. - The first class returning True will be instantiated and called via the - run() method. - - Returns: - bool: True if the kernel being analyzed fulfill the class requirements. - """ - - def _proto_hook_loop(self) -> Iterator[Tuple[int, str, int, str]]: - """Flattens the protocol families and hooks""" - for proto_idx, proto in enumerate(AbstractNetfilter.PROTO_HOOKS): - if proto == PROTO_NOT_IMPLEMENTED: - continue - if proto.name not in self.subscribed_protocols(): - # This protocol is not managed in this object - continue - for hook_idx, hook_name in enumerate(proto.hooks): - yield proto_idx, proto.name, hook_idx, hook_name - - def build_nf_hook_ops_array( - self, nf_hook_entries - ) -> Optional[interfaces.objects.ObjectInterface]: - """Function helper to build the nf_hook_ops array when it is not part of the - struct 'nf_hook_entries' definition. - - nf_hook_ops was stored adjacent in memory to the nf_hook_entry array, in the - new struct 'nf_hook_entries'. However, this 'nf_hooks_ops' array 'orig_ops' is - not part of the 'nf_hook_entries' struct. So, we need to calculate the offset. - - struct nf_hook_entries { - u16 num_hook_entries; /* plus padding */ - struct nf_hook_entry hooks[]; - //const struct nf_hook_ops *orig_ops[]; - } - """ - nf_hook_entry_size = self.vmlinux.get_type("nf_hook_entry").size - - try: - num_hook_entries = nf_hook_entries.num_hook_entries - except exceptions.InvalidAddressException: - return None - - orig_ops_addr = ( - nf_hook_entries.hooks.vol.offset + nf_hook_entry_size * num_hook_entries - ) - - if not self.vmlinux._context.layers[self.vmlinux.layer_name].is_valid( - orig_ops_addr - ): - return None - - orig_ops = self._context.object( - object_type=self.get_symbol_fullname("array"), - offset=orig_ops_addr, - subtype=self.vmlinux.get_type("pointer"), - layer_name=self.layer_name, - count=num_hook_entries, - ) - - return orig_ops - - def subscribed_protocols(self) -> Tuple[str]: - """Allows to select which PROTO_HOOKS protocols will be processed by the - Netfiler subclass. - """ - - # Most implementation handlers respond to these protocols, except for - # the ingress hook, which specifically handles the 'NETDEV' protocol. - # However, there is no corresponding Netfilter hook implementation for - # the INET protocol in the kernel. AFAIU, this is used as - # 'NFPROTO_INET = NFPROTO_IPV4 || NFPROTO_IPV6' - # in other parts of the kernel source code. - return ("IPV4", "ARP", "BRIDGE", "IPV6", "DECNET") - - @deprecation.method_being_removed( - removal_date="2025-09-25", - message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`", - ) - def get_module_name_for_address(self, addr) -> str: - """Helper to obtain the module and symbol name in the format needed for the - output of this plugin. - """ - module_name, symbol_name = ( - linux_utilities_modules.Modules.lookup_module_address( - self._context, self.vmlinux.name, self.handlers, addr - ) - ) - - if module_name == "UNKNOWN": - module_name = None - - if symbol_name != "N/A": - module_name = f"[{symbol_name}]" - - return module_name - - def get_net_namespaces(self): - """Common function to retrieve the different namespaces. - From 4.3 on, all the implementations use network namespaces. - """ - nethead = self.vmlinux.object_from_symbol("net_namespace_list") - symbol_net_name = self.get_symbol_fullname("net") - for net in nethead.to_list(symbol_net_name, "list"): - net_ns_id = net.ns.inum - yield net_ns_id, net - - def get_hooks_container(self, net, proto_name, hook_name): - """Returns the data structure used in a specific kernel implementation to store - the hooks for a respective namespace and protocol. - - Except for kernels < 4.3, all the implementations use network namespaces. - Also the data structure which contains the hooks, even though it changes its - implementation and/or data type, it is always in this location. - """ - yield net.nf.hooks - - def get_hook_ops(self, hook_container, proto_idx, hook_idx): - """Given the hook_container obtained from get_hooks_container(), it - returns an iterable of 'nf_hook_ops' elements for a corresponding protocol - and hook type. - - This is the most variable/unstable part of all Netfilter hook designs, it - changes almost in every single implementation. - """ - raise NotImplementedError("You must implement this method") - - def get_symbol_fullname(self, symbol_basename: str) -> str: - """Given a short symbol or type name, it returns its full name""" - return self.vmlinux.symbol_table_name + constants.BANG + symbol_basename - - @staticmethod - def get_member_type( - vol_type: interfaces.objects.Template, member_name: str - ) -> List[str]: - """Returns a list of types/subtypes belonging to the given type member. - - Args: - vol_type (interfaces.objects.Template): A vol3 type object - member_name (str): The member name - - Returns: - list: A list of types/subtypes - """ - _size, vol_obj = vol_type.vol.members[member_name] - type_name = vol_obj.type_name - type_basename = type_name.split(constants.BANG)[1] - member_type = [type_basename] - cur_type = vol_obj - while hasattr(cur_type, "subtype"): - subtype_name = cur_type.subtype.type_name - subtype_basename = subtype_name.split(constants.BANG)[1] - member_type.append(subtype_basename) - cur_type = cur_type.subtype - - return member_type - - -class NetfilterImp_to_4_3(AbstractNetfilter): - """At this point, Netfilter hooks were implemented as a linked list of struct - 'nf_hook_ops' type. One linked list per protocol per hook type. - It was like that until 4.2.8. - - struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - return vmlinux.has_symbol("nf_hooks") - - def get_net_namespaces(self): - # In kernels <= 4.2.8 netfilter hooks are not implemented per namespaces - netns, net = renderers.NotAvailableValue(), renderers.NotAvailableValue() - yield netns, net - - def get_hooks_container(self, net, proto_name, hook_name): - nf_hooks = self.vmlinux.object_from_symbol("nf_hooks") - if not nf_hooks: - return - - yield nf_hooks - - def get_hook_ops(self, hook_container, proto_idx, hook_idx): - list_head = hook_container[proto_idx][hook_idx] - nf_hooks_ops_name = self.get_symbol_fullname("nf_hook_ops") - return list_head.to_list(nf_hooks_ops_name, "list") - - -class NetfilterImp_4_3_to_4_9(AbstractNetfilter): - """Netfilter hooks were added to network namespaces in 4.3. - It is still implemented as a linked list of 'struct nf_hook_ops' type but inside a - network namespace. One linked list per protocol per hook type. - - struct net { ... struct netns_nf nf; ... } - struct netns_nf { ... - struct list_head hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; ... } - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - return ( - vmlinux.has_symbol("net_namespace_list") - and vmlinux.has_type("netns_nf") - and vmlinux.get_type("netns_nf").has_member("hooks") - and cls.get_member_type(vmlinux.get_type("netns_nf"), "hooks") - == ["array", "array", "list_head"] - ) - - def get_hook_ops(self, hook_container, proto_idx, hook_idx): - list_head = hook_container[proto_idx][hook_idx] - nf_hooks_ops_name = self.get_symbol_fullname("nf_hook_ops") - return list_head.to_list(nf_hooks_ops_name, "list") - - -class NetfilterImp_4_9_to_4_14(AbstractNetfilter): - """In this range of kernel versions, the doubly-linked lists of netfilter hooks were - replaced by an array of arrays of 'nf_hook_entry' pointers in a singly-linked lists. - struct net { ... struct netns_nf nf; ... } - struct netns_nf { .. - struct nf_hook_entry __rcu *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; ... } - - Also in v4.10 the struct nf_hook_entry changed, a hook function pointer was added to - it. However, for simplicity of this design, we will still take the hook address from - the 'nf_hook_ops'. As per v5.0-rc2, the hook address is duplicated in both sides. - - v4.9: - struct nf_hook_entry { - struct nf_hook_entry *next; - struct nf_hook_ops ops; - const struct nf_hook_ops *orig_ops; }; - - v4.10: - struct nf_hook_entry { - struct nf_hook_entry *next; - nf_hookfn *hook; - void *priv; - const struct nf_hook_ops *orig_ops; }; - (*) Even though the hook address is in the struct 'nf_hook_entry', we use the - original 'nf_hook_ops' hook address value, the one which was filled by the user, to - make it uniform to all the implementations. - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - hooks_type = ["array", "array", "pointer", "nf_hook_entry"] - return ( - vmlinux.has_symbol("net_namespace_list") - and vmlinux.has_type("netns_nf") - and vmlinux.get_type("netns_nf").has_member("hooks") - and cls.get_member_type(vmlinux.get_type("netns_nf"), "hooks") == hooks_type - ) - - def _get_hook_ops(self, hook_container, proto_idx, hook_idx): - list_head = hook_container[proto_idx][hook_idx] - nf_hooks_ops_name = self.get_symbol_fullname("nf_hook_ops") - return list_head.to_list(nf_hooks_ops_name, "list") - - def get_hook_ops(self, hook_container, proto_idx, hook_idx): - nf_hook_entry_list = hook_container[proto_idx][hook_idx] - while nf_hook_entry_list: - yield nf_hook_entry_list.orig_ops - nf_hook_entry_list = nf_hook_entry_list.next - - -class NetfilterImp_4_14_to_4_16(AbstractNetfilter): - """'nf_hook_ops' was removed from struct 'nf_hook_entry'. Instead, it was stored - adjacent in memory to the 'nf_hook_entry' array, in the new struct 'nf_hook_entries' - However, 'orig_ops' is not part of the 'nf_hook_entries' struct definition. So, we - have to craft it by hand. - - struct net { ... struct netns_nf nf; ... } - struct netns_nf { - struct nf_hook_entries *hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; ... } - struct nf_hook_entries { - u16 num_hook_entries; /* plus padding */ - struct nf_hook_entry hooks[]; - //const struct nf_hook_ops *orig_ops[]; } - struct nf_hook_entry { - nf_hookfn *hook; - void *priv; } - - (*) Even though the hook address is in the struct 'nf_hook_entry', we use the - original 'nf_hook_ops' hook address value, the one which was filled by the user, to - make it uniform to all the implementations. - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - hooks_type = ["array", "array", "pointer", "nf_hook_entries"] - return ( - vmlinux.has_symbol("net_namespace_list") - and vmlinux.has_type("netns_nf") - and vmlinux.get_type("netns_nf").has_member("hooks") - and cls.get_member_type(vmlinux.get_type("netns_nf"), "hooks") == hooks_type - ) - - def get_nf_hook_entries(self, nf_hooks_addr, proto_idx, hook_idx): - """This allows to support different hook array implementations from this version - on. For instance, in kernels >= 4.16 this multi-dimensional array is split in - one-dimensional array of pointers to 'nf_hooks_entries' per each protocol.""" - return nf_hooks_addr[proto_idx][hook_idx] - - def get_hook_ops(self, hook_container, proto_idx, hook_idx): - nf_hook_entries = self.get_nf_hook_entries(hook_container, proto_idx, hook_idx) - if not nf_hook_entries: - return - - nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") - nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries) - if not nf_hook_ops_ptr_arr: - return - - for nf_hook_ops_ptr in nf_hook_ops_ptr_arr: - nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name) - yield nf_hook_ops - - -class NetfilterImp_4_16_to_latest(NetfilterImp_4_14_to_4_16): - """The multidimensional array of nf_hook_entries was split in a one-dimensional - array per each protocol. - - struct net { - struct netns_nf nf; ... } - struct netns_nf { - struct nf_hook_entries * hooks_ipv4[NF_INET_NUMHOOKS]; - struct nf_hook_entries * hooks_ipv6[NF_INET_NUMHOOKS]; - struct nf_hook_entries * hooks_arp[NF_ARP_NUMHOOKS]; - struct nf_hook_entries * hooks_bridge[NF_INET_NUMHOOKS]; - struct nf_hook_entries * hooks_decnet[NF_DN_NUMHOOKS]; ... } - struct nf_hook_entries { - u16 num_hook_entries; /* plus padding */ - struct nf_hook_entry hooks[]; - //const struct nf_hook_ops *orig_ops[]; } - struct nf_hook_entry { - nf_hookfn *hook; - void *priv; } - - (*) Even though the hook address is in the struct nf_hook_entry, we use the original - nf_hook_ops hook address value, the one which was filled by the user, to make it - uniform to all the implementations. - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - return ( - vmlinux.has_symbol("net_namespace_list") - and vmlinux.has_type("netns_nf") - and vmlinux.get_type("netns_nf").has_member("hooks_ipv4") - ) - - def get_hooks_container(self, net, proto_name, hook_name): - try: - if proto_name == "IPV4": - net_nf_hooks = net.nf.hooks_ipv4 - elif proto_name == "ARP": - net_nf_hooks = net.nf.hooks_arp - elif proto_name == "BRIDGE": - net_nf_hooks = net.nf.hooks_bridge - elif proto_name == "IPV6": - net_nf_hooks = net.nf.hooks_ipv6 - elif proto_name == "DECNET": - net_nf_hooks = net.nf.hooks_decnet - else: - return - - yield net_nf_hooks - - except AttributeError: - # Protocol family disabled at kernel compilation - # CONFIG_NETFILTER_FAMILY_ARP=n || - # CONFIG_NETFILTER_FAMILY_BRIDGE=n || - # CONFIG_DECNET=n - pass - - def _get_nf_hook_entries_ptr(self, nf_hooks_addr, proto_idx, hook_idx): - nf_hook_entries_ptr = nf_hooks_addr[hook_idx] - return nf_hook_entries_ptr - - def get_nf_hook_entries(self, nf_hooks_addr, proto_idx, hook_idx): - return nf_hooks_addr[hook_idx] - - -class AbstractNetfilterNetDev(AbstractNetfilter): - """Base class to handle the Netfilter NetDev hooks. - It won't be executed. It has some common functions to all Netfilter NetDev hook - implementations. - - Netfilter NetDev hooks are set per network device which belongs to a network - namespace. - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - return False - - def subscribed_protocols(self): - return ("NETDEV",) - - def get_hooks_container(self, net, proto_name, hook_name): - net_device_type = self.vmlinux.get_type("net_device") - net_device_name = self.get_symbol_fullname("net_device") - for net_device in net.dev_base_head.to_list(net_device_name, "dev_list"): - if hook_name == "INGRESS": - if net_device_type.has_member("nf_hooks_ingress"): - # CONFIG_NETFILTER_INGRESS=y - yield net_device.nf_hooks_ingress - - elif hook_name == "EGRESS": - if net_device_type.has_member("nf_hooks_egress"): - # CONFIG_NETFILTER_EGRESS=y - yield net_device.nf_hooks_egress - - -class NetfilterNetDevImp_4_2_to_4_9(AbstractNetfilterNetDev): - """This is the first version of Netfilter Ingress hooks which was implemented using - a doubly-linked list of 'nf_hook_ops'. - struct list_head nf_hooks_ingress; - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - hooks_type = ["list_head"] - return ( - vmlinux.has_symbol("net_namespace_list") - and vmlinux.has_type("net_device") - and vmlinux.get_type("net_device").has_member("nf_hooks_ingress") - and cls.get_member_type(vmlinux.get_type("net_device"), "nf_hooks_ingress") - == hooks_type - ) - - def get_hook_ops(self, hook_container, proto_idx, hook_idx): - nf_hooks_ingress = hook_container - nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") - return nf_hooks_ingress.to_list(nf_hook_ops_name, "list") - - -class NetfilterNetDevImp_4_9_to_4_14(AbstractNetfilterNetDev): - """In 4.9 it was changed to a simple singly-linked list. - struct nf_hook_entry * nf_hooks_ingress; - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - hooks_type = ["pointer", "nf_hook_entry"] - return ( - vmlinux.has_symbol("net_namespace_list") - and vmlinux.has_type("net_device") - and vmlinux.get_type("net_device").has_member("nf_hooks_ingress") - and cls.get_member_type(vmlinux.get_type("net_device"), "nf_hooks_ingress") - == hooks_type - ) - - def get_hook_ops(self, hook_container, proto_idx, hook_idx): - nf_hooks_ingress_ptr = hook_container - if not nf_hooks_ingress_ptr: - return - - while nf_hooks_ingress_ptr: - nf_hook_entry = nf_hooks_ingress_ptr.dereference() - orig_ops = nf_hook_entry.orig_ops.dereference() - yield orig_ops - nf_hooks_ingress_ptr = nf_hooks_ingress_ptr.next - - -class NetfilterNetDevImp_4_14_to_latest(AbstractNetfilterNetDev): - """In 4.14 the hook list was converted to an array of pointers inside the struct - 'nf_hook_entries': - struct nf_hook_entries * nf_hooks_ingress; - struct nf_hook_entries { - u16 num_hook_entries; - struct nf_hook_entry hooks[]; - //const struct nf_hook_ops *orig_ops[]; } - """ - - @classmethod - def symtab_checks(cls, vmlinux) -> bool: - hooks_type = ["pointer", "nf_hook_entries"] - return ( - vmlinux.has_symbol("net_namespace_list") - and vmlinux.has_type("net_device") - and vmlinux.get_type("net_device").has_member("nf_hooks_ingress") - and cls.get_member_type(vmlinux.get_type("net_device"), "nf_hooks_ingress") - == hooks_type - ) - - def get_hook_ops(self, hook_container, proto_idx, hook_idx): - nf_hook_entries = hook_container - if not nf_hook_entries: - return - - nf_hook_ops_name = self.get_symbol_fullname("nf_hook_ops") - nf_hook_ops_ptr_arr = self.build_nf_hook_ops_array(nf_hook_entries) - if not nf_hook_ops_ptr_arr: - return - - for nf_hook_ops_ptr in nf_hook_ops_ptr_arr: - nf_hook_ops = nf_hook_ops_ptr.dereference().cast(nf_hook_ops_name) - yield nf_hook_ops - - -class Netfilter(interfaces.plugins.PluginInterface): - """Lists Netfilter hooks.""" - - _required_framework_version = (2, 22, 0) +class Netfilter( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=netfilter.Netfilter, + removal_date="2026-06-07", +): + """Lists Netfilter hooks (deprecated).""" _version = (2, 0, 0) - - _required_linux_utilities_modules_version = (3, 0, 0) - _required_linuxutils_gatherers_version = (1, 0, 0) - _required_linuxnet_version = (1, 0, 0) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="linux_utilities_module_gatherers", - component=linux_utilities_modules.ModuleGatherers, - version=cls._required_linuxutils_gatherers_version, - ), - requirements.VersionRequirement( - name="linuxnet", - component=network.NetSymbols, - version=cls._required_linuxnet_version, - ), - ] - - def _format_fields(self, fields): - ( - netns, - proto_name, - hook_name, - priority, - hook_func, - module_info, - symbol_name, - hooked, - ) = fields - - if module_info: - module_name = module_info.name - else: - module_name = renderers.NotAvailableValue() - - return ( - netns, - proto_name, - hook_name, - priority, - format_hints.Hex(hook_func), - module_name, - symbol_name or renderers.NotAvailableValue(), - str(hooked), - ) - - def _generator(self): - kernel_module_name = self.config["kernel"] - for fields in AbstractNetfilter.run_all( - context=self.context, kernel_module_name=kernel_module_name - ): - yield (0, self._format_fields(fields)) - - def run(self): - headers = [ - ("Net NS", int), - ("Proto", str), - ("Hook", str), - ("Priority", int), - ("Handler", format_hints.Hex), - ("Module", str), - ("Symbol", str), - ("Is Hooked", str), - ] - return renderers.TreeGrid(headers, self._generator()) + _required_framework_version = (2, 22, 0) From e3877f68ec463a8f39b946014214e5cbaf8a52b5 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 10 Jun 2025 19:37:57 +0300 Subject: [PATCH 1169/1352] Plugins: categorize linux.tty_check as a malware plugin --- test/plugins/linux/linux.py | 2 +- .../plugins/linux/malware/tty_check.py | 119 +++++++++++++++++ .../framework/plugins/linux/tty_check.py | 120 ++---------------- 3 files changed, 131 insertions(+), 110 deletions(-) create mode 100644 volatility3/framework/plugins/linux/malware/tty_check.py diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index c7f1df9c6..99fb4136a 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -89,7 +89,7 @@ class TestLinuxProcMaps: class TestLinuxTtyCheck: def test_linux_generic_tty_check(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.tty_check.tty_check", image, volatility, python + "linux.malware.tty_check.tty_check", image, volatility, python ) assert rc == 0 diff --git a/volatility3/framework/plugins/linux/malware/tty_check.py b/volatility3/framework/plugins/linux/malware/tty_check.py new file mode 100644 index 000000000..1547c5cc6 --- /dev/null +++ b/volatility3/framework/plugins/linux/malware/tty_check.py @@ -0,0 +1,119 @@ +# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +from typing import List + +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules +from volatility3.framework import interfaces, renderers, exceptions, constants +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import linux + +vollog = logging.getLogger(__name__) + + +class Tty_Check(plugins.PluginInterface): + """Checks tty devices for hooks""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 0), + ), + requirements.VersionRequirement( + name="linux_utilities_module_gatherers", + component=linux_utilities_modules.ModuleGatherers, + version=(1, 0, 0), + ), + requirements.VersionRequirement( + name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) + ), + ] + + def _generator(self): + vmlinux = self.context.modules[self.config["kernel"]] + + try: + tty_drivers = vmlinux.object_from_symbol("tty_drivers").cast("list_head") + except exceptions.SymbolError: + tty_drivers = None + + if not tty_drivers: + raise TypeError( + "This plugin requires the tty_drivers structure." + "This structure is not present in the supplied symbol table." + "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." + ) + + known_modules = linux_utilities_modules.Modules.run_modules_scanners( + context=self.context, + kernel_module_name=self.config["kernel"], + caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, + ) + + for tty in tty_drivers.to_list( + vmlinux.symbol_table_name + constants.BANG + "tty_driver", "tty_drivers" + ): + try: + ttys = utility.array_of_pointers( + tty.ttys.dereference(), + count=tty.num, + subtype=vmlinux.symbol_table_name + constants.BANG + "tty_struct", + context=self.context, + ) + except exceptions.PagedInvalidAddressException: + continue + + for tty_dev in ttys: + if tty_dev == 0: + continue + + try: + name = utility.array_to_string(tty_dev.name) + recv_buf = tty_dev.ldisc.ops.receive_buf + except exceptions.InvalidAddressException: + continue + + module_info, symbol_name = ( + linux_utilities_modules.Modules.module_lookup_by_address( + self.context, vmlinux.name, known_modules, recv_buf + ) + ) + + if module_info: + module_name = module_info.name + else: + module_name = renderers.NotAvailableValue() + + yield 0, ( + name, + format_hints.Hex(recv_buf), + module_name, + symbol_name or renderers.NotAvailableValue(), + ) + + def run(self): + return renderers.TreeGrid( + [ + ("Name", str), + ("Address", format_hints.Hex), + ("Module", str), + ("Symbol", str), + ], + self._generator(), + ) diff --git a/volatility3/framework/plugins/linux/tty_check.py b/volatility3/framework/plugins/linux/tty_check.py index 7d30b84ee..36bfb1b5a 100644 --- a/volatility3/framework/plugins/linux/tty_check.py +++ b/volatility3/framework/plugins/linux/tty_check.py @@ -1,118 +1,20 @@ -# This file is Copyright 2020 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - import logging -from typing import List - -import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, renderers, exceptions, constants -from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins -from volatility3.framework.objects import utility -from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols import linux +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.linux.malware import tty_check as ttycheck vollog = logging.getLogger(__name__) -class tty_check(plugins.PluginInterface): - """Checks tty devices for hooks""" +class tty_check( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=ttycheck.Tty_Check, + removal_date="2026-06-07", +): + """Checks tty devices for hooks (deprecated).""" _required_framework_version = (2, 0, 0) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 0), - ), - requirements.VersionRequirement( - name="linux_utilities_module_gatherers", - component=linux_utilities_modules.ModuleGatherers, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) - ), - ] - - def _generator(self): - vmlinux = self.context.modules[self.config["kernel"]] - - try: - tty_drivers = vmlinux.object_from_symbol("tty_drivers").cast("list_head") - except exceptions.SymbolError: - tty_drivers = None - - if not tty_drivers: - raise TypeError( - "This plugin requires the tty_drivers structure." - "This structure is not present in the supplied symbol table." - "This means you are either analyzing an unsupported kernel version or that your symbol table is corrupt." - ) - - known_modules = linux_utilities_modules.Modules.run_modules_scanners( - context=self.context, - kernel_module_name=self.config["kernel"], - caller_wanted_gatherers=linux_utilities_modules.ModuleGatherers.all_gatherers_identifier, - ) - - for tty in tty_drivers.to_list( - vmlinux.symbol_table_name + constants.BANG + "tty_driver", "tty_drivers" - ): - try: - ttys = utility.array_of_pointers( - tty.ttys.dereference(), - count=tty.num, - subtype=vmlinux.symbol_table_name + constants.BANG + "tty_struct", - context=self.context, - ) - except exceptions.PagedInvalidAddressException: - continue - - for tty_dev in ttys: - if tty_dev == 0: - continue - - try: - name = utility.array_to_string(tty_dev.name) - recv_buf = tty_dev.ldisc.ops.receive_buf - except exceptions.InvalidAddressException: - continue - - module_info, symbol_name = ( - linux_utilities_modules.Modules.module_lookup_by_address( - self.context, vmlinux.name, known_modules, recv_buf - ) - ) - - if module_info: - module_name = module_info.name - else: - module_name = renderers.NotAvailableValue() - - yield 0, ( - name, - format_hints.Hex(recv_buf), - module_name, - symbol_name or renderers.NotAvailableValue(), - ) - - def run(self): - return renderers.TreeGrid( - [ - ("Name", str), - ("Address", format_hints.Hex), - ("Module", str), - ("Symbol", str), - ], - self._generator(), - ) + _version = (1, 0, 0) From 8040c049e0c338e66a4f70671b6976421d2ae361 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 10 Jun 2025 20:30:05 +0300 Subject: [PATCH 1170/1352] Tests: change class name for tty_check --- test/plugins/linux/linux.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/plugins/linux/linux.py b/test/plugins/linux/linux.py index 99fb4136a..d6fbf5fa8 100644 --- a/test/plugins/linux/linux.py +++ b/test/plugins/linux/linux.py @@ -89,7 +89,7 @@ class TestLinuxProcMaps: class TestLinuxTtyCheck: def test_linux_generic_tty_check(self, image, volatility, python): rc, out, _err = test_volatility.runvol_plugin( - "linux.malware.tty_check.tty_check", image, volatility, python + "linux.malware.tty_check.Tty_Check", image, volatility, python ) assert rc == 0 From 742b0634b931855a74f39fdb3e9ebbe8142ee7db Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 19:30:29 +0300 Subject: [PATCH 1171/1352] readjust _run to contain less code & removal of redundant code --- volatility3/framework/plugins/regexscan.py | 43 ++++++++-------------- 1 file changed, 15 insertions(+), 28 deletions(-) diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index e95986899..1f199658e 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -46,12 +46,21 @@ class RegExScan(plugins.PluginInterface): ), ] - def _generator(self, compiled_pattern, raw_pattern, maxsize): - vollog.debug(f"RegEx Pattern: {raw_pattern}") - layer = self.context.layers[self.config["primary"]] + def _generator(self, layer, pattern, maxsize): + vollog.debug(f"RegEx Pattern: {pattern}") + + # Convert string pattern to bytes for RegExScanner + pattern_bytes = pattern.encode("utf-8") + + # Compile the pattern here to ensure consistency + try: + compiled_pattern = re.compile(pattern_bytes) + except re.error as e: + vollog.error(f"Invalid regex pattern: {e}") + raise ValueError(f"Invalid regex pattern: {e}") for offset in layer.scan( - context=self.context, scanner=scanners.RegExScanner(raw_pattern) + context=self.context, scanner=scanners.RegExScanner(pattern_bytes) ): result_data = layer.read(offset, maxsize, pad=True) @@ -73,30 +82,8 @@ class RegExScan(plugins.PluginInterface): def run(self): pattern = self.config.get("pattern") - - # Handle pattern encoding robustly - if isinstance(pattern, str): - try: - raw_pattern = pattern.encode("utf-8") - except UnicodeEncodeError: - raw_pattern = pattern.encode("latin1", errors="replace") - else: - raw_pattern = pattern - - try: - compiled_pattern = re.compile(raw_pattern) - except re.error as e: - vollog.error(f"Invalid regex pattern: {e}") - return renderers.TreeGrid( - [ - ("Offset", format_hints.Hex), - ("Text", str), - ("Hex", bytes), - ], - [], - ) - maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT) + layer = self.context.layers[self.config["primary"]] return renderers.TreeGrid( [ @@ -104,5 +91,5 @@ class RegExScan(plugins.PluginInterface): ("Text", str), ("Hex", bytes), ], - self._generator(compiled_pattern, raw_pattern, maxsize), + self._generator(layer, pattern, maxsize), ) From c270cf4b15123662c2ca2d0af48bc5144fafd78e Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Thu, 12 Jun 2025 20:09:28 +0300 Subject: [PATCH 1172/1352] RegexScan: parameterize _generator --- volatility3/framework/plugins/regexscan.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/regexscan.py b/volatility3/framework/plugins/regexscan.py index 1f199658e..2c188ba4c 100644 --- a/volatility3/framework/plugins/regexscan.py +++ b/volatility3/framework/plugins/regexscan.py @@ -46,7 +46,8 @@ class RegExScan(plugins.PluginInterface): ), ] - def _generator(self, layer, pattern, maxsize): + def _generator(self, context, layer_name, pattern, maxsize): + layer = self.context.layers[layer_name] vollog.debug(f"RegEx Pattern: {pattern}") # Convert string pattern to bytes for RegExScanner @@ -60,7 +61,7 @@ class RegExScan(plugins.PluginInterface): raise ValueError(f"Invalid regex pattern: {e}") for offset in layer.scan( - context=self.context, scanner=scanners.RegExScanner(pattern_bytes) + context=context, scanner=scanners.RegExScanner(pattern_bytes) ): result_data = layer.read(offset, maxsize, pad=True) @@ -83,7 +84,8 @@ class RegExScan(plugins.PluginInterface): def run(self): pattern = self.config.get("pattern") maxsize = self.config.get("maxsize", self.MAXSIZE_DEFAULT) - layer = self.context.layers[self.config["primary"]] + layer_name = self.config["primary"] + context = self.context return renderers.TreeGrid( [ @@ -91,5 +93,5 @@ class RegExScan(plugins.PluginInterface): ("Text", str), ("Hex", bytes), ], - self._generator(layer, pattern, maxsize), + self._generator(context, layer_name, pattern, maxsize), ) From 215ba1dfaad2b32f9d07b2d615ee6b92166be8be Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Fri, 13 Jun 2025 17:42:17 +0300 Subject: [PATCH 1173/1352] Plugins: categorize ldrmodules as a malware plugin --- test/plugins/windows/windows.py | 26 ++-- .../framework/plugins/windows/ldrmodules.py | 126 ++--------------- .../plugins/windows/malware/ldrmodules.py | 128 ++++++++++++++++++ 3 files changed, 151 insertions(+), 129 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/ldrmodules.py diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 0f44ba533..431461b6d 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -58,6 +58,7 @@ class TestWindowsPslist: } assert test_volatility.match_output_row(expected_row, json.loads(out)) + class TestWindowsTimeliner: def test_windows_specific_timeliner(self, volatility, python): image = WindowsSamples.WINDOWSXP_GENERIC.value.path @@ -67,6 +68,7 @@ class TestWindowsTimeliner: assert rc == 0 assert out.count(b"\n") > 10 + class TestWindowsPsscan: def test_windows_specific_psscan(self, volatility, python): image = WindowsSamples.WINDOWSXP_GENERIC.value.path @@ -780,19 +782,19 @@ class TestWindowsSymlinkScan: assert test_volatility.count_entries_flat(json_out) > 5 expected_rows = [ { - "CreateTime": "2005-06-25T16:47:28+00:00", - "From Name": "AUX", - "Offset": 453082584, - "To Name": "\\DosDevices\\COM1", - "__children": [] + "CreateTime": "2005-06-25T16:47:28+00:00", + "From Name": "AUX", + "Offset": 453082584, + "To Name": "\\DosDevices\\COM1", + "__children": [], }, { - "CreateTime": "2005-06-25T16:47:28+00:00", - "From Name": "UNC", - "Offset": 453176664, - "To Name": "\\Device\\Mup", - "__children": [] - } + "CreateTime": "2005-06-25T16:47:28+00:00", + "From Name": "UNC", + "Offset": 453176664, + "To Name": "\\Device\\Mup", + "__children": [], + }, ] for expected_row in expected_rows: @@ -803,7 +805,7 @@ class TestWindowsLdrModules: def test_windows_specific_ldrmodules(self, volatility, python): image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( - "windows.ldrmodules.LdrModules", + "windows.malware.ldrmodules.LdrModules", image, volatility, python, diff --git a/volatility3/framework/plugins/windows/ldrmodules.py b/volatility3/framework/plugins/windows/ldrmodules.py index 32432c44e..efb62f8f6 100644 --- a/volatility3/framework/plugins/windows/ldrmodules.py +++ b/volatility3/framework/plugins/windows/ldrmodules.py @@ -1,128 +1,20 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - import logging - -from volatility3.framework import constants, exceptions, interfaces, renderers -from volatility3.framework.configuration import requirements -from volatility3.framework.renderers import format_hints -from volatility3.framework.symbols import intermed -from volatility3.framework.symbols.windows.extensions import pe -from volatility3.plugins.windows import pslist, vadinfo +from volatility3.framework import interfaces, deprecation +from volatility3.plugins.windows.malware import ldrmodules vollog = logging.getLogger(__name__) -class LdrModules(interfaces.plugins.PluginInterface): +class LdrModules( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=ldrmodules.LdrModules, + removal_date="2026-06-07", +): """Lists the loaded modules in a particular windows memory image.""" _required_framework_version = (2, 0, 0) _version = (1, 0, 1) - - @classmethod - def get_requirements(cls): - return [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) - ), - requirements.ListRequirement( - name="pid", - element_type=int, - description="Process IDs to include (all other processes are excluded)", - optional=True, - ), - ] - - def _generator(self, procs): - pe_table_name = intermed.IntermediateSymbolTable.create( - self.context, self.config_path, "windows", "pe", class_types=pe.class_types - ) - - for proc in procs: - proc_layer_name = proc.add_process_layer() - - # Build dictionaries from different module lists, where the DllBase address is the key and value is the module object - load_order_mod = dict( - (mod.DllBase, mod) for mod in proc.load_order_modules() - ) - init_order_mod = dict( - (mod.DllBase, mod) for mod in proc.init_order_modules() - ) - mem_order_mod = dict((mod.DllBase, mod) for mod in proc.mem_order_modules()) - - # Build dictionary of mapped files, where the VAD start address is the key and value is the file name of the mapped file - mapped_files = {} - for vad in vadinfo.VadInfo.list_vads(proc): - dos_header = self.context.object( - pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", - offset=vad.get_start(), - layer_name=proc_layer_name, - ) - try: - # Filter out VADs that do not start with a MZ header - if dos_header.e_magic != 0x5A4D: - continue - except exceptions.InvalidAddressException: - vollog.log( - constants.LOGLEVEL_VVVV, - f"Skipping vad at {hex(dos_header.vol.offset)} due to InvalidAddressException", - ) - continue - - mapped_files[vad.get_start()] = vad.get_file_name() - - for base in mapped_files.keys(): - # Does the base address exist in the PEB DLL lists? - load_mod = load_order_mod.get(base, None) - init_mod = init_order_mod.get(base, None) - mem_mod = mem_order_mod.get(base, None) - - yield ( - 0, - [ - int(proc.UniqueProcessId), - str( - proc.ImageFileName.cast( - "string", - max_length=proc.ImageFileName.vol.count, - errors="replace", - ) - ), - format_hints.Hex(base), - load_mod is not None, - init_mod is not None, - mem_mod is not None, - mapped_files[base], - ], - ) - - def run(self): - filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) - - return renderers.TreeGrid( - [ - ("Pid", int), - ("Process", str), - ("Base", format_hints.Hex), - ("InLoad", bool), - ("InInit", bool), - ("InMem", bool), - ("MappedPath", str), - ], - self._generator( - pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config["kernel"], - filter_func=filter_func, - ) - ), - ) diff --git a/volatility3/framework/plugins/windows/malware/ldrmodules.py b/volatility3/framework/plugins/windows/malware/ldrmodules.py new file mode 100644 index 000000000..32432c44e --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/ldrmodules.py @@ -0,0 +1,128 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging + +from volatility3.framework import constants, exceptions, interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints +from volatility3.framework.symbols import intermed +from volatility3.framework.symbols.windows.extensions import pe +from volatility3.plugins.windows import pslist, vadinfo + +vollog = logging.getLogger(__name__) + + +class LdrModules(interfaces.plugins.PluginInterface): + """Lists the loaded modules in a particular windows memory image.""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 1) + + @classmethod + def get_requirements(cls): + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="vadinfo", component=vadinfo.VadInfo, version=(2, 0, 0) + ), + requirements.ListRequirement( + name="pid", + element_type=int, + description="Process IDs to include (all other processes are excluded)", + optional=True, + ), + ] + + def _generator(self, procs): + pe_table_name = intermed.IntermediateSymbolTable.create( + self.context, self.config_path, "windows", "pe", class_types=pe.class_types + ) + + for proc in procs: + proc_layer_name = proc.add_process_layer() + + # Build dictionaries from different module lists, where the DllBase address is the key and value is the module object + load_order_mod = dict( + (mod.DllBase, mod) for mod in proc.load_order_modules() + ) + init_order_mod = dict( + (mod.DllBase, mod) for mod in proc.init_order_modules() + ) + mem_order_mod = dict((mod.DllBase, mod) for mod in proc.mem_order_modules()) + + # Build dictionary of mapped files, where the VAD start address is the key and value is the file name of the mapped file + mapped_files = {} + for vad in vadinfo.VadInfo.list_vads(proc): + dos_header = self.context.object( + pe_table_name + constants.BANG + "_IMAGE_DOS_HEADER", + offset=vad.get_start(), + layer_name=proc_layer_name, + ) + try: + # Filter out VADs that do not start with a MZ header + if dos_header.e_magic != 0x5A4D: + continue + except exceptions.InvalidAddressException: + vollog.log( + constants.LOGLEVEL_VVVV, + f"Skipping vad at {hex(dos_header.vol.offset)} due to InvalidAddressException", + ) + continue + + mapped_files[vad.get_start()] = vad.get_file_name() + + for base in mapped_files.keys(): + # Does the base address exist in the PEB DLL lists? + load_mod = load_order_mod.get(base, None) + init_mod = init_order_mod.get(base, None) + mem_mod = mem_order_mod.get(base, None) + + yield ( + 0, + [ + int(proc.UniqueProcessId), + str( + proc.ImageFileName.cast( + "string", + max_length=proc.ImageFileName.vol.count, + errors="replace", + ) + ), + format_hints.Hex(base), + load_mod is not None, + init_mod is not None, + mem_mod is not None, + mapped_files[base], + ], + ) + + def run(self): + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + + return renderers.TreeGrid( + [ + ("Pid", int), + ("Process", str), + ("Base", format_hints.Hex), + ("InLoad", bool), + ("InInit", bool), + ("InMem", bool), + ("MappedPath", str), + ], + self._generator( + pslist.PsList.list_processes( + context=self.context, + kernel_module_name=self.config["kernel"], + filter_func=filter_func, + ) + ), + ) From e37ed0e806d1028a4766289626551fd8fac4c099 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 14 Jun 2025 23:08:15 +0300 Subject: [PATCH 1174/1352] Plugins: categorize direct_system_calls as a malware plugin --- .../plugins/windows/direct_system_calls.py | 432 +--------------- .../windows/malware/direct_system_calls.py | 472 ++++++++++++++++++ 2 files changed, 483 insertions(+), 421 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/direct_system_calls.py diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index dce09605b..9616696d8 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -1,28 +1,13 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - import logging - +from volatility3.framework import interfaces, deprecation from collections import namedtuple -from typing import List, Tuple, Optional, Generator, Callable - -from volatility3.framework.objects import utility -from volatility3.framework import interfaces, renderers, symbols, exceptions -from volatility3.framework.configuration import requirements -from volatility3.plugins import yarascan -from volatility3.framework.renderers import format_hints -from volatility3.plugins.windows import pslist +from volatility3.plugins.windows.malware import direct_system_calls vollog = logging.getLogger(__name__) -try: - import capstone - - has_capstone = True -except ImportError: - has_capstone = False - # Full details on the techniques used in these plugins to detect EDR-evading malware # can be found in our 20 page whitepaper submitted to DEFCON along with the presentation # https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf @@ -38,19 +23,13 @@ syscall_finder_type = namedtuple( ], ) -syscall_finder_type.__doc__ = """ -This type is used to specify how malicious system call invocations should be found. - -`get_syscall_target_address` is optionally used to extract the address containing the malicious 'syscall' instruction -`wants_syscall_inst` whether or not this method expects the 'syscall' instruction directly within the malicious code block -`rule` the opcode string to search for the malicious syscall instructions -`invalid_ops` instructions that only appear in invalid code blocks. Stops processing of the code block when encountered. -`termination_ops` instructions that are expected to be present in the code block and that stop processing -""" - - -class DirectSystemCalls(interfaces.plugins.PluginInterface): - """Detects the Direct System Call technique used to bypass EDRs""" +class DirectSystemCalls( + interfaces.plugins.PluginInterface, + deprecation.PluginRenameClass, + replacement_class=direct_system_calls.DirectSystemCalls, + removal_date="2026-06-07", +): + """Detects the Direct System Call technique used to bypass EDRs (deprecated).""" _required_framework_version = (2, 4, 0) @@ -80,393 +59,4 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): ["jmp", "call", "leave", "int3"], # the expected form is to end with a "ret" back to the calling code ["ret"], - ) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - # create a list of requirements for vadyarascan - vadyarascan_requirements = [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="pslist", component=pslist.PsList, version=(3, 0, 0) - ), - requirements.VersionRequirement( - name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) - ), - requirements.VersionRequirement( - name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) - ), - ] - - # get base yarascan requirements for command line options - yarascan_requirements = yarascan.YaraScan.get_yarascan_option_requirements() - - # return the combined requirements - return yarascan_requirements + vadyarascan_requirements - - @staticmethod - def _is_syscall_block( - disasm_func: Callable, - syscall_finder: syscall_finder_type, - data: bytes, - address: int, - ) -> Optional[Tuple[str, "capstone._cs_insn"]]: - """ - Determines if the bytes starting at `data` represent a valid syscall instruction invocation block - - To maliciously invoke the system call instruction, malware must do each of the following: - - 1) update RAX to the system call number - 2) update R10 to the first parameter - 3) hit the 'termination' instruction set in `syscall_finder_type` - - We also track whether the 'syscall' instruction was encountered while parsing - - This function is reusable for every technique we found and studied during the DEFCON research timeframe - - Args: - disasm_func: capstone disassembly function gathered from `get_disasm_function` - syscall_finder: the method and constraints on the malicious system call blocks that the calling plugin knows how to find - data: the bytes from memory to search for malicious syscall invocations - address: the address from where `data` came from in the particular process - Returns: - Optional[Tuple[str, capstone._cs_insn]]: For valid blocks, the disassembled bytes in string from and the last (termination) instruction - """ - found_movr10 = False - found_movreax = False - found_syscall = False - found_end = False - end_inst = None - - disasm_bytes = "" - - for inst in disasm_func(data, address): - disasm_bytes += f"{inst.address:#x}: {inst.mnemonic} {inst.op_str}; " - - # an instruction of all 0x00 opcodes - if inst.opcode.count(0) == len(inst.opcode): - break - - op = inst.mnemonic - - # invalid op, bail - if op in syscall_finder.invalid_ops: - break - - # found the end instruction wanted by the caller - elif op in syscall_finder.termination_ops: - found_end = True - end_inst = inst - break - - # track this no matter what to make code more re-usable - elif op == "syscall": - found_syscall = True - - # if we hit a 'syscall' but RAX or R10 haven't been touched - # then we are in an invalid path, so bail - if not syscall_finder.wants_syscall_inst or ( - not (found_movr10 and found_movreax) - ): - break - - else: - # attempt to see if any other instruction type wrote to registers - try: - _, regs_written = inst.regs_access() - except capstone.CsError: - continue - - if regs_written: - for r in regs_written: - # track writes to eax/rax or R10 - reg = inst.reg_name(r) - if reg in ["eax", "rax"]: - found_movreax = True - - elif reg == "r10": - found_movr10 = True - - # if any of these are missing, the block is invalid regardless of - # the technique we are trying to detect now or in the future - if not (found_movr10 and found_movreax and found_end): - return None - - # if the finder requires a 'syscall' instruction then bail now if we didn't find one - if syscall_finder.wants_syscall_inst and not found_syscall: - return None - - return disasm_bytes, end_inst - - @classmethod - def get_disasm_function(cls, architecture: str) -> Callable: - """ - Returns the disassembly handler for the given architecture - .detail is used to get full instruction information - - Args: - architecture: the name of the architecture for the process being disassembled - Returns: - The disasm function from capstone for the given architecture - """ - disasm_types = { - "intel": capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32), - "intel64": capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64), - } - - disasm_type = disasm_types[architecture] - disasm_type.detail = True - return disasm_type.disasm - - @classmethod - def _is_valid_syscall( - cls, - syscall_finder: syscall_finder_type, - proc_layer: interfaces.layers.DataLayerInterface, - architecture: str, - vads: List[Tuple[int, int, str]], - address: int, - ) -> Optional[Tuple[int, str]]: - """ - Args: - syscall_finder: - proc_layer: the memory layer of the process being scanned - architecture: the name of the architecture for the process being disassembled - vads: the ranges of this process under 10MB - address: the starting address to check for malicious syscall code blocks - - Returns: - Optional[Tuple[int, str]]: For valid code blocks, the starting address of the block and the disassembly string - """ - # the number bytes behind the yara rule hit to scan - behind = 32 - - address = address - behind - - try: - data = proc_layer.read(address, behind * 2) - except exceptions.InvalidAddressException: - return None - - disasm_func = cls.get_disasm_function(architecture) - - # since Intel does not have fixed-size instructions, we have to scan - # each byte offset and re-disassemble the remaining block - for offset in range(behind): - # if this looks like a system call back (r10, rax, ret/jmp) - syscall_info = cls._is_syscall_block( - disasm_func, syscall_finder, data[offset:], address + offset - ) - if syscall_info: - disasm_bytes, end_inst = syscall_info - - # if we can recover (and require) a target address for this malware technique - if syscall_finder.get_syscall_target_address: - target_address = syscall_finder.get_syscall_target_address( - proc_layer, end_inst - ) - - # could not determine the address -> invalid basic block - if not target_address: - continue - - # we only care about calls to system call DLLs - path = cls.get_range_path(vads, target_address) - if not isinstance(path, str) or not path.lower().endswith( - cls.valid_syscall_handlers - ): - continue - - # return the address and disassembly string if all checks pass - return address + offset, disasm_bytes - - return None - - @classmethod - def get_vad_maps( - cls, - task: interfaces.objects.ObjectInterface, - ) -> List[Tuple[int, int, str]]: - """Creates a map of start/end addresses within a virtual address - descriptor tree. - - Args: - task: The EPROCESS object of which to traverse the vad tree - - Returns: - An iterable of tuples containing start and end addresses for each descriptor - """ - vads: List[Tuple[int, int, str]] = [] - - # scan regions under 10MB - scan_max = 10 * 1000 * 1000 - - vad_root = task.get_vad_root() - - for vad in vad_root.traverse(): - if vad.get_size() < scan_max: - vads.append((vad.get_start(), vad.get_size(), vad.get_file_name())) - - return vads - - @classmethod - def get_range_path( - cls, ranges: List[Tuple[int, int, str]], address: int - ) -> Optional[str]: - """ - Returns the path for the range holding `address`, if found - - Args: - ranges: VADs collected from `get_vad_maps` - address: the address to find - Returns: - The path holding the address, if any - """ - for start, size, path in ranges: - if start <= address < start + size: - return path - - return None - - @classmethod - def get_tasks_to_scan( - cls, - context: interfaces.context.ContextInterface, - kernel_module_name: str, - ) -> Generator[ - Tuple[interfaces.objects.ObjectInterface, str, str, str], None, None - ]: - """ - Gathers active processes with the extra information needed - to detect malicious syscall instructions - - Returns: - Generator of the process object, name, memory layer, and architecture - """ - - # gather active processes - filter_func = pslist.PsList.create_active_process_filter() - - kernel = context.modules[kernel_module_name] - - is_32bit_arch = not symbols.symbol_table_is_64bit( - context=context, symbol_table_name=kernel.symbol_table_name - ) - - for proc in pslist.PsList.list_processes( - context=context, - kernel_module_name=kernel_module_name, - filter_func=filter_func, - ): - proc_name = utility.array_to_string(proc.ImageFileName) - - # skip Defender - if proc_name in ["MsMpEng.exe"]: - continue - - try: - proc_layer_name = proc.add_process_layer() - except exceptions.InvalidAddressException: - continue - - if is_32bit_arch or proc.get_is_wow64(): - architecture = "intel" - else: - architecture = "intel64" - - yield proc, proc_name, proc_layer_name, architecture - - @classmethod - def _get_rule_hits( - cls, - context: interfaces.objects.ObjectInterface, - proc_layer: interfaces.layers.DataLayerInterface, - vads: List[Tuple[int, int, str]], - pattern: str, - ) -> Generator[Tuple[int, Optional[str]], None, None]: - """ - Runs the given opcode rule through Yara and returns the address and file path of hits - - Args: - context: - proc_layer: the layer to scan - vads: the ranges inside of the process being scanned - pattern: the opcodes rule from the plugin to detect a particular EDR-bypass technique - - Returns: - Generator of the address and file path of hits - """ - sections = [(vad[0], vad[1]) for vad in vads] - - rule = yarascan.YaraScanner.get_rule(pattern) - - for hit in proc_layer.scan( - context=context, - scanner=yarascan.YaraScanner(rules=rule), - sections=sections, - ): - address = hit[0] - - path = cls.get_range_path(vads, address) - - # ignore hits in the system call DLLs - if isinstance(path, str) and path.lower().endswith( - cls.valid_syscall_handlers - ): - continue - - yield address, path - - def _generator( - self, - ) -> Generator[Tuple[int, Tuple[str, int, Optional[str], int, str]], None, None]: - if not has_capstone: - vollog.warning( - "capstone is not installed. This plugin requires capstone to operate." - ) - return - - for proc, proc_name, proc_layer_name, architecture in self.get_tasks_to_scan( - self.context, self.config["kernel"] - ): - proc_layer = self.context.layers[proc_layer_name] - - vads = self.get_vad_maps(proc) - if not vads: - continue - - # for each valid process, look for malicious syscall invocations - for address, vad_path in self._get_rule_hits( - self.context, proc_layer, vads, self.syscall_finder.rule_str - ): - syscall_info = self._is_valid_syscall( - self.syscall_finder, proc_layer, architecture, vads, address - ) - if not syscall_info: - continue - - address, disasm_bytes = syscall_info - - yield 0, ( - proc_name, - proc.UniqueProcessId, - vad_path, - format_hints.Hex(address), - disasm_bytes, - ) - - def run(self) -> renderers.TreeGrid: - return renderers.TreeGrid( - [ - ("Process", str), - ("PID", int), - ("Range", str), - ("Address", format_hints.Hex), - ("Disasm", str), - ], - self._generator(), - ) + ) \ No newline at end of file diff --git a/volatility3/framework/plugins/windows/malware/direct_system_calls.py b/volatility3/framework/plugins/windows/malware/direct_system_calls.py new file mode 100644 index 000000000..dce09605b --- /dev/null +++ b/volatility3/framework/plugins/windows/malware/direct_system_calls.py @@ -0,0 +1,472 @@ +# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging + +from collections import namedtuple +from typing import List, Tuple, Optional, Generator, Callable + +from volatility3.framework.objects import utility +from volatility3.framework import interfaces, renderers, symbols, exceptions +from volatility3.framework.configuration import requirements +from volatility3.plugins import yarascan +from volatility3.framework.renderers import format_hints +from volatility3.plugins.windows import pslist + +vollog = logging.getLogger(__name__) + +try: + import capstone + + has_capstone = True +except ImportError: + has_capstone = False + +# Full details on the techniques used in these plugins to detect EDR-evading malware +# can be found in our 20 page whitepaper submitted to DEFCON along with the presentation +# https://www.volexity.com/wp-content/uploads/2024/08/Defcon24_EDR_Evasion_Detection_White-Paper_Andrew-Case.pdf + +syscall_finder_type = namedtuple( + "syscall_finder_type", + [ + "get_syscall_target_address", + "wants_syscall_inst", + "rule_str", + "invalid_ops", + "termination_ops", + ], +) + +syscall_finder_type.__doc__ = """ +This type is used to specify how malicious system call invocations should be found. + +`get_syscall_target_address` is optionally used to extract the address containing the malicious 'syscall' instruction +`wants_syscall_inst` whether or not this method expects the 'syscall' instruction directly within the malicious code block +`rule` the opcode string to search for the malicious syscall instructions +`invalid_ops` instructions that only appear in invalid code blocks. Stops processing of the code block when encountered. +`termination_ops` instructions that are expected to be present in the code block and that stop processing +""" + + +class DirectSystemCalls(interfaces.plugins.PluginInterface): + """Detects the Direct System Call technique used to bypass EDRs""" + + _required_framework_version = (2, 4, 0) + + # 2.0.0 - changes signature of `get_tasks_to_scan` + _version = (2, 0, 0) + + # DLLs that are expected to host system call invocations + valid_syscall_handlers = ("ntdll.dll", "win32u.dll") + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + + self.syscall_finder = syscall_finder_type( + # for direct system calls, we find the `syscall` instruction directly, so we already know the address + None, + # yes, we want the syscall instruction present as it is what this technique looks for + True, + # regex to find "\x0f\x05" (syscall) followed later by "\xc3" (ret) + # we allow spacing in between to break naive anti-analysis forms (e.g., TarTarus Gate) + # Standard techniques, such as HellsGate, look like: + # mov r10, rcx + # mov eax, + # syscall + # ret + "/\\x0f\\x05[^\\xc3]{,24}\\xc3/", + # any of these will not be in a workable, malicious direct system call block + ["jmp", "call", "leave", "int3"], + # the expected form is to end with a "ret" back to the calling code + ["ret"], + ) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + # create a list of requirements for vadyarascan + vadyarascan_requirements = [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) + ), + requirements.VersionRequirement( + name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) + ), + ] + + # get base yarascan requirements for command line options + yarascan_requirements = yarascan.YaraScan.get_yarascan_option_requirements() + + # return the combined requirements + return yarascan_requirements + vadyarascan_requirements + + @staticmethod + def _is_syscall_block( + disasm_func: Callable, + syscall_finder: syscall_finder_type, + data: bytes, + address: int, + ) -> Optional[Tuple[str, "capstone._cs_insn"]]: + """ + Determines if the bytes starting at `data` represent a valid syscall instruction invocation block + + To maliciously invoke the system call instruction, malware must do each of the following: + + 1) update RAX to the system call number + 2) update R10 to the first parameter + 3) hit the 'termination' instruction set in `syscall_finder_type` + + We also track whether the 'syscall' instruction was encountered while parsing + + This function is reusable for every technique we found and studied during the DEFCON research timeframe + + Args: + disasm_func: capstone disassembly function gathered from `get_disasm_function` + syscall_finder: the method and constraints on the malicious system call blocks that the calling plugin knows how to find + data: the bytes from memory to search for malicious syscall invocations + address: the address from where `data` came from in the particular process + Returns: + Optional[Tuple[str, capstone._cs_insn]]: For valid blocks, the disassembled bytes in string from and the last (termination) instruction + """ + found_movr10 = False + found_movreax = False + found_syscall = False + found_end = False + end_inst = None + + disasm_bytes = "" + + for inst in disasm_func(data, address): + disasm_bytes += f"{inst.address:#x}: {inst.mnemonic} {inst.op_str}; " + + # an instruction of all 0x00 opcodes + if inst.opcode.count(0) == len(inst.opcode): + break + + op = inst.mnemonic + + # invalid op, bail + if op in syscall_finder.invalid_ops: + break + + # found the end instruction wanted by the caller + elif op in syscall_finder.termination_ops: + found_end = True + end_inst = inst + break + + # track this no matter what to make code more re-usable + elif op == "syscall": + found_syscall = True + + # if we hit a 'syscall' but RAX or R10 haven't been touched + # then we are in an invalid path, so bail + if not syscall_finder.wants_syscall_inst or ( + not (found_movr10 and found_movreax) + ): + break + + else: + # attempt to see if any other instruction type wrote to registers + try: + _, regs_written = inst.regs_access() + except capstone.CsError: + continue + + if regs_written: + for r in regs_written: + # track writes to eax/rax or R10 + reg = inst.reg_name(r) + if reg in ["eax", "rax"]: + found_movreax = True + + elif reg == "r10": + found_movr10 = True + + # if any of these are missing, the block is invalid regardless of + # the technique we are trying to detect now or in the future + if not (found_movr10 and found_movreax and found_end): + return None + + # if the finder requires a 'syscall' instruction then bail now if we didn't find one + if syscall_finder.wants_syscall_inst and not found_syscall: + return None + + return disasm_bytes, end_inst + + @classmethod + def get_disasm_function(cls, architecture: str) -> Callable: + """ + Returns the disassembly handler for the given architecture + .detail is used to get full instruction information + + Args: + architecture: the name of the architecture for the process being disassembled + Returns: + The disasm function from capstone for the given architecture + """ + disasm_types = { + "intel": capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32), + "intel64": capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64), + } + + disasm_type = disasm_types[architecture] + disasm_type.detail = True + return disasm_type.disasm + + @classmethod + def _is_valid_syscall( + cls, + syscall_finder: syscall_finder_type, + proc_layer: interfaces.layers.DataLayerInterface, + architecture: str, + vads: List[Tuple[int, int, str]], + address: int, + ) -> Optional[Tuple[int, str]]: + """ + Args: + syscall_finder: + proc_layer: the memory layer of the process being scanned + architecture: the name of the architecture for the process being disassembled + vads: the ranges of this process under 10MB + address: the starting address to check for malicious syscall code blocks + + Returns: + Optional[Tuple[int, str]]: For valid code blocks, the starting address of the block and the disassembly string + """ + # the number bytes behind the yara rule hit to scan + behind = 32 + + address = address - behind + + try: + data = proc_layer.read(address, behind * 2) + except exceptions.InvalidAddressException: + return None + + disasm_func = cls.get_disasm_function(architecture) + + # since Intel does not have fixed-size instructions, we have to scan + # each byte offset and re-disassemble the remaining block + for offset in range(behind): + # if this looks like a system call back (r10, rax, ret/jmp) + syscall_info = cls._is_syscall_block( + disasm_func, syscall_finder, data[offset:], address + offset + ) + if syscall_info: + disasm_bytes, end_inst = syscall_info + + # if we can recover (and require) a target address for this malware technique + if syscall_finder.get_syscall_target_address: + target_address = syscall_finder.get_syscall_target_address( + proc_layer, end_inst + ) + + # could not determine the address -> invalid basic block + if not target_address: + continue + + # we only care about calls to system call DLLs + path = cls.get_range_path(vads, target_address) + if not isinstance(path, str) or not path.lower().endswith( + cls.valid_syscall_handlers + ): + continue + + # return the address and disassembly string if all checks pass + return address + offset, disasm_bytes + + return None + + @classmethod + def get_vad_maps( + cls, + task: interfaces.objects.ObjectInterface, + ) -> List[Tuple[int, int, str]]: + """Creates a map of start/end addresses within a virtual address + descriptor tree. + + Args: + task: The EPROCESS object of which to traverse the vad tree + + Returns: + An iterable of tuples containing start and end addresses for each descriptor + """ + vads: List[Tuple[int, int, str]] = [] + + # scan regions under 10MB + scan_max = 10 * 1000 * 1000 + + vad_root = task.get_vad_root() + + for vad in vad_root.traverse(): + if vad.get_size() < scan_max: + vads.append((vad.get_start(), vad.get_size(), vad.get_file_name())) + + return vads + + @classmethod + def get_range_path( + cls, ranges: List[Tuple[int, int, str]], address: int + ) -> Optional[str]: + """ + Returns the path for the range holding `address`, if found + + Args: + ranges: VADs collected from `get_vad_maps` + address: the address to find + Returns: + The path holding the address, if any + """ + for start, size, path in ranges: + if start <= address < start + size: + return path + + return None + + @classmethod + def get_tasks_to_scan( + cls, + context: interfaces.context.ContextInterface, + kernel_module_name: str, + ) -> Generator[ + Tuple[interfaces.objects.ObjectInterface, str, str, str], None, None + ]: + """ + Gathers active processes with the extra information needed + to detect malicious syscall instructions + + Returns: + Generator of the process object, name, memory layer, and architecture + """ + + # gather active processes + filter_func = pslist.PsList.create_active_process_filter() + + kernel = context.modules[kernel_module_name] + + is_32bit_arch = not symbols.symbol_table_is_64bit( + context=context, symbol_table_name=kernel.symbol_table_name + ) + + for proc in pslist.PsList.list_processes( + context=context, + kernel_module_name=kernel_module_name, + filter_func=filter_func, + ): + proc_name = utility.array_to_string(proc.ImageFileName) + + # skip Defender + if proc_name in ["MsMpEng.exe"]: + continue + + try: + proc_layer_name = proc.add_process_layer() + except exceptions.InvalidAddressException: + continue + + if is_32bit_arch or proc.get_is_wow64(): + architecture = "intel" + else: + architecture = "intel64" + + yield proc, proc_name, proc_layer_name, architecture + + @classmethod + def _get_rule_hits( + cls, + context: interfaces.objects.ObjectInterface, + proc_layer: interfaces.layers.DataLayerInterface, + vads: List[Tuple[int, int, str]], + pattern: str, + ) -> Generator[Tuple[int, Optional[str]], None, None]: + """ + Runs the given opcode rule through Yara and returns the address and file path of hits + + Args: + context: + proc_layer: the layer to scan + vads: the ranges inside of the process being scanned + pattern: the opcodes rule from the plugin to detect a particular EDR-bypass technique + + Returns: + Generator of the address and file path of hits + """ + sections = [(vad[0], vad[1]) for vad in vads] + + rule = yarascan.YaraScanner.get_rule(pattern) + + for hit in proc_layer.scan( + context=context, + scanner=yarascan.YaraScanner(rules=rule), + sections=sections, + ): + address = hit[0] + + path = cls.get_range_path(vads, address) + + # ignore hits in the system call DLLs + if isinstance(path, str) and path.lower().endswith( + cls.valid_syscall_handlers + ): + continue + + yield address, path + + def _generator( + self, + ) -> Generator[Tuple[int, Tuple[str, int, Optional[str], int, str]], None, None]: + if not has_capstone: + vollog.warning( + "capstone is not installed. This plugin requires capstone to operate." + ) + return + + for proc, proc_name, proc_layer_name, architecture in self.get_tasks_to_scan( + self.context, self.config["kernel"] + ): + proc_layer = self.context.layers[proc_layer_name] + + vads = self.get_vad_maps(proc) + if not vads: + continue + + # for each valid process, look for malicious syscall invocations + for address, vad_path in self._get_rule_hits( + self.context, proc_layer, vads, self.syscall_finder.rule_str + ): + syscall_info = self._is_valid_syscall( + self.syscall_finder, proc_layer, architecture, vads, address + ) + if not syscall_info: + continue + + address, disasm_bytes = syscall_info + + yield 0, ( + proc_name, + proc.UniqueProcessId, + vad_path, + format_hints.Hex(address), + disasm_bytes, + ) + + def run(self) -> renderers.TreeGrid: + return renderers.TreeGrid( + [ + ("Process", str), + ("PID", int), + ("Range", str), + ("Address", format_hints.Hex), + ("Disasm", str), + ], + self._generator(), + ) From 7cc8c6e94c3a6f3eccf318afd0b46ee46ec011d9 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 14 Jun 2025 23:08:56 +0300 Subject: [PATCH 1175/1352] Plugins: categorize indirect_system_calls as a malware plugin --- .../plugins/windows/indirect_system_calls.py | 122 ++---------------- .../windows/malware/indirect_system_calls.py | 120 +++++++++++++++++ 2 files changed, 132 insertions(+), 110 deletions(-) create mode 100644 volatility3/framework/plugins/windows/malware/indirect_system_calls.py diff --git a/volatility3/framework/plugins/windows/indirect_system_calls.py b/volatility3/framework/plugins/windows/indirect_system_calls.py index 26216d2c3..65f5f8734 100644 --- a/volatility3/framework/plugins/windows/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/indirect_system_calls.py @@ -1,119 +1,21 @@ -# This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # - -import struct import logging -from typing import List, Optional - -from volatility3.framework import interfaces, exceptions -from volatility3.framework.configuration import requirements -from volatility3.plugins import yarascan -from volatility3.plugins.windows import direct_system_calls +from volatility3.framework import deprecation +from volatility3.plugins.windows.malware import indirect_system_calls +from volatility3.plugins.windows.malware import direct_system_calls vollog = logging.getLogger(__name__) -class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): +class IndirectSystemCalls( + direct_system_calls.DirectSystemCalls, + deprecation.PluginRenameClass, + replacement_class=indirect_system_calls.IndirectSystemCalls, + removal_date="2026-06-07", +): + """Detects the Indirect System Call technique used to bypass EDRs (deprecated).""" + _required_framework_version = (2, 4, 0) _version = (1, 0, 0) - - def __init__(self, *args, **kwargs): - super().__init__(*args, **kwargs) - - self.syscall_finder = direct_system_calls.syscall_finder_type( - # gets the target address of a indirect jmp - self._indirect_syscall_block_target, - # we are looking for indirect system calls, so we don't want 'syscall' instructions in our code block - False, - # jmp [address]; ret - "/\\xff\\x25[^\\xc3]{,24}\\xc3/", - # any of these mean we aren't in a malicious indirect call - ["call", "leave", "int3", "ret"], - # stop at jmp, this should reference the system call instruction - ["jmp"], - ) - - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - # create a list of requirements for vadyarascan - vadyarascan_requirements = [ - requirements.ModuleRequirement( - name="kernel", - description="Windows kernel", - architectures=["Intel32", "Intel64"], - ), - requirements.VersionRequirement( - name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) - ), - requirements.VersionRequirement( - name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) - ), - requirements.VersionRequirement( - name="direct_system_calls", - component=direct_system_calls.DirectSystemCalls, - version=(2, 0, 0), - ), - ] - - # get base yarascan requirements for command line options - yarascan_requirements = yarascan.YaraScan.get_yarascan_option_requirements() - - # return the combined requirements - return yarascan_requirements + vadyarascan_requirements - - @staticmethod - def _indirect_syscall_block_target( - proc_layer: interfaces.layers.DataLayerInterface, inst - ) -> Optional[int]: - """ - This function determines the address of a jmp in the following form: - - jmp [address] - - To determine this, we must: - 1) Pull the 4 byte relative offset of 'address' inside the instruction - 2) Compute the full address of this relative offset - 3) Read from the address as it is being dereferenced - 4) Ensure the target address points to a 'syscall' instruction - - Args: - proc_layer: the layer of the potential syscall block - inst: the terminating instruction of the syscall block check - Returns: - The target address of the jump if it can be computed - """ - - try: - jmp_address_str = proc_layer.read(inst.address, 6) - except exceptions.InvalidAddressException: - return None - - # Should be an jmp... - if jmp_address_str[0:2] != b"\xff\x25": - return None - - # get the address of the 'jmp [address]' instruction - relative_offset = struct.unpack(" List[interfaces.configuration.RequirementInterface]: + # create a list of requirements for vadyarascan + vadyarascan_requirements = [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) + ), + requirements.VersionRequirement( + name="yarascan", component=yarascan.YaraScan, version=(2, 0, 0) + ), + requirements.VersionRequirement( + name="direct_system_calls", + component=direct_system_calls.DirectSystemCalls, + version=(2, 0, 0), + ), + ] + + # get base yarascan requirements for command line options + yarascan_requirements = yarascan.YaraScan.get_yarascan_option_requirements() + + # return the combined requirements + return yarascan_requirements + vadyarascan_requirements + + @staticmethod + def _indirect_syscall_block_target( + proc_layer: interfaces.layers.DataLayerInterface, inst + ) -> Optional[int]: + """ + This function determines the address of a jmp in the following form: + + jmp [address] + + To determine this, we must: + 1) Pull the 4 byte relative offset of 'address' inside the instruction + 2) Compute the full address of this relative offset + 3) Read from the address as it is being dereferenced + 4) Ensure the target address points to a 'syscall' instruction + + Args: + proc_layer: the layer of the potential syscall block + inst: the terminating instruction of the syscall block check + Returns: + The target address of the jump if it can be computed + """ + + try: + jmp_address_str = proc_layer.read(inst.address, 6) + except exceptions.InvalidAddressException: + return None + + # Should be an jmp... + if jmp_address_str[0:2] != b"\xff\x25": + return None + + # get the address of the 'jmp [address]' instruction + relative_offset = struct.unpack(" Date: Sat, 14 Jun 2025 23:15:01 +0300 Subject: [PATCH 1176/1352] black --- .../framework/plugins/windows/malware/indirect_system_calls.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/windows/malware/indirect_system_calls.py b/volatility3/framework/plugins/windows/malware/indirect_system_calls.py index cb4565086..ba34eb110 100644 --- a/volatility3/framework/plugins/windows/malware/indirect_system_calls.py +++ b/volatility3/framework/plugins/windows/malware/indirect_system_calls.py @@ -16,6 +16,7 @@ vollog = logging.getLogger(__name__) class IndirectSystemCalls(direct_system_calls.DirectSystemCalls): """Detects the Indirect System Call technique used to bypass EDRs.""" + _required_framework_version = (2, 4, 0) _version = (1, 0, 0) From aa4ef88b51a72324ffad0976064ee0c1f6941195 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 14 Jun 2025 23:17:04 +0300 Subject: [PATCH 1177/1352] fix: black lint --- volatility3/framework/plugins/windows/direct_system_calls.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/direct_system_calls.py b/volatility3/framework/plugins/windows/direct_system_calls.py index 9616696d8..79d02fe67 100644 --- a/volatility3/framework/plugins/windows/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/direct_system_calls.py @@ -23,6 +23,7 @@ syscall_finder_type = namedtuple( ], ) + class DirectSystemCalls( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, @@ -59,4 +60,4 @@ class DirectSystemCalls( ["jmp", "call", "leave", "int3"], # the expected form is to end with a "ret" back to the calling code ["ret"], - ) \ No newline at end of file + ) From 7e77ee0e24cf5d95845a4f3db6a8c6854a9f6a36 Mon Sep 17 00:00:00 2001 From: tvanegro Date: Tue, 17 Jun 2025 10:24:04 +0200 Subject: [PATCH 1178/1352] Adding dump dirty page feature --- .../plugins/linux/malware/malfind.py | 22 ++++++++++++-- .../symbols/linux/extensions/__init__.py | 29 ++++++++++++++++++- 2 files changed, 48 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index c7e141c02..a8104fbaa 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -37,6 +37,16 @@ class Malfind(interfaces.plugins.PluginInterface): element_type=int, optional=True, ), + requirements.IntRequirement( + name="dumpsize", + description="Dump X bytes of each malicious region found", + optional=True, + ), + requirements.BooleanRequirement( + name="dumppage", + description="Dump dirty page content (for each dirty page)", + optional=True, + ), ] def _list_injections( @@ -50,6 +60,8 @@ class Malfind(interfaces.plugins.PluginInterface): return None proc_layer = self.context.layers[proc_layer_name] + dumpsize = self.config.get("dumpsize") if self.config.get("dumpsize") is not None else 64 + dumppage = self.config.get("dumppage") or False for vma in task.mm.get_vma_iter(): vma_name = vma.get_name(self.context, task) @@ -57,8 +69,14 @@ class Malfind(interfaces.plugins.PluginInterface): f"Injections : processing PID {task.pid} : VMA {vma_name} : {hex(vma.vm_start)}-{hex(vma.vm_end)}" ) if vma.is_suspicious(proc_layer) and vma_name != "[vdso]": - data = proc_layer.read(vma.vm_start, 64, pad=True) - yield vma, vma_name, data + malicious_pages = vma.get_malicious_pages(proc_layer) + if dumppage: + for page_addr in malicious_pages: + data = proc_layer.read(page_addr, dumpsize, pad=True) + yield vma, vma_name+f", page address: {page_addr:#x}, offset: {page_addr-vma.vm_start:#x}", data + else: + data = proc_layer.read(vma.vm_start,dumpsize,pad=True) + yield vma, vma_name, data def _generator(self, tasks): # determine if we're on a 32 or 64 bit kernel diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 3b9a73e7c..27cb44989 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1273,6 +1273,32 @@ class vm_area_struct(objects.StructType): except exceptions.InvalidAddressException: return None + def get_malicious_pages(self,proclayer=None): + malicious_pages = [] + + flags_str = self.get_protection() + + if flags_str == "rwx": + ret = True + elif flags_str == "r-x" and self.vm_file.dereference().vol.offset == 0: + ret = True + elif proclayer and "x" in flags_str: + for i in range(self.vm_start, self.vm_end, proclayer.page_size): + try: + if proclayer.is_dirty(i): + vollog.debug( + f"Found malicious (dirty+exec) page at {hex(i)} !" + ) + malicious_pages.append(i) + except ( + exceptions.PagedInvalidAddressException, + exceptions.InvalidAddressException, + ) as excp: + vollog.debug(f"Unable to translate address {hex(i)} : {excp}") + # Abort as it is likely that other addresses in the same range will also fail + break + return malicious_pages + # used by malfind def is_suspicious(self, proclayer=None): ret = False @@ -1288,7 +1314,7 @@ class vm_area_struct(objects.StructType): try: if proclayer.is_dirty(i): vollog.warning( - f"Found malicious (dirty+exec) page at {hex(i)} !" + f"Found malicious page(s) inside (dirty+exec) region {hex(self.vm_start)} !" ) # We do not attempt to find other dirty+exec pages once we have found one ret = True @@ -2733,6 +2759,7 @@ class page(objects.StructType): for name, value in self.pageflags_enum.items(): if self.flags & (1 << value) != 0: flags.append(name) + print(name,value) return flags From 96fe242c9d0cbe35e0c653c18c2700e4bed441d2 Mon Sep 17 00:00:00 2001 From: tvanegro Date: Tue, 17 Jun 2025 11:00:18 +0200 Subject: [PATCH 1179/1352] Minor cleanup + comments --- .../plugins/linux/malware/malfind.py | 33 +++++++++++++------ .../symbols/linux/extensions/__init__.py | 12 +++---- 2 files changed, 28 insertions(+), 17 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index a8104fbaa..39d885f68 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -38,13 +38,13 @@ class Malfind(interfaces.plugins.PluginInterface): optional=True, ), requirements.IntRequirement( - name="dumpsize", - description="Dump X bytes of each malicious region found", + name="dump_size", + description="Amount of bytes to dump for each dirty region/page found - Default 64 bytes", optional=True, ), requirements.BooleanRequirement( - name="dumppage", - description="Dump dirty page content (for each dirty page)", + name="dump_page", + description="Dump each dirty page and content - Default off", optional=True, ), ] @@ -60,22 +60,35 @@ class Malfind(interfaces.plugins.PluginInterface): return None proc_layer = self.context.layers[proc_layer_name] - dumpsize = self.config.get("dumpsize") if self.config.get("dumpsize") is not None else 64 - dumppage = self.config.get("dumppage") or False + + # Allowing a dump_size of 0 (no dump) + dump_size = self.config.get("dump_size") if self.config.get("dump_size") is not None else 64 + + # Dumping page defaults to off, as in case a whole r-xp region is dirty + # this would likely dump 1000's of pages which might not always be wise nor necessary + + dump_page = self.config.get("dump_page") or False for vma in task.mm.get_vma_iter(): vma_name = vma.get_name(self.context, task) vollog.debug( f"Injections : processing PID {task.pid} : VMA {vma_name} : {hex(vma.vm_start)}-{hex(vma.vm_end)}" ) + + # If is_suspicious returns true, this means at least one page + # in the region is dirty. If dump_page is true, then we dump + # all dirty pages + if vma.is_suspicious(proc_layer) and vma_name != "[vdso]": malicious_pages = vma.get_malicious_pages(proc_layer) - if dumppage: + if dump_page: + # Dumping each dirty page for page_addr in malicious_pages: - data = proc_layer.read(page_addr, dumpsize, pad=True) - yield vma, vma_name+f", page address: {page_addr:#x}, offset: {page_addr-vma.vm_start:#x}", data + data = proc_layer.read(page_addr, dump_size, pad=True) + yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {page_addr-vma.vm_start:#x}", data else: - data = proc_layer.read(vma.vm_start,dumpsize,pad=True) + # Original behaviour - Dump the start of the region (not necessarily matching the dirty page) + data = proc_layer.read(vma.vm_start,dump_size,pad=True) yield vma, vma_name, data def _generator(self, tasks): diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 27cb44989..236d28bb1 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1274,19 +1274,17 @@ class vm_area_struct(objects.StructType): return None def get_malicious_pages(self,proclayer=None): + """ + This function will return a list of all malicious pages inside a given dirty region + """ malicious_pages = [] - flags_str = self.get_protection() - if flags_str == "rwx": - ret = True - elif flags_str == "r-x" and self.vm_file.dereference().vol.offset == 0: - ret = True - elif proclayer and "x" in flags_str: + if proclayer and "r-x" in flags_str and self.vm_file.dereference().vol.offset !=0: for i in range(self.vm_start, self.vm_end, proclayer.page_size): try: if proclayer.is_dirty(i): - vollog.debug( + vollog.warning( f"Found malicious (dirty+exec) page at {hex(i)} !" ) malicious_pages.append(i) From ba9e13698d470e6c3502b12fec45f02dfc0e133f Mon Sep 17 00:00:00 2001 From: tvanegro Date: Tue, 17 Jun 2025 11:33:44 +0200 Subject: [PATCH 1180/1352] Minor changes 2 --- volatility3/framework/plugins/linux/malware/malfind.py | 8 ++++---- .../framework/symbols/linux/extensions/__init__.py | 3 +-- 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 39d885f68..577c6c1e8 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -38,12 +38,12 @@ class Malfind(interfaces.plugins.PluginInterface): optional=True, ), requirements.IntRequirement( - name="dump_size", + name="dump-size", description="Amount of bytes to dump for each dirty region/page found - Default 64 bytes", optional=True, ), requirements.BooleanRequirement( - name="dump_page", + name="dump-page", description="Dump each dirty page and content - Default off", optional=True, ), @@ -62,12 +62,12 @@ class Malfind(interfaces.plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] # Allowing a dump_size of 0 (no dump) - dump_size = self.config.get("dump_size") if self.config.get("dump_size") is not None else 64 + dump_size = self.config.get("dump-size") if self.config.get("dump-size") is not None else 64 # Dumping page defaults to off, as in case a whole r-xp region is dirty # this would likely dump 1000's of pages which might not always be wise nor necessary - dump_page = self.config.get("dump_page") or False + dump_page = self.config.get("dump-page") or False for vma in task.mm.get_vma_iter(): vma_name = vma.get_name(self.context, task) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 236d28bb1..94dfb0576 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1284,7 +1284,7 @@ class vm_area_struct(objects.StructType): for i in range(self.vm_start, self.vm_end, proclayer.page_size): try: if proclayer.is_dirty(i): - vollog.warning( + vollog.debug( f"Found malicious (dirty+exec) page at {hex(i)} !" ) malicious_pages.append(i) @@ -2757,7 +2757,6 @@ class page(objects.StructType): for name, value in self.pageflags_enum.items(): if self.flags & (1 << value) != 0: flags.append(name) - print(name,value) return flags From 53b3bd7d47ca855a770be8be0119a6a86439a49b Mon Sep 17 00:00:00 2001 From: tvanegro Date: Tue, 17 Jun 2025 12:51:59 +0200 Subject: [PATCH 1181/1352] black --- .../framework/plugins/linux/malware/malfind.py | 8 ++++++-- .../framework/symbols/linux/extensions/__init__.py | 12 +++++++----- 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 577c6c1e8..4aaaf9bf8 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -62,7 +62,11 @@ class Malfind(interfaces.plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] # Allowing a dump_size of 0 (no dump) - dump_size = self.config.get("dump-size") if self.config.get("dump-size") is not None else 64 + dump_size = ( + self.config.get("dump-size") + if self.config.get("dump-size") is not None + else 64 + ) # Dumping page defaults to off, as in case a whole r-xp region is dirty # this would likely dump 1000's of pages which might not always be wise nor necessary @@ -88,7 +92,7 @@ class Malfind(interfaces.plugins.PluginInterface): yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {page_addr-vma.vm_start:#x}", data else: # Original behaviour - Dump the start of the region (not necessarily matching the dirty page) - data = proc_layer.read(vma.vm_start,dump_size,pad=True) + data = proc_layer.read(vma.vm_start, dump_size, pad=True) yield vma, vma_name, data def _generator(self, tasks): diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 94dfb0576..99b2c989c 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1273,20 +1273,22 @@ class vm_area_struct(objects.StructType): except exceptions.InvalidAddressException: return None - def get_malicious_pages(self,proclayer=None): + def get_malicious_pages(self, proclayer=None): """ This function will return a list of all malicious pages inside a given dirty region """ malicious_pages = [] flags_str = self.get_protection() - if proclayer and "r-x" in flags_str and self.vm_file.dereference().vol.offset !=0: + if ( + proclayer + and "r-x" in flags_str + and self.vm_file.dereference().vol.offset != 0 + ): for i in range(self.vm_start, self.vm_end, proclayer.page_size): try: if proclayer.is_dirty(i): - vollog.debug( - f"Found malicious (dirty+exec) page at {hex(i)} !" - ) + vollog.debug(f"Found malicious (dirty+exec) page at {hex(i)} !") malicious_pages.append(i) except ( exceptions.PagedInvalidAddressException, From e13b8f9bd0633496dda13df1446fcafa6c9207e7 Mon Sep 17 00:00:00 2001 From: tvanegro Date: Tue, 17 Jun 2025 16:12:22 +0200 Subject: [PATCH 1182/1352] Fixing memory wrong memory offset in hex dump --- .../framework/plugins/linux/malware/malfind.py | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 4aaaf9bf8..98e9c4695 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -85,15 +85,17 @@ class Malfind(interfaces.plugins.PluginInterface): if vma.is_suspicious(proc_layer) and vma_name != "[vdso]": malicious_pages = vma.get_malicious_pages(proc_layer) + offset = 0 if dump_page: # Dumping each dirty page for page_addr in malicious_pages: + offset = page_addr - vma.vm_start data = proc_layer.read(page_addr, dump_size, pad=True) - yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {page_addr-vma.vm_start:#x}", data + yield vma, f"{vma_name}, page address: {page_addr:#x}, offset: {offset:#x}", data, offset else: # Original behaviour - Dump the start of the region (not necessarily matching the dirty page) data = proc_layer.read(vma.vm_start, dump_size, pad=True) - yield vma, vma_name, data + yield vma, vma_name, data, offset def _generator(self, tasks): # determine if we're on a 32 or 64 bit kernel @@ -105,13 +107,15 @@ class Malfind(interfaces.plugins.PluginInterface): for task in tasks: process_name = utility.array_to_string(task.comm) - for vma, vma_name, data in self._list_injections(task): + for vma, vma_name, data, offset in self._list_injections(task): if is_32bit_arch: architecture = "intel" else: architecture = "intel64" - disasm = renderers.Disassembly(data, vma.vm_start, architecture) + disasm = renderers.Disassembly( + data, vma.vm_start + offset, architecture + ) yield ( 0, From 253b274cfbe88fe12b0dc742fa6adfce73f8de84 Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 15:35:51 +0900 Subject: [PATCH 1183/1352] linux-tutorial: update symbol table section - Removed outdated reference to the Linux ISF Server (service no longer available) - Updated symbol table instructions to reflect current volatility3 behavior (symbol files now auto-detected from volatility3/symbols directory) --- doc/source/getting-started-linux-tutorial.rst | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 33f82911a..eb4ab7562 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -14,14 +14,11 @@ Volatility3 does not provide the ability to acquire memory. Below are some exam Be aware that LiME raw format is not supported by volatility3, the padded or lime option should be used instead. `This issue contains further information `_. Procedure to create symbol tables for linux --------------------------------------------- +------------------------------------------- -To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol tables`. - -.. tip:: It may be possible to locate pre-made ISF files from the `Linux ISF Server `_ , - which is built and maintained by `kevthehermit `_. - After creating the file or downloading it from the ISF server, place the file under the directory ``volatility3/symbols/linux``. - If necessary create a linux directory under the symbols directory (this will become unnecessary in future versions). +To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol tables`. +After creating the file, place it under the directory ``volatility3/symbols``. +Volatility3 will automatically detect and use symbol tables from this location. Listing plugins From 46609d418a7d25a1632c130f04e6b490a5217d68 Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 15:42:35 +0900 Subject: [PATCH 1184/1352] linux-tutorial: revise plugin listing section - Replaced outdated and partial plugin list with a concise summary - Mentioned total number of supported Linux plugins (~40+) - Highlighted representative plugins such as pslist, bash, lsmod, etc. - Provided updated command to enumerate all available Linux plugins --- doc/source/getting-started-linux-tutorial.rst | 25 +++++++++++-------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index eb4ab7562..53f44fc4f 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -24,20 +24,25 @@ Volatility3 will automatically detect and use symbol tables from this location. Listing plugins --------------- -The following is a sample of the linux plugins available for volatility3, it is not complete and more plugins may -be added. For a complete reference, please see the volatility 3 :doc:`list of plugins `. -For plugin requests, please create an issue with a description of the requested plugin. +Volatility3 currently supports over 40 Linux-specific plugins covering a wide range of forensic analysis needs, such as process enumeration, memory-mapped file inspection, loaded modules, and kernel tracing features. + +Some representative plugins include: + +- ``linux.pslist``: Lists running processes with their PIDs and PPIDs. +- ``linux.bash``: Recovers bash command history from memory. +- ``linux.lsmod``: Displays loaded kernel modules. +- ``linux.kmsg``: Reads messages from the kernel log buffer. +- ``linux.elfs``: Lists all memory-mapped ELF files. +- ``linux.check_creds``: Checks for suspicious credential structures. +- ``linux.vmayarascan``: Scans process memory using YARA signatures. + +For a full list of supported plugins, run the following command: .. code-block:: shell-session - $ python3 vol.py --help | grep -i linux. | head -n 5 - banners.Banners Attempts to identify potential linux banners in an - linux.bash.Bash Recovers bash command history from memory. - linux.malware.check_afinfo.Check_afinfo - linux.malware.check_creds.Check_creds - linux.malware.check_idt.Check_idt + $ python3 vol.py --help | grep -i linux. -.. note:: Here the command is piped to grep and head to provide the start of the list of linux plugins. +.. note:: You can also filter and inspect available plugins using more sophisticated patterns or tools like ``grep``, ``awk``, or simply explore the source under ``volatility3/framework/plugins/linux``. Using plugins From 25e15f12fad6d27597a8f5f8a6686426c0a68557 Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 15:52:08 +0900 Subject: [PATCH 1185/1352] linux-tutorial: update banners section - Removed outdated instructions referencing the ISF server - Updated guidance to reflect current method of manually generating ISF files - Clarified placement of ISF files under volatility3/symbols for automatic detection --- doc/source/getting-started-linux-tutorial.rst | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 53f44fc4f..05571ad07 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -69,7 +69,7 @@ Thanks go to `stuxnet `_ for providing this memo $ python3 vol.py -f memory.vmem banners - Volatility 3 Framework 2.0.1 + Volatility 3 Framework 2.26.0 Progress: 100.00 PDB scanning finished Offset Banner @@ -81,10 +81,11 @@ Thanks go to `stuxnet `_ for providing this memo 0x7fde0010 Linux version 4.15.0-72-generic (buildd@lcy01-amd64-026) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) #81-Ubuntu SMP Tue Nov 26 12:20:02 UTC 2019 (Ubuntu 4.15.0-72.81-generic 4.15.18) -The above command helps us to find the memory dump's kernel version and the distribution version. Now using the above banner we can search for the needed ISF file from the ISF server. -If an ISF file cannot be found then, follow the instructions on :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux`. After that, place the ISF file under the ``volatility3/symbols/linux`` directory. +The above command helps us identify the kernel version and distribution from the memory dump. +Using this information, follow the instructions in :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux` to generate the required ISF file. +Once created, place the file under the ``volatility3/symbols`` directory so that Volatility3 can recognize it automatically. + -.. tip:: Use the banner text which is most repeated to search on the ISF Server. linux.pslist ~~~~~~~~~~~~ From e8f36325ecdcbb7b8a1ee4df833fb5089c3477e5 Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 15:59:27 +0900 Subject: [PATCH 1186/1352] linux-tutorial: add boottime plugin example - Added new section for linux.boottime plugin - Demonstrated how to extract system boot time from memory - Explained its relevance for timeline analysis and incident response --- doc/source/getting-started-linux-tutorial.rst | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 05571ad07..147293195 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -85,6 +85,23 @@ The above command helps us identify the kernel version and distribution from the Using this information, follow the instructions in :ref:`getting-started-linux-tutorial:Procedure to create symbol tables for linux` to generate the required ISF file. Once created, place the file under the ``volatility3/symbols`` directory so that Volatility3 can recognize it automatically. +linux.boottime +~~~~~~~~~~~~~~ + +This plugin provides the system boot time extracted from memory. +It is useful for establishing a timeline, particularly when analyzing incident response scenarios or determining system uptime. + +.. code-block:: shell-session + + $ python3 vol.py -f memory.vmem linux.boottime + + Volatility 3 Framework 2.26.0 + Progress: 100.00 Stacking attempts finished + TIME NS Boot Time + + - 2022-02-10 06:50:16.450008 UTC + +This timestamp can serve as a reference point for correlating system events, such as process start times, logs, or malicious activity. linux.pslist From 5531d76bfc460b4719c9f0a9fa5922875e9f1665 Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 16:06:00 +0900 Subject: [PATCH 1187/1352] linux-tutorial: update pslist and pstree sections - Updated linux.pslist output to include new fields: OFFSET, UID/GID, creation time, and file output - Added detailed explanation of each column and its forensic significance - Revised linux.pstree section to reflect new output format including OFFSET and hierarchical indentation - Emphasized the utility of both plugins for process analysis and anomaly detection --- doc/source/getting-started-linux-tutorial.rst | 83 +++++++------------ 1 file changed, 29 insertions(+), 54 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 147293195..f43c26b66 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -97,6 +97,7 @@ It is useful for establishing a timeline, particularly when analyzing incident r Volatility 3 Framework 2.26.0 Progress: 100.00 Stacking attempts finished + TIME NS Boot Time - 2022-02-10 06:50:16.450008 UTC @@ -107,77 +108,51 @@ This timestamp can serve as a reference point for correlating system events, suc linux.pslist ~~~~~~~~~~~~ +This plugin lists active processes by walking the task list from memory. +It provides detailed metadata for each process, including identifiers and user/group information. + .. code-block:: shell-session $ python3 vol.py -f memory.vmem linux.pslist - Volatility 3 Framework 2.0.1 Stacking attempts finished + Volatility 3 Framework 2.26.0 + Progress: 100.00 Stacking attempts finished + OFFSET (V) PID TID PPID COMM UID GID EUID EGID CREATION TIME File output - PID PPID COMM + 0x8ca6db1aac80 1 1 0 systemd 0 0 0 0 2022-02-10 06:50:16.364213 UTC Disabled + 0x8ca6db1a9640 2 2 0 kthreadd 0 0 0 0 2022-02-10 06:50:16.364213 UTC Disabled + 0x8ca6db1ac2c0 3 3 2 rcu_gp 0 0 0 0 2022-02-10 06:50:16.372213 UTC Disabled + ... - 1 0 systemd - 2 0 kthreadd - 3 2 kworker/0:0 - 4 2 kworker/0:0H - 5 2 kworker/u256:0 - 6 2 mm_percpu_wq - 7 2 ksoftirqd/0 - 8 2 rcu_sched - 9 2 rcu_bh - 10 2 migration/0 - 11 2 watchdog/0 - 12 2 cpuhp/0 - 13 2 kdevtmpfs - 14 2 netns - 15 2 rcu_tasks_kthre - 16 2 kauditd - ..... +This detailed view allows investigators to correlate user privileges, startup times, and relationships between processes more precisely than before. -``linux.pslist`` helps us to list the processes which are running, their PIDs and PPIDs. linux.pstree ~~~~~~~~~~~~ +This plugin presents the process hierarchy as a tree, clearly showing parent-child relationships between processes. +It is especially useful for identifying unusual or suspicious process structures, such as orphaned child processes, injected children under legitimate parents, or long chains of shell execution. + .. code-block:: shell-session $ python3 vol.py -f memory.vmem linux.pstree - Volatility 3 Framework 2.0.1 + + Volatility 3 Framework 2.26.0 Progress: 100.00 Stacking attempts finished - PID PPID COMM + OFFSET (V) PID TID PPID COMM - 1 0 systemd - * 636 1 polkitd - * 514 1 acpid - * 1411 1 pulseaudio - * 517 1 rsyslogd - * 637 1 cups-browsed - * 903 1 whoopsie - * 522 1 ModemManager - * 525 1 cron - * 526 1 avahi-daemon - ** 542 526 avahi-daemon - * 657 1 unattended-upgr - * 914 1 kerneloops - * 532 1 dbus-daemon - * 1429 1 ibus-x11 - * 929 1 kerneloops - * 1572 1 gsd-printer - * 933 1 upowerd - * 1071 1 rtkit-daemon - * 692 1 gdm3 - ** 1234 692 gdm-session-wor - *** 1255 1234 gdm-x-session - **** 1257 1255 Xorg - **** 1266 1255 gnome-session-b - ***** 1537 1266 gsd-clipboard - ***** 1539 1266 gsd-color - ***** 1542 1266 gsd-datetime - ***** 2950 1266 deja-dup-monito - ***** 1546 1266 gsd-housekeepin - ***** 1548 1266 gsd-keyboard - ***** 1550 1266 gsd-media-keys + 0x8ca6db1aac80 1 1 0 systemd + * 0x8ca6db3342c0 278 278 1 systemd-journal + * 0x8ca6d005ac80 315 315 1 systemd-udevd + * 0x8ca6d0eac2c0 478 478 1 systemd-resolve + * ... + *** 0x8ca67108c2c0 1507 1507 1438 gdm-x-session + **** 0x8ca671215900 1527 1527 1507 Xorg + **** 0x8ca671210000 1608 1608 1507 gnome-session-b + ***** 0x8ca66fba42c0 1765 1765 1608 ssh-agent + +The tree view can help identify anomalies in process launch sequences or privilege escalations by inspecting unexpected parent-child relationships. -``linux.pstree`` helps us to display the parent-child relationships between processes. linux.bash ~~~~~~~~~~ From 8ea6422420b92d70666dffc80d8cd35116b6160e Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 16:15:46 +0900 Subject: [PATCH 1188/1352] linux-tutorial: add network plugin examples under Using plugins - Added linux.ip.Addr and linux.ip.Link examples to the Using plugins section - Highlighted the importance of network configuration in memory forensics - Explained key fields such as interface state, MAC, IP, namespace, and flags - Structured the content consistently alongside other plugin examples (pslist, bash, etc.) --- doc/source/getting-started-linux-tutorial.rst | 44 ++++++++++++++----- 1 file changed, 32 insertions(+), 12 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index f43c26b66..c91340902 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -163,7 +163,7 @@ Now to find the commands that were run in the bash shell by using ``linux.bash`` $ python3 vol.py -f memory.vmem linux.bash - Volatility 3 Framework 2.0.1 + Volatility 3 Framework 2.26.0 Progress: 100.00 Stacking attempts finished PID Process CommandTime Command @@ -172,17 +172,37 @@ Now to find the commands that were run in the bash shell by using ``linux.bash`` 1733 bash 2020-01-16 14:00:36.000000 sudo apt upgrade 1733 bash 2020-01-16 14:00:36.000000 sudo apt upgrade 1733 bash 2020-01-16 14:00:36.000000 sudo reboot - 1733 bash 2020-01-16 14:00:36.000000 sudo apt update - 1733 bash 2020-01-16 14:00:36.000000 sudo apt update - 1733 bash 2020-01-16 14:00:36.000000 sudo reboot - 1733 bash 2020-01-16 14:00:36.000000 sudo apt upgrade - 1733 bash 2020-01-16 14:00:36.000000 sudo apt update - 1733 bash 2020-01-16 14:00:36.000000 rub - 1733 bash 2020-01-16 14:00:36.000000 sudo apt upgrade 1733 bash 2020-01-16 14:00:36.000000 uname -a - 1733 bash 2020-01-16 14:00:36.000000 uname -a - 1733 bash 2020-01-16 14:00:36.000000 sudo apt autoclean - 1733 bash 2020-01-16 14:00:36.000000 sudo reboot - 1733 bash 2020-01-16 14:00:36.000000 sudo apt upgrade 1733 bash 2020-01-16 14:00:41.000000 chmod +x meterpreter 1733 bash 2020-01-16 14:00:42.000000 sudo ./meterpreter + + +linux.ip.Addr and linux.ip.Link +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Network configuration is an essential aspect of memory forensics. +Analyzing the network interfaces and their IP assignments can reveal active connections, misconfigured settings, or even artifacts of malicious activity. + +Volatility3 provides the following two plugins to examine this information: + +**linux.ip.Addr** displays IP-related metadata for each interface, including IPv4/IPv6 addresses, MAC, scope, and interface status. + +.. code-block:: shell-session + + $ python3 vol.py -f memory.vmem linux.ip.Addr + + NetNS Index Interface MAC Promiscuous IP Prefix Scope Type State + 4026531992 2 enp0s3 08:00:27:8a:4d:eb False 10.0.2.15 24 global UP + ... + +**linux.ip.Link** shows lower-level link information such as MTU, Qdisc, and interface flags. + +.. code-block:: shell-session + + $ python3 vol.py -f memory.vmem linux.ip.Link + + NS Interface MAC State MTU Qdisc Qlen Flags + 4026531992 enp0s3 08:00:27:8a:4d:eb UP 1500 fq_codel 1000 BROADCAST,LOWER_UP,MULTICAST,UP + +Together, these plugins help investigators assess the system’s network exposure and identify anomalies such as multiple network namespaces, unexpected IP addresses, or active interfaces in promiscuous mode. + From ce6c43f1f44f105db21fd581c03f3f5835a7b475 Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 16:20:57 +0900 Subject: [PATCH 1189/1352] linux-tutorial: add malfind plugin section - Added new section for linux.malfind plugin under Using plugins - Included example output showing detection of suspicious executable memory regions - Explained how to interpret fields such as anonymous mapping, rwx protection, and disassembly - Highlighted analysis tips for identifying potential code injection or fileless malware --- doc/source/getting-started-linux-tutorial.rst | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index c91340902..c474a8291 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -206,3 +206,44 @@ Volatility3 provides the following two plugins to examine this information: Together, these plugins help investigators assess the system’s network exposure and identify anomalies such as multiple network namespaces, unexpected IP addresses, or active interfaces in promiscuous mode. +linux.malfind +~~~~~~~~~~~~~ + +This plugin scans process memory for suspicious executable regions that may indicate code injection or malicious payloads. +It is particularly useful for detecting fileless malware, injected shellcode, or unpacked runtime payloads that do not correspond to legitimate binary files on disk. + +.. code-block:: shell-session + + $ python3 vol.py -f memory.vmem linux.malfind + + Volatility 3 Framework 2.26.0 + Progress: 100.00 Stacking attempts finished + PID Process Start End Path Protection Hexdump Disasm + + 540 networkd-dispat 0x7f1506482000 0x7f1506483000 Anonymous Mapping rwx + 00 00 00 00 00 00 00 00 43 00 00 00 00 00 00 00 ........C....... + 4c 8d 15 f9 ff ff ff ff 25 03 00 00 00 0f 1f 00 L.......%....... + ... + 0x7f1506482000: add byte ptr [rax], al + 0x7f1506482002: add byte ptr [rax], al + ... + 0x7f1506482013: stc + +In this output: + +- **PID / Process**: Identifies the target process (in this case, `networkd-dispat`, PID 540) +- **Start / End**: The memory address range of the suspicious region +- **Path**: Indicates that the region is an anonymous memory mapping (i.e., not backed by a file) +- **Protection**: The region is marked `rwx` (read-write-execute), which is uncommon for legitimate memory regions +- **Disasm**: Shows the disassembled machine code found in that memory region + +**Key indicators to focus on:** + +- **Anonymous Mapping + rwx**: Memory that is not backed by a file and has execute permissions is often used for injected code +- **Disassembly patterns**: Repetitive `add` instructions, `nop`, or unusual instruction sequences can be artifacts of shellcode, packer stubs, or JIT-compiled code +- **Process context**: The suspicious memory is found in `networkd-dispat`, a system service — if this service is not expected to have dynamic executable memory regions, it may be compromised + +Use this plugin early in an investigation to flag processes for deeper inspection. + + + From 5ce5fe67dc93112d76b18e1fe12118b8d8137fd8 Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 16:24:22 +0900 Subject: [PATCH 1190/1352] linux-tutorial: finalize with plugin discovery and contribution guide - Added concluding section to guide users toward further plugin exploration - Provided command to list all supported Linux plugins in Volatility 3 - Encouraged community contribution by highlighting the open-source nature of the project - Linked to the official Volatility 3 GitHub repository for contributor reference --- doc/source/getting-started-linux-tutorial.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index c474a8291..c7917b4db 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -245,5 +245,11 @@ In this output: Use this plugin early in an investigation to flag processes for deeper inspection. +Further Exploration and Contribution +------------------------------------ +This guide has introduced several key Linux plugins available in Volatility 3 for memory forensics. +However, many more plugins are available, covering topics such as kernel modules, page cache analysis, tracing frameworks, and malware detection. +If you identify gaps in plugin functionality or wish to extend support for a specific analysis use case, you are encouraged to contribute new plugins or enhancements. +Your insights can help shape the future of Linux memory forensics. From 17a7fff9268f80cebcd33b6f9dfa669f6cd45458 Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 16:30:28 +0900 Subject: [PATCH 1191/1352] Change link Change link --- doc/source/getting-started-linux-tutorial.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index c7917b4db..28726d0ec 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -62,7 +62,7 @@ banners ~~~~~~~ In this example we will be using a memory dump from the Insomni'hack teaser 2020 CTF Challenge called Getdents. We will limit the discussion to memory forensics with volatility 3 and not extend it to other parts of the challenge. -Thanks go to `stuxnet `_ for providing this memory dump and `writeup `_. +Thanks go to `stuxnet `_ for providing this memory dump and writeup `_. .. code-block:: shell-session From 9df53004830684dadfb38e505ead8a34eac07b1e Mon Sep 17 00:00:00 2001 From: cpuu Date: Wed, 18 Jun 2025 16:32:14 +0900 Subject: [PATCH 1192/1352] Edit link link --- doc/source/getting-started-linux-tutorial.rst | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 28726d0ec..250a34c88 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -62,7 +62,7 @@ banners ~~~~~~~ In this example we will be using a memory dump from the Insomni'hack teaser 2020 CTF Challenge called Getdents. We will limit the discussion to memory forensics with volatility 3 and not extend it to other parts of the challenge. -Thanks go to `stuxnet `_ for providing this memory dump and writeup `_. +Thanks go to `stuxnet `_ for providing this memory dump and `writeup `_. .. code-block:: shell-session @@ -253,3 +253,4 @@ However, many more plugins are available, covering topics such as kernel modules If you identify gaps in plugin functionality or wish to extend support for a specific analysis use case, you are encouraged to contribute new plugins or enhancements. Your insights can help shape the future of Linux memory forensics. + From d9a6ff803b583c1dfa49532929ac87cd98cd91c9 Mon Sep 17 00:00:00 2001 From: Jaeyou PARK Date: Mon, 23 Jun 2025 14:53:12 +0900 Subject: [PATCH 1193/1352] Update getting-started-linux-tutorial.rst Update memory acquisition section: remove deprecated LiME reference LiME has been removed from the documentation due to its unmaintained status. The section now highlights AVML as an actively maintained tool, and includes a general note encouraging users to verify tool compatibility. --- doc/source/getting-started-linux-tutorial.rst | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index 250a34c88..bb40de208 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -6,12 +6,11 @@ This guide will give you a brief overview of how volatility3 works as well as a Acquiring memory ---------------- -Volatility3 does not provide the ability to acquire memory. Below are some examples of tools that can be used to acquire memory, but more are available: +Volatility3 does not provide the ability to acquire memory. Below is an example of a tool that can be used to acquire memory on Linux systems: * `AVML - Acquire Volatile Memory for Linux `_ -* `LiME - Linux Memory Extract `_ -Be aware that LiME raw format is not supported by volatility3, the padded or lime option should be used instead. `This issue contains further information `_. +Other tools may exist, but please verify their maintenance status and compatibility with volatility3 before use. Procedure to create symbol tables for linux ------------------------------------------- From 0f33734f3bd541118d5c51491bb856c7ed91c880 Mon Sep 17 00:00:00 2001 From: Jaeyou PARK Date: Mon, 23 Jun 2025 15:20:42 +0900 Subject: [PATCH 1194/1352] Update getting-started-linux-tutorial.rst : Add reference to Abyss-W4tcher/volatility3-symbols Recommend users first check this repository for pre-generated symbol tables by kernel version for popular Linux distributions before creating their own. --- doc/source/getting-started-linux-tutorial.rst | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index bb40de208..d84872b3e 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -12,14 +12,19 @@ Volatility3 does not provide the ability to acquire memory. Below is an example Other tools may exist, but please verify their maintenance status and compatibility with volatility3 before use. -Procedure to create symbol tables for linux +Procedure to create symbol tables for Linux ------------------------------------------- -To create a symbol table please refer to :ref:`symbol-tables:Mac or Linux symbol tables`. +It is recommended to first check the repository `volatility3-symbols `_ for pre-generated JSON.xz symbol table files. +This repository provides files organized by kernel version for popular Linux distributions such as Debian, Ubuntu, and AlmaLinux. + +If you cannot find a suitable symbol table for your kernel version there, please refer to :ref:`symbol-tables:Mac or Linux symbol tables` to create one manually. + After creating the file, place it under the directory ``volatility3/symbols``. Volatility3 will automatically detect and use symbol tables from this location. + Listing plugins --------------- From 389223795561620ba4ff868976cf81e57ce8722e Mon Sep 17 00:00:00 2001 From: Jaeyou PARK Date: Mon, 23 Jun 2025 15:37:35 +0900 Subject: [PATCH 1195/1352] Update getting-started-linux-tutorial.rst : Rearrange linux.pstree plugin description Moved plugin output example above the feature explanation for better flow and clarity. Simplified the description while retaining key points about process hierarchy and anomaly detection. --- doc/source/getting-started-linux-tutorial.rst | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/doc/source/getting-started-linux-tutorial.rst b/doc/source/getting-started-linux-tutorial.rst index d84872b3e..d0b097e0e 100644 --- a/doc/source/getting-started-linux-tutorial.rst +++ b/doc/source/getting-started-linux-tutorial.rst @@ -133,9 +133,7 @@ This detailed view allows investigators to correlate user privileges, startup ti linux.pstree ~~~~~~~~~~~~ - -This plugin presents the process hierarchy as a tree, clearly showing parent-child relationships between processes. -It is especially useful for identifying unusual or suspicious process structures, such as orphaned child processes, injected children under legitimate parents, or long chains of shell execution. +This plugin presents the process hierarchy as a tree, clearly showing parent-child relationships between processes. .. code-block:: shell-session @@ -155,7 +153,10 @@ It is especially useful for identifying unusual or suspicious process structures **** 0x8ca671210000 1608 1608 1507 gnome-session-b ***** 0x8ca66fba42c0 1765 1765 1608 ssh-agent -The tree view can help identify anomalies in process launch sequences or privilege escalations by inspecting unexpected parent-child relationships. + +It helps identify unusual or suspicious process structures such as orphaned child processes, injected children under legitimate parents, or long chains of shell execution. +The tree view is particularly useful for spotting anomalies in process launch sequences or privilege escalations by inspecting unexpected parent-child relationships. + linux.bash From 65b99bc5462f635bf7f4ef5d83f766ed5c385a2e Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Mon, 23 Jun 2025 12:41:17 +0300 Subject: [PATCH 1196/1352] Plugins: remove unused unix argument in linux.sockstat --- volatility3/framework/plugins/linux/sockstat.py | 6 ------ 1 file changed, 6 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockstat.py b/volatility3/framework/plugins/linux/sockstat.py index a6acf825b..a74e84f92 100644 --- a/volatility3/framework/plugins/linux/sockstat.py +++ b/volatility3/framework/plugins/linux/sockstat.py @@ -475,12 +475,6 @@ class Sockstat(plugins.PluginInterface): requirements.VersionRequirement( name="linux_net", component=network.NetSymbols, version=(1, 0, 0) ), - requirements.BooleanRequirement( - name="unix", - description=("Show UNIX domain Sockets only"), - default=False, - optional=True, - ), requirements.ListRequirement( name="pids", description="Filter results by process IDs. " From 50767ffb8d809b6b2c7fab1d599c95965422a5d7 Mon Sep 17 00:00:00 2001 From: kyrre Date: Fri, 27 Jun 2025 16:33:28 +0200 Subject: [PATCH 1197/1352] add arrow and parquet renderers --- pyproject.toml | 2 + volatility3/cli/text_renderer.py | 141 ++++++++++++++++++++++++++++++- 2 files changed, 142 insertions(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index b88ac7752..0acbfcbbe 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -42,6 +42,8 @@ dev = [ "types-jsonschema>=4.23.0,<5", ] +arrow = ["pyarrow>=17.0.0"] + test = [ "volatility3[dev]", "pytest>=8.3.3,<9", diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 1e437a0be..69d2d6d31 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -9,7 +9,7 @@ import random import string import sys from functools import wraps -from typing import Any, Callable, Dict, List, Optional, Set, Tuple, TypeVar, Union +from typing import Any, Callable, Dict, List, Optional, Set, Tuple, TypeVar, Union, TextIO from volatility3.cli import text_filter from volatility3.framework import exceptions, interfaces, renderers @@ -25,6 +25,15 @@ except ImportError: vollog.debug("Disassembly library capstone not found") +try: + ARROW_PRESENT = True + import pyarrow as pa + import pyarrow.parquet as pq +except ImportError: + ARROW_PRESENT = False + vollog.debug("Arrow/Parquet libraries not found") + + def hex_bytes_as_text(value: bytes, width: int = 16) -> str: """Renders HexBytes as text. @@ -624,3 +633,133 @@ class JsonLinesRenderer(JsonRenderer): for line in result: outfd.write(json.dumps(line, sort_keys=True)) outfd.write("\n") + +class ArrowRenderer(CLIRenderer): + def __init__( + self, options: List[interfaces.renderers.RenderOption] | None = None + ) -> None: + super().__init__(options) + + if not ARROW_PRESENT: + raise RuntimeError("Arrow output format requires the pyarrow package") + + _to_arrow_type = { + renderers.Disassembly: pa.utf8, + bool: pa.bool_, + int: pa.int64, + float: pa.float64, + str: pa.utf8, + datetime.datetime: lambda: pa.timestamp("ms"), + format_hints.Bin: pa.int64, + format_hints.Hex: pa.int64, + format_hints.MultiTypeData: pa.utf8, + format_hints.HexBytes: pa.binary, + } + + name = "arrow" + structured_output = True + + def get_render_options(self) -> List[interfaces.renderers.RenderOption]: + return [] + + def to_arrow_schema(self, grid: interfaces.renderers.TreeGrid) -> pa.Schema: + fields = [] + for column in grid.columns: + arrow_type = self._to_arrow_type[column.type] + fields.append(pa.field(column.name, arrow_type())) + return pa.schema(fields) + + def output_result(self, schema, outfd: TextIO, result): + """Outputs the JSON data to a file in a particular format""" + + t = pa.Table.from_pylist(result, schema=schema) + self.write_data(t, outfd) + + def write_data(self, t: pa.Table, outfd: TextIO) -> None: + buf = pa.BufferOutputStream() + + writer = pa.ipc.new_stream(buf, t.schema) + writer.write_table(t) + writer.close() + + # Get the buffer bytes and write to output + buf_bytes = buf.getvalue().to_pybytes() + outfd.buffer.write(buf_bytes) + + def render(self, grid: interfaces.renderers.TreeGrid): + outfd = sys.stdout + final_output: Tuple[ + Dict[str, List[interfaces.renderers.TreeNode]], + List[interfaces.renderers.TreeNode], + ] = ({}, []) + + ignore_columns = self.ignored_columns(grid) + + def visitor( + node: interfaces.renderers.TreeNode, + accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]], + ) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]: + # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case + acc_map, final_tree = accumulator + node_dict: Dict[str, Any] = {"__children": []} + line = [] + for column_index, column in enumerate(grid.columns): + if column in ignore_columns: + continue + + data = list(node.values)[column_index] + + if isinstance(data, interfaces.renderers.BaseAbsentValue): + data = None + + if isinstance(data, renderers.Disassembly): + data = display_disassembly(data) + + node_dict[column.name] = data + line.append(data) + + if self.filter and self.filter.filter(line): + return accumulator + + if node.parent: + acc_map[node.parent.path]["__children"].append(node_dict) + else: + final_tree.append(node_dict) + acc_map[node.path] = node_dict + + return (acc_map, final_tree) + + if not grid.populated: + grid.populate(visitor, final_output) + else: + grid.visit(node=None, function=visitor, initial_accumulator=final_output) + + schema = self.to_arrow_schema(grid) + self.output_result(schema, outfd, final_output[1]) + + +class ParquetRenderer(ArrowRenderer): + name = "parquet" + structured_output = True + + def get_render_options(self) -> List[interfaces.renderers.RenderOption]: + return [] + + def write_data(self, t: pa.Table, outfd: TextIO) -> None: + """ + Writes a table to stdout using the Parquet format. + + Args: + t: The Arrow table to write + outfd: The output file descriptor + + Returns: + Nothing + """ + # Write DataFrame to a temporary file-like object + buf = pa.BufferOutputStream() + pq.write_table(t, buf, compression="snappy") + + # Get the buffer as a bytes object + buf_bytes = buf.getvalue().to_pybytes() + outfd.buffer.write(buf_bytes) \ No newline at end of file From a0b00766f8df6cd4351e850ee9424a1c18786aa9 Mon Sep 17 00:00:00 2001 From: kyrre Date: Fri, 27 Jun 2025 16:58:35 +0200 Subject: [PATCH 1198/1352] formatting with ruff --- volatility3/cli/text_renderer.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 69d2d6d31..13276520d 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -748,11 +748,11 @@ class ParquetRenderer(ArrowRenderer): def write_data(self, t: pa.Table, outfd: TextIO) -> None: """ Writes a table to stdout using the Parquet format. - + Args: t: The Arrow table to write outfd: The output file descriptor - + Returns: Nothing """ @@ -762,4 +762,4 @@ class ParquetRenderer(ArrowRenderer): # Get the buffer as a bytes object buf_bytes = buf.getvalue().to_pybytes() - outfd.buffer.write(buf_bytes) \ No newline at end of file + outfd.buffer.write(buf_bytes) From 1c7856212f6c05feec3aa4d5527b7b00f4bbc456 Mon Sep 17 00:00:00 2001 From: kyrre Date: Fri, 27 Jun 2025 17:01:08 +0200 Subject: [PATCH 1199/1352] linting --- volatility3/cli/text_renderer.py | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 13276520d..1bdca3803 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -9,7 +9,18 @@ import random import string import sys from functools import wraps -from typing import Any, Callable, Dict, List, Optional, Set, Tuple, TypeVar, Union, TextIO +from typing import ( + Any, + Callable, + Dict, + List, + Optional, + Set, + Tuple, + TypeVar, + Union, + TextIO, +) from volatility3.cli import text_filter from volatility3.framework import exceptions, interfaces, renderers @@ -634,6 +645,7 @@ class JsonLinesRenderer(JsonRenderer): outfd.write(json.dumps(line, sort_keys=True)) outfd.write("\n") + class ArrowRenderer(CLIRenderer): def __init__( self, options: List[interfaces.renderers.RenderOption] | None = None From 03895969875f682031466cb84793b6dc9d74f617 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Sat, 28 Jun 2025 11:46:13 +0200 Subject: [PATCH 1200/1352] Fix: Avoid import-time errors if pyarrow is missing - Use string type annotations for pa.* types in Arrow/Parquet renderers. - Ensure pyarrow dependency is checked only in __init__. --- volatility3/cli/text_renderer.py | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 1bdca3803..d2334a9f9 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -655,18 +655,18 @@ class ArrowRenderer(CLIRenderer): if not ARROW_PRESENT: raise RuntimeError("Arrow output format requires the pyarrow package") - _to_arrow_type = { - renderers.Disassembly: pa.utf8, - bool: pa.bool_, - int: pa.int64, - float: pa.float64, - str: pa.utf8, - datetime.datetime: lambda: pa.timestamp("ms"), - format_hints.Bin: pa.int64, - format_hints.Hex: pa.int64, - format_hints.MultiTypeData: pa.utf8, - format_hints.HexBytes: pa.binary, - } + self._to_arrow_type = { + renderers.Disassembly: pa.utf8, + bool: pa.bool_, + int: pa.int64, + float: pa.float64, + str: pa.utf8, + datetime.datetime: lambda: pa.timestamp("ms"), + format_hints.Bin: pa.int64, + format_hints.Hex: pa.int64, + format_hints.MultiTypeData: pa.utf8, + format_hints.HexBytes: pa.binary, + } name = "arrow" structured_output = True @@ -674,20 +674,20 @@ class ArrowRenderer(CLIRenderer): def get_render_options(self) -> List[interfaces.renderers.RenderOption]: return [] - def to_arrow_schema(self, grid: interfaces.renderers.TreeGrid) -> pa.Schema: + def to_arrow_schema(self, grid: interfaces.renderers.TreeGrid) -> "pa.Schema": fields = [] for column in grid.columns: arrow_type = self._to_arrow_type[column.type] fields.append(pa.field(column.name, arrow_type())) return pa.schema(fields) - def output_result(self, schema, outfd: TextIO, result): + def output_result(self, schema: "pa.Schema", outfd: TextIO, result): """Outputs the JSON data to a file in a particular format""" t = pa.Table.from_pylist(result, schema=schema) self.write_data(t, outfd) - def write_data(self, t: pa.Table, outfd: TextIO) -> None: + def write_data(self, t: "pa.Table", outfd: TextIO) -> None: buf = pa.BufferOutputStream() writer = pa.ipc.new_stream(buf, t.schema) @@ -757,7 +757,7 @@ class ParquetRenderer(ArrowRenderer): def get_render_options(self) -> List[interfaces.renderers.RenderOption]: return [] - def write_data(self, t: pa.Table, outfd: TextIO) -> None: + def write_data(self, t: "pa.Table", outfd: TextIO) -> None: """ Writes a table to stdout using the Parquet format. From 78d56534c0b9b17fff2e9e62c06f53fb1edc7015 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Sat, 28 Jun 2025 12:16:36 +0200 Subject: [PATCH 1201/1352] fix: handle layerdata to pyarrow conversion --- volatility3/cli/text_renderer.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index d2334a9f9..52a499ffe 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -666,6 +666,8 @@ class ArrowRenderer(CLIRenderer): format_hints.Hex: pa.int64, format_hints.MultiTypeData: pa.utf8, format_hints.HexBytes: pa.binary, + renderers.LayerData: pa.binary, + bytes: pa.binary, } name = "arrow" @@ -727,6 +729,9 @@ class ArrowRenderer(CLIRenderer): if isinstance(data, renderers.Disassembly): data = display_disassembly(data) + if isinstance(data, renderers.LayerData): + data = LayerDataRenderer().render_bytes(data)[0] + node_dict[column.name] = data line.append(data) From 97006bc61cb7403e7e1fe43389c9724e87247492 Mon Sep 17 00:00:00 2001 From: atcuno Date: Mon, 30 Jun 2025 17:27:58 -0500 Subject: [PATCH 1202/1352] Change warning to debug to not break plugin output and to conform to coding standards --- volatility3/framework/plugins/windows/malware/malfind.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/malware/malfind.py b/volatility3/framework/plugins/windows/malware/malfind.py index 33eaf64ef..01da93e1f 100644 --- a/volatility3/framework/plugins/windows/malware/malfind.py +++ b/volatility3/framework/plugins/windows/malware/malfind.py @@ -173,7 +173,7 @@ class Malfind(interfaces.plugins.PluginInterface): if dirty_page is not None: # Useful information to investigate the page content with volshell afterwards. - vollog.warning( + vollog.debug( f"[proc_id {proc_id}] Found suspicious DIRTY + {protection_string} page at {hex(dirty_page)}", ) start = vad.get_start() From e4aa9af834bedc70f7e27d2a8599444b2a7af4ab Mon Sep 17 00:00:00 2001 From: tvanegro Date: Thu, 3 Jul 2025 13:31:03 +0200 Subject: [PATCH 1203/1352] version bump --- volatility3/framework/plugins/linux/malware/malfind.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 98e9c4695..b9a03c616 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -18,7 +18,7 @@ class Malfind(interfaces.plugins.PluginInterface): """Lists process memory ranges that potentially contain injected code.""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 3) + _version = (1, 0, 4) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 2f8aecc025ec326aa9897c9762d099a51d171910 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 4 Jun 2025 22:13:28 +0300 Subject: [PATCH 1204/1352] linux_utilities show deleted fd + lsof files_only arg --- volatility3/framework/plugins/linux/lsof.py | 15 +++++++++++++-- volatility3/framework/symbols/linux/__init__.py | 17 +++++++++++++---- 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 283eabca0..1880bb09e 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -137,6 +137,12 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): element_type=int, optional=True, ), + requirements.BooleanRequirement( + name="files_only", + description="Include only file descriptors of type file", + optional=True, + default=False, + ), ] @classmethod @@ -145,6 +151,7 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): context: interfaces.context.ContextInterface, vmlinux_module_name: str, filter_func: Callable[[int], bool] = lambda _: False, + include_files_only: bool = False, ) -> Iterable[FDInternal]: """Enumerates open file descriptors in tasks @@ -167,7 +174,7 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): linuxutils_symbol_table = task.vol.type_name.split(constants.BANG)[0] fd_generator = linux.LinuxUtilities.files_descriptors_for_process( - context, linuxutils_symbol_table, task + context, linuxutils_symbol_table, task, files_only=include_files_only ) for fd_fields in fd_generator: @@ -175,8 +182,12 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): def _generator(self, pids, vmlinux_module_name): filter_func = pslist.PsList.create_pid_filter(pids) + include_files_only = self.config.get("files_only") for fd_internal in self.list_fds( - self.context, vmlinux_module_name, filter_func=filter_func + self.context, + vmlinux_module_name, + filter_func=filter_func, + include_files_only=include_files_only, ): fd_user = fd_internal.to_user() yield (0, dataclasses.astuple(fd_user)) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index ac27b7e42..d66d350b1 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -101,6 +101,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): _version = (2, 3, 1) _required_framework_version = (2, 0, 0) + deleted = " (deleted)" framework.require_interface_version(*_required_framework_version) @@ -168,6 +169,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): # vfsmnt can be the vfsmount object itself (>=3.3) or a vfsmount * (<3.3) return "" + inode = dentry.d_inode path_reversed = [] smeared = False while ( @@ -191,6 +193,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): parent = dentry.d_parent dname = dentry.d_name.name_as_str() + # empty dentry names are most likely # the result of smearing if not dname: @@ -204,6 +207,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): # path would be /foo/bar/baz, but bar is missing due to smear the results # returned here will show /foo//baz. Note the // for the missing dname. return f" {path}" + print(path, inode.i_nlink) + if inode and inode.is_readable() and inode.is_valid() and inode.i_nlink == 0: + path += LinuxUtilities.deleted return path @classmethod @@ -260,7 +266,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): pre_name = name.dereference().cast( "string", max_length=255, errors="replace" ) - return "/" + pre_name + " (deleted)" + return "/" + pre_name + LinuxUtilities.deleted else: pre_name = "" @@ -301,7 +307,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return f"{pre_name}:[{inode.i_ino:d}]" @classmethod - def path_for_file(cls, context, task, filp) -> str: + def path_for_file(cls, context, task, filp, files_only) -> str: """Returns a file (or sock pipe) pathname relative to the task's root directory. A 'file' structure doesn't have enough information to properly restore its @@ -340,7 +346,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): except exceptions.InvalidAddressException: dname_is_valid = False - if dname_is_valid: + if dname_is_valid and not files_only: ret = LinuxUtilities._get_new_sock_pipe_path(context, task, filp) else: ret = LinuxUtilities._get_path_file(task, filp) @@ -353,6 +359,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): context: interfaces.context.ContextInterface, symbol_table: str, task: interfaces.objects.ObjectInterface, + files_only: bool = False, ): try: files = task.files @@ -376,7 +383,9 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): for fd_num, filp in enumerate(fds): if filp and filp.is_readable(): - full_path = LinuxUtilities.path_for_file(context, task, filp) + full_path = LinuxUtilities.path_for_file( + context, task, filp, files_only + ) yield fd_num, filp, full_path From bf68bb6590e75569a75bedffc05189fa5d8dddda Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 4 Jun 2025 22:18:29 +0300 Subject: [PATCH 1205/1352] debug print remove --- volatility3/framework/symbols/linux/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index d66d350b1..dbea14d47 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -207,7 +207,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): # path would be /foo/bar/baz, but bar is missing due to smear the results # returned here will show /foo//baz. Note the // for the missing dname. return f" {path}" - print(path, inode.i_nlink) + if inode and inode.is_readable() and inode.is_valid() and inode.i_nlink == 0: path += LinuxUtilities.deleted return path From e29a01e6826a58b75c9f1f95e06a8e38b521cc21 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 4 Jun 2025 22:20:10 +0300 Subject: [PATCH 1206/1352] black --- volatility3/framework/symbols/linux/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index dbea14d47..6de445c6b 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -207,7 +207,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): # path would be /foo/bar/baz, but bar is missing due to smear the results # returned here will show /foo//baz. Note the // for the missing dname. return f" {path}" - + if inode and inode.is_readable() and inode.is_valid() and inode.i_nlink == 0: path += LinuxUtilities.deleted return path From 2efb7f580a6a574fd5c942e3a78082ec94f80023 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 4 Jun 2025 22:27:18 +0300 Subject: [PATCH 1207/1352] declare default value :(( --- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 3b9a73e7c..8330d70aa 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1253,7 +1253,7 @@ class vm_area_struct(objects.StructType): def _do_get_name(self, context, task) -> str: if self.vm_file != 0: - fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file) + fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file, files_only=False) elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk: fname = "[heap]" elif self.vm_start <= task.mm.start_stack <= self.vm_end: From e0dc64938463722e3465a7dbfdd09bd053b66849 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 4 Jun 2025 22:28:27 +0300 Subject: [PATCH 1208/1352] black --- volatility3/framework/symbols/linux/extensions/__init__.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 8330d70aa..318424d5b 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1253,7 +1253,9 @@ class vm_area_struct(objects.StructType): def _do_get_name(self, context, task) -> str: if self.vm_file != 0: - fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file, files_only=False) + fname = linux.LinuxUtilities.path_for_file( + context, task, self.vm_file, files_only=False + ) elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk: fname = "[heap]" elif self.vm_start <= task.mm.start_stack <= self.vm_end: From 23e4d35017b7ed3f73458d862c77cdc471e5a1bf Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 19:44:50 +0300 Subject: [PATCH 1209/1352] prepend for deleted sock & file instead of (deleted) --- volatility3/framework/symbols/linux/__init__.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 6de445c6b..b3a8935c6 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -101,7 +101,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): _version = (2, 3, 1) _required_framework_version = (2, 0, 0) - deleted = " (deleted)" + deleted = "" framework.require_interface_version(*_required_framework_version) @@ -209,7 +209,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return f" {path}" if inode and inode.is_readable() and inode.is_valid() and inode.i_nlink == 0: - path += LinuxUtilities.deleted + path = f"{LinuxUtilities.deleted} {path}" return path @classmethod @@ -266,7 +266,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): pre_name = name.dereference().cast( "string", max_length=255, errors="replace" ) - return "/" + pre_name + LinuxUtilities.deleted + return f"{LinuxUtilities.deleted} /{pre_name}" else: pre_name = "" From 0a8f2cd23e15d046a37bb986c6394e7bb04d9ec2 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 19:47:27 +0300 Subject: [PATCH 1210/1352] files_only default arg & minor version bump --- volatility3/framework/symbols/linux/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index b3a8935c6..8e1b94a0a 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -99,7 +99,7 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): class LinuxUtilities(interfaces.configuration.VersionableInterface): """Class with multiple useful linux functions.""" - _version = (2, 3, 1) + _version = (2, 4, 0) _required_framework_version = (2, 0, 0) deleted = "" @@ -307,7 +307,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return f"{pre_name}:[{inode.i_ino:d}]" @classmethod - def path_for_file(cls, context, task, filp, files_only) -> str: + def path_for_file(cls, context, task, filp, files_only=False) -> str: """Returns a file (or sock pipe) pathname relative to the task's root directory. A 'file' structure doesn't have enough information to properly restore its From c64c6229d1db02f880d35be479410b2c58b31847 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 19:58:18 +0300 Subject: [PATCH 1211/1352] move config arg to run() --- volatility3/framework/plugins/linux/lsof.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 1880bb09e..d807d444e 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -180,9 +180,9 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): for fd_fields in fd_generator: yield FDInternal(task=task, fd_fields=fd_fields) - def _generator(self, pids, vmlinux_module_name): + def _generator(self, pids, vmlinux_module_name, include_files_only): filter_func = pslist.PsList.create_pid_filter(pids) - include_files_only = self.config.get("files_only") + for fd_internal in self.list_fds( self.context, vmlinux_module_name, @@ -195,6 +195,7 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): def run(self): pids = self.config.get("pid", None) vmlinux_module_name = self.config["kernel"] + include_files_only = self.config.get("files_only") tree_grid_args = [ ("PID", int), @@ -212,7 +213,10 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): ("Size", int), ] return renderers.TreeGrid( - tree_grid_args, self._generator(pids, vmlinux_module_name) + tree_grid_args, + self._generator( + pids, vmlinux_module_name, include_files_only=include_files_only + ), ) def generate_timeline(self): From 606323f25a13ae5bd73cc07721ad2e59780e4f5d Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Thu, 12 Jun 2025 21:09:25 +0300 Subject: [PATCH 1212/1352] remove code for next PR --- volatility3/framework/symbols/linux/__init__.py | 2 +- volatility3/framework/symbols/linux/extensions/__init__.py | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 8e1b94a0a..19f8fc800 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -266,7 +266,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): pre_name = name.dereference().cast( "string", max_length=255, errors="replace" ) - return f"{LinuxUtilities.deleted} /{pre_name}" + return "/" + pre_name + " (deleted)" else: pre_name = "" diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 318424d5b..3b9a73e7c 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1253,9 +1253,7 @@ class vm_area_struct(objects.StructType): def _do_get_name(self, context, task) -> str: if self.vm_file != 0: - fname = linux.LinuxUtilities.path_for_file( - context, task, self.vm_file, files_only=False - ) + fname = linux.LinuxUtilities.path_for_file(context, task, self.vm_file) elif self.vm_start <= task.mm.start_brk and self.vm_end >= task.mm.brk: fname = "[heap]" elif self.vm_start <= task.mm.start_stack <= self.vm_end: From c4717075b68ce70ae9d01261165322a01a02928c Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Thu, 12 Jun 2025 21:27:19 +0300 Subject: [PATCH 1213/1352] create potential smear tag --- volatility3/framework/symbols/linux/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 19f8fc800..856be961e 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -102,6 +102,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): _version = (2, 4, 0) _required_framework_version = (2, 0, 0) deleted = "" + smear = "" framework.require_interface_version(*_required_framework_version) @@ -206,7 +207,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): # if there is smear the missing dname will be empty. e.g. if the normal # path would be /foo/bar/baz, but bar is missing due to smear the results # returned here will show /foo//baz. Note the // for the missing dname. - return f" {path}" + return f"{LinuxUtilities.smear} {path}" if inode and inode.is_readable() and inode.is_valid() and inode.i_nlink == 0: path = f"{LinuxUtilities.deleted} {path}" From 7ed7d43c424010a9e5e1875854189299a5c52cc8 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Mon, 23 Jun 2025 10:18:47 +0300 Subject: [PATCH 1214/1352] plugins: bump lsof minor version --- volatility3/framework/plugins/linux/lsof.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index d807d444e..4b6f011ea 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -110,7 +110,7 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists open files for each processes.""" _required_framework_version = (2, 0, 0) - _version = (2, 0, 2) + _version = (2, 1, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From eb790083e2875f63dc14a9a9fb52f5088114f08e Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Fri, 11 Jul 2025 15:26:03 +0300 Subject: [PATCH 1215/1352] plugins: lsof change back to (deleted) --- volatility3/framework/symbols/linux/__init__.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 856be961e..19fb8f1d4 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -101,7 +101,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): _version = (2, 4, 0) _required_framework_version = (2, 0, 0) - deleted = "" + deleted = "(deleted)" smear = "" framework.require_interface_version(*_required_framework_version) @@ -210,7 +210,7 @@ class LinuxUtilities(interfaces.configuration.VersionableInterface): return f"{LinuxUtilities.smear} {path}" if inode and inode.is_readable() and inode.is_valid() and inode.i_nlink == 0: - path = f"{LinuxUtilities.deleted} {path}" + path = f" {path} {LinuxUtilities.deleted}" return path @classmethod From 1ebb82a0c0ec00c6e54f2d5f731de18520367041 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sat, 12 Jul 2025 11:09:47 +0100 Subject: [PATCH 1216/1352] Try to fix documentation builds --- pyproject.toml | 2 +- volatility3/framework/plugins/yarascan.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index b88ac7752..fca8ea436 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -52,7 +52,7 @@ test = [ docs = [ "volatility3[dev]", "sphinx>=4.0.0,<9", - "sphinx-autodoc-typehints>=2.0.0,<3", + "sphinx-autodoc-typehints>=3.0.0,<4", "sphinx-rtd-theme>=3.0.1,<4", ] diff --git a/volatility3/framework/plugins/yarascan.py b/volatility3/framework/plugins/yarascan.py index 040a50c1a..910ded109 100644 --- a/volatility3/framework/plugins/yarascan.py +++ b/volatility3/framework/plugins/yarascan.py @@ -31,7 +31,7 @@ except ImportError: except ImportError: vollog.info( - "Neither yara-x nor yara-python (>3.8.0) module not found, plugin (and dependent plugins) not available" + "Neither yara-x nor yara-python (>3.8.0) module was found, plugin (and dependent plugins) not available" ) raise From d3a6b030b7604f6289f59dc7fa3e2882eb69225a Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Mon, 14 Jul 2025 13:38:35 +0200 Subject: [PATCH 1217/1352] moved arrow/parquet parsers to it's own file and reverted changes --- volatility3/cli/text_renderer.py | 166 +----------------- .../framework/plugins/parquet_renderer.py | 161 +++++++++++++++++ 2 files changed, 165 insertions(+), 162 deletions(-) create mode 100644 volatility3/framework/plugins/parquet_renderer.py diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 52a499ffe..89526c90c 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -9,18 +9,7 @@ import random import string import sys from functools import wraps -from typing import ( - Any, - Callable, - Dict, - List, - Optional, - Set, - Tuple, - TypeVar, - Union, - TextIO, -) +from typing import Any, Callable, Dict, List, Optional, Set, Tuple, TypeVar, Union from volatility3.cli import text_filter from volatility3.framework import exceptions, interfaces, renderers @@ -36,15 +25,6 @@ except ImportError: vollog.debug("Disassembly library capstone not found") -try: - ARROW_PRESENT = True - import pyarrow as pa - import pyarrow.parquet as pq -except ImportError: - ARROW_PRESENT = False - vollog.debug("Arrow/Parquet libraries not found") - - def hex_bytes_as_text(value: bytes, width: int = 16) -> str: """Renders HexBytes as text. @@ -298,7 +278,6 @@ class CLIRenderer(interfaces.renderers.Renderer): class QuickTextRenderer(CLIRenderer): - name = "quick" def get_render_options(self): @@ -368,7 +347,6 @@ class NoneRenderer(CLIRenderer): class CSVRenderer(CLIRenderer): - name = "csv" structured_output = True @@ -486,9 +464,9 @@ class PrettyTextRenderer(CLIRenderer): accumulator.append((node.path_depth, line)) return accumulator - final_output: List[Tuple[int, Dict[interfaces.renderers.Column, list[str]]]] = ( - [] - ) + final_output: List[ + Tuple[int, Dict[interfaces.renderers.Column, list[str]]] + ] = [] if not grid.populated: grid.populate(visitor, final_output) else: @@ -644,139 +622,3 @@ class JsonLinesRenderer(JsonRenderer): for line in result: outfd.write(json.dumps(line, sort_keys=True)) outfd.write("\n") - - -class ArrowRenderer(CLIRenderer): - def __init__( - self, options: List[interfaces.renderers.RenderOption] | None = None - ) -> None: - super().__init__(options) - - if not ARROW_PRESENT: - raise RuntimeError("Arrow output format requires the pyarrow package") - - self._to_arrow_type = { - renderers.Disassembly: pa.utf8, - bool: pa.bool_, - int: pa.int64, - float: pa.float64, - str: pa.utf8, - datetime.datetime: lambda: pa.timestamp("ms"), - format_hints.Bin: pa.int64, - format_hints.Hex: pa.int64, - format_hints.MultiTypeData: pa.utf8, - format_hints.HexBytes: pa.binary, - renderers.LayerData: pa.binary, - bytes: pa.binary, - } - - name = "arrow" - structured_output = True - - def get_render_options(self) -> List[interfaces.renderers.RenderOption]: - return [] - - def to_arrow_schema(self, grid: interfaces.renderers.TreeGrid) -> "pa.Schema": - fields = [] - for column in grid.columns: - arrow_type = self._to_arrow_type[column.type] - fields.append(pa.field(column.name, arrow_type())) - return pa.schema(fields) - - def output_result(self, schema: "pa.Schema", outfd: TextIO, result): - """Outputs the JSON data to a file in a particular format""" - - t = pa.Table.from_pylist(result, schema=schema) - self.write_data(t, outfd) - - def write_data(self, t: "pa.Table", outfd: TextIO) -> None: - buf = pa.BufferOutputStream() - - writer = pa.ipc.new_stream(buf, t.schema) - writer.write_table(t) - writer.close() - - # Get the buffer bytes and write to output - buf_bytes = buf.getvalue().to_pybytes() - outfd.buffer.write(buf_bytes) - - def render(self, grid: interfaces.renderers.TreeGrid): - outfd = sys.stdout - final_output: Tuple[ - Dict[str, List[interfaces.renderers.TreeNode]], - List[interfaces.renderers.TreeNode], - ] = ({}, []) - - ignore_columns = self.ignored_columns(grid) - - def visitor( - node: interfaces.renderers.TreeNode, - accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]], - ) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]: - # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case - acc_map, final_tree = accumulator - node_dict: Dict[str, Any] = {"__children": []} - line = [] - for column_index, column in enumerate(grid.columns): - if column in ignore_columns: - continue - - data = list(node.values)[column_index] - - if isinstance(data, interfaces.renderers.BaseAbsentValue): - data = None - - if isinstance(data, renderers.Disassembly): - data = display_disassembly(data) - - if isinstance(data, renderers.LayerData): - data = LayerDataRenderer().render_bytes(data)[0] - - node_dict[column.name] = data - line.append(data) - - if self.filter and self.filter.filter(line): - return accumulator - - if node.parent: - acc_map[node.parent.path]["__children"].append(node_dict) - else: - final_tree.append(node_dict) - acc_map[node.path] = node_dict - - return (acc_map, final_tree) - - if not grid.populated: - grid.populate(visitor, final_output) - else: - grid.visit(node=None, function=visitor, initial_accumulator=final_output) - - schema = self.to_arrow_schema(grid) - self.output_result(schema, outfd, final_output[1]) - - -class ParquetRenderer(ArrowRenderer): - name = "parquet" - structured_output = True - - def get_render_options(self) -> List[interfaces.renderers.RenderOption]: - return [] - - def write_data(self, t: "pa.Table", outfd: TextIO) -> None: - """ - Writes a table to stdout using the Parquet format. - - Args: - t: The Arrow table to write - outfd: The output file descriptor - - Returns: - Nothing - """ - # Write DataFrame to a temporary file-like object - buf = pa.BufferOutputStream() - pq.write_table(t, buf, compression="snappy") - - # Get the buffer as a bytes object - buf_bytes = buf.getvalue().to_pybytes() - outfd.buffer.write(buf_bytes) diff --git a/volatility3/framework/plugins/parquet_renderer.py b/volatility3/framework/plugins/parquet_renderer.py new file mode 100644 index 000000000..806dcd801 --- /dev/null +++ b/volatility3/framework/plugins/parquet_renderer.py @@ -0,0 +1,161 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import datetime +import logging +import sys +from typing import ( + Any, + Dict, + List, + Tuple, + TextIO, +) +from volatility3.framework import interfaces, renderers +from volatility3.framework.renderers import format_hints +from volatility3.cli.text_renderer import CLIRenderer, display_disassembly, LayerDataRenderer + +vollog = logging.getLogger(__name__) + +try: + ARROW_PRESENT = True + import pyarrow as pa + import pyarrow.parquet as pq +except ImportError: + ARROW_PRESENT = False + vollog.debug("Arrow/Parquet libraries not found") + +class ArrowRenderer(CLIRenderer): + def __init__( + self, options: List[interfaces.renderers.RenderOption] | None = None + ) -> None: + super().__init__(options) + + if not ARROW_PRESENT: + raise RuntimeError("Arrow output format requires the pyarrow package") + + self._to_arrow_type = { + renderers.Disassembly: pa.utf8, + bool: pa.bool_, + int: pa.int64, + float: pa.float64, + str: pa.utf8, + datetime.datetime: lambda: pa.timestamp("ms"), + format_hints.Bin: pa.int64, + format_hints.Hex: pa.int64, + format_hints.MultiTypeData: pa.utf8, + format_hints.HexBytes: pa.binary, + renderers.LayerData: pa.binary, + bytes: pa.binary, + } + + name = "arrow" + structured_output = True + + def get_render_options(self) -> List[interfaces.renderers.RenderOption]: + return [] + + def to_arrow_schema(self, grid: interfaces.renderers.TreeGrid) -> "pa.Schema": + fields = [] + for column in grid.columns: + arrow_type = self._to_arrow_type[column.type] + fields.append(pa.field(column.name, arrow_type())) + return pa.schema(fields) + + def output_result(self, schema: "pa.Schema", outfd: TextIO, result): + """Outputs the JSON data to a file in a particular format""" + + t = pa.Table.from_pylist(result, schema=schema) + self.write_data(t, outfd) + + def write_data(self, t: "pa.Table", outfd: TextIO) -> None: + buf = pa.BufferOutputStream() + + writer = pa.ipc.new_stream(buf, t.schema) + writer.write_table(t) + writer.close() + + # Get the buffer bytes and write to output + buf_bytes = buf.getvalue().to_pybytes() + outfd.buffer.write(buf_bytes) + + def render(self, grid: interfaces.renderers.TreeGrid): + outfd = sys.stdout + final_output: Tuple[ + Dict[str, List[interfaces.renderers.TreeNode]], + List[interfaces.renderers.TreeNode], + ] = ({}, []) + + ignore_columns = self.ignored_columns(grid) + + def visitor( + node: interfaces.renderers.TreeNode, + accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]], + ) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]: + # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case + acc_map, final_tree = accumulator + node_dict: Dict[str, Any] = {"__children": []} + line = [] + for column_index, column in enumerate(grid.columns): + if column in ignore_columns: + continue + + data = list(node.values)[column_index] + + if isinstance(data, interfaces.renderers.BaseAbsentValue): + data = None + + if isinstance(data, renderers.Disassembly): + data = display_disassembly(data) + + if isinstance(data, renderers.LayerData): + data = LayerDataRenderer().render_bytes(data)[0] + + node_dict[column.name] = data + line.append(data) + + if self.filter and self.filter.filter(line): + return accumulator + + if node.parent: + acc_map[node.parent.path]["__children"].append(node_dict) + else: + final_tree.append(node_dict) + acc_map[node.path] = node_dict + + return (acc_map, final_tree) + + if not grid.populated: + grid.populate(visitor, final_output) + else: + grid.visit(node=None, function=visitor, initial_accumulator=final_output) + + schema = self.to_arrow_schema(grid) + self.output_result(schema, outfd, final_output[1]) + + +class ParquetRenderer(ArrowRenderer): + name = "parquet" + structured_output = True + + def get_render_options(self) -> List[interfaces.renderers.RenderOption]: + return [] + + def write_table(self, table: "pa.Table", outfd: TextIO) -> None: + """ + Writes a table to stdout using the Parquet format. + + Args: + t: The Arrow table to write + outfd: The output file descriptor + + Returns: + Nothing + """ + # Write DataFrame to a temporary file-like object + buf = pa.BufferOutputStream() + pq.write_table(table, buf, compression="snappy") + + # Get the buffer as a bytes object + buf_bytes = buf.getvalue().to_pybytes() + outfd.buffer.write(buf_bytes) From 8479fa1c136c3f71c7fb8602184219326fca1fae Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Mon, 14 Jul 2025 14:07:44 +0200 Subject: [PATCH 1218/1352] moved renderer parsing to after the plugins are imported --- volatility3/cli/__init__.py | 45 ++++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 20 deletions(-) diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index cc97c4fcb..4c379a15e 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -106,13 +106,6 @@ class CommandLine: volatility3.framework.require_interface_version(2, 0, 0) - renderers = dict( - [ - (x.name.lower(), x) - for x in framework.class_subclasses(text_renderer.CLIRenderer) - ] - ) - # Load up system defaults delayed_logs, default_config = self.load_system_defaults("vol.json") @@ -193,14 +186,6 @@ class CommandLine: default=False, action="store_true", ) - parser.add_argument( - "-r", - "--renderer", - metavar="RENDERER", - help=f"Determines how to render the output ({', '.join(list(renderers))})", - default="quick", - choices=list(renderers), - ) parser.add_argument( "-f", "--file", @@ -270,11 +255,6 @@ class CommandLine: known_args = [arg for arg in sys.argv if arg != "--help" and arg != "-h"] partial_args, _ = parser.parse_known_args(known_args) - banner_output = sys.stdout - if renderers[partial_args.renderer].structured_output: - banner_output = sys.stderr - banner_output.write(f"Volatility 3 Framework {constants.PACKAGE_VERSION}\n") - ### Start up logging if partial_args.log: file_logger = logging.FileHandler(partial_args.log) @@ -346,6 +326,24 @@ class CommandLine: plugin_list = framework.list_plugins() + # Discover renderers after plugin directories are loaded + # This allows custom renderers to be found in plugin directories + renderers = dict( + [ + (x.name.lower(), x) + for x in framework.class_subclasses(text_renderer.CLIRenderer) + ] + ) + + parser.add_argument( + "-r", + "--renderer", + metavar="RENDERER", + help=f"Determines how to render the output ({', '.join(list(renderers))})", + default="quick", + choices=list(renderers), + ) + seen_automagics = set() chosen_configurables_list = {} for amagic in automagics: @@ -392,6 +390,13 @@ class CommandLine: # before all the plugins have been added argcomplete.autocomplete(parser) args = parser.parse_args() + + # Display banner - redirect to stderr if using structured output + banner_output = sys.stdout + if renderers[args.renderer].structured_output: + banner_output = sys.stderr + banner_output.write(f"Volatility 3 Framework {constants.PACKAGE_VERSION}\n") + if args.plugin is None: parser.error( f"Please select a plugin to run (see '{self.CLI_NAME} --help' for options" From 066076b4d83ff47b766f250bef379076ab8b8369 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Mon, 14 Jul 2025 14:10:31 +0200 Subject: [PATCH 1219/1352] black formatting --- volatility3/cli/text_renderer.py | 6 +++--- volatility3/framework/plugins/parquet_renderer.py | 7 ++++++- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 89526c90c..d55201371 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -464,9 +464,9 @@ class PrettyTextRenderer(CLIRenderer): accumulator.append((node.path_depth, line)) return accumulator - final_output: List[ - Tuple[int, Dict[interfaces.renderers.Column, list[str]]] - ] = [] + final_output: List[Tuple[int, Dict[interfaces.renderers.Column, list[str]]]] = ( + [] + ) if not grid.populated: grid.populate(visitor, final_output) else: diff --git a/volatility3/framework/plugins/parquet_renderer.py b/volatility3/framework/plugins/parquet_renderer.py index 806dcd801..adc3a97e1 100644 --- a/volatility3/framework/plugins/parquet_renderer.py +++ b/volatility3/framework/plugins/parquet_renderer.py @@ -13,7 +13,11 @@ from typing import ( ) from volatility3.framework import interfaces, renderers from volatility3.framework.renderers import format_hints -from volatility3.cli.text_renderer import CLIRenderer, display_disassembly, LayerDataRenderer +from volatility3.cli.text_renderer import ( + CLIRenderer, + display_disassembly, + LayerDataRenderer, +) vollog = logging.getLogger(__name__) @@ -25,6 +29,7 @@ except ImportError: ARROW_PRESENT = False vollog.debug("Arrow/Parquet libraries not found") + class ArrowRenderer(CLIRenderer): def __init__( self, options: List[interfaces.renderers.RenderOption] | None = None From 0f32bec2638e69ac543f27f0ce2b0993cc9d75c6 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Mon, 14 Jul 2025 14:20:37 +0200 Subject: [PATCH 1220/1352] restore orginal text_renderer --- volatility3/cli/text_renderer.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index d55201371..1e437a0be 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -278,6 +278,7 @@ class CLIRenderer(interfaces.renderers.Renderer): class QuickTextRenderer(CLIRenderer): + name = "quick" def get_render_options(self): @@ -347,6 +348,7 @@ class NoneRenderer(CLIRenderer): class CSVRenderer(CLIRenderer): + name = "csv" structured_output = True From 72422d0db9ab255a03d50f3830681011c8b3191c Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Mon, 21 Jul 2025 13:38:54 +0200 Subject: [PATCH 1221/1352] fix bug: hadn't properly renamed the write_data method name --- volatility3/framework/plugins/parquet_renderer.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/parquet_renderer.py b/volatility3/framework/plugins/parquet_renderer.py index adc3a97e1..6564dbaeb 100644 --- a/volatility3/framework/plugins/parquet_renderer.py +++ b/volatility3/framework/plugins/parquet_renderer.py @@ -71,9 +71,9 @@ class ArrowRenderer(CLIRenderer): """Outputs the JSON data to a file in a particular format""" t = pa.Table.from_pylist(result, schema=schema) - self.write_data(t, outfd) + self.write_table(t, outfd) - def write_data(self, t: "pa.Table", outfd: TextIO) -> None: + def write_table(self, t: "pa.Table", outfd: TextIO) -> None: buf = pa.BufferOutputStream() writer = pa.ipc.new_stream(buf, t.schema) From 60c058548e9cbc718d73032cd7bc8aaa224112be Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 21 Jul 2025 20:43:00 +0200 Subject: [PATCH 1222/1352] use mnt_node instead of mnt_list --- volatility3/framework/symbols/linux/extensions/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 3b9a73e7c..e642c20ec 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1971,8 +1971,9 @@ class mnt_namespace(objects.StructType): self._context, self ) for node in self.mounts.get_nodes(): + # See kernel's node_to_mount() mnt = linux.LinuxUtilities.container_of( - node, "mount", "mnt_list", vmlinux + node, "mount", "mnt_node", vmlinux ) yield mnt else: From e7c1126b05996ecb3fd718ba559422d68c852023 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Mon, 21 Jul 2025 23:46:14 +0200 Subject: [PATCH 1223/1352] moved the arrow/parquet renderers to a subdir for renderers --- .../plugins/renderers/parquet_renderer.py | 173 ++++++++++++++++++ 1 file changed, 173 insertions(+) create mode 100644 volatility3/framework/plugins/renderers/parquet_renderer.py diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py new file mode 100644 index 000000000..c9ef95ee7 --- /dev/null +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -0,0 +1,173 @@ +# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# +import datetime +import logging +import sys +from typing import ( + Any, + Dict, + List, + Tuple, + TextIO, +) +from volatility3.framework import interfaces, renderers +from volatility3.framework.renderers import format_hints +from volatility3.cli.text_renderer import ( + CLIRenderer, + display_disassembly, + LayerDataRenderer, +) + +vollog = logging.getLogger(__name__) + +ARROW_PRESENT = False +try: + import pyarrow as pa + import pyarrow.parquet as pq + + ARROW_PRESENT = True +except ImportError: + vollog.debug("Arrow/Parquet libraries not found") + + +class ArrowRenderer(CLIRenderer): + """Renderer that outputs Arrow IPC format data.""" + + name = "arrow" + structured_output = True + _version = (1, 0, 0) + + def __init__( + self, options: List[interfaces.renderers.RenderOption] | None = None + ) -> None: + super().__init__(options) + + if not ARROW_PRESENT: + raise RuntimeError("Arrow output format requires the pyarrow package") + + self._to_arrow_type = { + renderers.Disassembly: pa.utf8, + bool: pa.bool_, + int: pa.int64, + float: pa.float64, + str: pa.utf8, + datetime.datetime: lambda: pa.timestamp("ms"), + format_hints.Bin: pa.int64, + format_hints.Hex: pa.int64, + format_hints.MultiTypeData: pa.utf8, + format_hints.HexBytes: pa.binary, + renderers.LayerData: pa.binary, + bytes: pa.binary, + } + + def get_render_options(self) -> List[interfaces.renderers.RenderOption]: + return [] + + def to_arrow_schema(self, grid: interfaces.renderers.TreeGrid) -> "pa.Schema": + fields = [] + for column in grid.columns: + arrow_type = self._to_arrow_type[column.type] + fields.append(pa.field(column.name, arrow_type())) + return pa.schema(fields) + + def output_result(self, schema: "pa.Schema", outfd: TextIO, result): + """Outputs the JSON data to a file in a particular format""" + + t = pa.Table.from_pylist(result, schema=schema) + self.write_table(t, outfd) + + def write_table(self, t: "pa.Table", outfd: TextIO) -> None: + buf = pa.BufferOutputStream() + + writer = pa.ipc.new_stream(buf, t.schema) + writer.write_table(t) + writer.close() + + # Get the buffer bytes and write to output + buf_bytes = buf.getvalue().to_pybytes() + outfd.buffer.write(buf_bytes) + + def render(self, grid: interfaces.renderers.TreeGrid): + outfd = sys.stdout + final_output: Tuple[ + Dict[str, List[interfaces.renderers.TreeNode]], + List[interfaces.renderers.TreeNode], + ] = ({}, []) + + ignore_columns = self.ignored_columns(grid) + + def visitor( + node: interfaces.renderers.TreeNode, + accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]], + ) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]: + # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case + acc_map, final_tree = accumulator + node_dict: Dict[str, Any] = {"__children": []} + line = [] + for column_index, column in enumerate(grid.columns): + if column in ignore_columns: + continue + + data = list(node.values)[column_index] + + if isinstance(data, interfaces.renderers.BaseAbsentValue): + data = None + + if isinstance(data, renderers.Disassembly): + data = display_disassembly(data) + + if isinstance(data, renderers.LayerData): + data = LayerDataRenderer().render_bytes(data)[0] + + node_dict[column.name] = data + line.append(data) + + if self.filter and self.filter.filter(line): + return accumulator + + if node.parent: + acc_map[node.parent.path]["__children"].append(node_dict) + else: + final_tree.append(node_dict) + acc_map[node.path] = node_dict + + return (acc_map, final_tree) + + if not grid.populated: + grid.populate(visitor, final_output) + else: + grid.visit(node=None, function=visitor, initial_accumulator=final_output) + + schema = self.to_arrow_schema(grid) + self.output_result(schema, outfd, final_output[1]) + + +class ParquetRenderer(ArrowRenderer): + """Renderer that outputs Parquet format data.""" + + name = "parquet" + structured_output = True + _version = (1, 0, 0) + + def get_render_options(self) -> List[interfaces.renderers.RenderOption]: + return [] + + def write_table(self, table: "pa.Table", outfd: TextIO) -> None: + """ + Writes a table to stdout using the Parquet format. + + Args: + t: The Arrow table to write + outfd: The output file descriptor + + Returns: + Nothing + """ + # Write DataFrame to a temporary file-like object + buf = pa.BufferOutputStream() + pq.write_table(table, buf, compression="snappy") + + # Get the buffer as a bytes object + buf_bytes = buf.getvalue().to_pybytes() + outfd.buffer.write(buf_bytes) From 6437148dc8d5d976e8f36a7b3e18780833de0716 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Mon, 21 Jul 2025 23:47:24 +0200 Subject: [PATCH 1224/1352] remove old parquet renderer --- .../framework/plugins/parquet_renderer.py | 166 ------------------ 1 file changed, 166 deletions(-) delete mode 100644 volatility3/framework/plugins/parquet_renderer.py diff --git a/volatility3/framework/plugins/parquet_renderer.py b/volatility3/framework/plugins/parquet_renderer.py deleted file mode 100644 index 6564dbaeb..000000000 --- a/volatility3/framework/plugins/parquet_renderer.py +++ /dev/null @@ -1,166 +0,0 @@ -# This file is Copyright 2019 Volatility Foundation and licensed under the Volatility Software License 1.0 -# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 -# -import datetime -import logging -import sys -from typing import ( - Any, - Dict, - List, - Tuple, - TextIO, -) -from volatility3.framework import interfaces, renderers -from volatility3.framework.renderers import format_hints -from volatility3.cli.text_renderer import ( - CLIRenderer, - display_disassembly, - LayerDataRenderer, -) - -vollog = logging.getLogger(__name__) - -try: - ARROW_PRESENT = True - import pyarrow as pa - import pyarrow.parquet as pq -except ImportError: - ARROW_PRESENT = False - vollog.debug("Arrow/Parquet libraries not found") - - -class ArrowRenderer(CLIRenderer): - def __init__( - self, options: List[interfaces.renderers.RenderOption] | None = None - ) -> None: - super().__init__(options) - - if not ARROW_PRESENT: - raise RuntimeError("Arrow output format requires the pyarrow package") - - self._to_arrow_type = { - renderers.Disassembly: pa.utf8, - bool: pa.bool_, - int: pa.int64, - float: pa.float64, - str: pa.utf8, - datetime.datetime: lambda: pa.timestamp("ms"), - format_hints.Bin: pa.int64, - format_hints.Hex: pa.int64, - format_hints.MultiTypeData: pa.utf8, - format_hints.HexBytes: pa.binary, - renderers.LayerData: pa.binary, - bytes: pa.binary, - } - - name = "arrow" - structured_output = True - - def get_render_options(self) -> List[interfaces.renderers.RenderOption]: - return [] - - def to_arrow_schema(self, grid: interfaces.renderers.TreeGrid) -> "pa.Schema": - fields = [] - for column in grid.columns: - arrow_type = self._to_arrow_type[column.type] - fields.append(pa.field(column.name, arrow_type())) - return pa.schema(fields) - - def output_result(self, schema: "pa.Schema", outfd: TextIO, result): - """Outputs the JSON data to a file in a particular format""" - - t = pa.Table.from_pylist(result, schema=schema) - self.write_table(t, outfd) - - def write_table(self, t: "pa.Table", outfd: TextIO) -> None: - buf = pa.BufferOutputStream() - - writer = pa.ipc.new_stream(buf, t.schema) - writer.write_table(t) - writer.close() - - # Get the buffer bytes and write to output - buf_bytes = buf.getvalue().to_pybytes() - outfd.buffer.write(buf_bytes) - - def render(self, grid: interfaces.renderers.TreeGrid): - outfd = sys.stdout - final_output: Tuple[ - Dict[str, List[interfaces.renderers.TreeNode]], - List[interfaces.renderers.TreeNode], - ] = ({}, []) - - ignore_columns = self.ignored_columns(grid) - - def visitor( - node: interfaces.renderers.TreeNode, - accumulator: Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]], - ) -> Tuple[Dict[str, Dict[str, Any]], List[Dict[str, Any]]]: - # Nodes always have a path value, giving them a path_depth of at least 1, we use max just in case - acc_map, final_tree = accumulator - node_dict: Dict[str, Any] = {"__children": []} - line = [] - for column_index, column in enumerate(grid.columns): - if column in ignore_columns: - continue - - data = list(node.values)[column_index] - - if isinstance(data, interfaces.renderers.BaseAbsentValue): - data = None - - if isinstance(data, renderers.Disassembly): - data = display_disassembly(data) - - if isinstance(data, renderers.LayerData): - data = LayerDataRenderer().render_bytes(data)[0] - - node_dict[column.name] = data - line.append(data) - - if self.filter and self.filter.filter(line): - return accumulator - - if node.parent: - acc_map[node.parent.path]["__children"].append(node_dict) - else: - final_tree.append(node_dict) - acc_map[node.path] = node_dict - - return (acc_map, final_tree) - - if not grid.populated: - grid.populate(visitor, final_output) - else: - grid.visit(node=None, function=visitor, initial_accumulator=final_output) - - schema = self.to_arrow_schema(grid) - self.output_result(schema, outfd, final_output[1]) - - -class ParquetRenderer(ArrowRenderer): - name = "parquet" - structured_output = True - - def get_render_options(self) -> List[interfaces.renderers.RenderOption]: - return [] - - def write_table(self, table: "pa.Table", outfd: TextIO) -> None: - """ - Writes a table to stdout using the Parquet format. - - Args: - t: The Arrow table to write - outfd: The output file descriptor - - Returns: - Nothing - """ - # Write DataFrame to a temporary file-like object - buf = pa.BufferOutputStream() - pq.write_table(table, buf, compression="snappy") - - # Get the buffer as a bytes object - buf_bytes = buf.getvalue().to_pybytes() - outfd.buffer.write(buf_bytes) From 11b312383c5bce78b9bb144a47e9ad47a6954f29 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Tue, 22 Jul 2025 10:09:55 +0200 Subject: [PATCH 1225/1352] fix: update data type mappings for format_hints.Bin and format_hints.Hex to pa.uint64 --- volatility3/framework/plugins/renderers/parquet_renderer.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py index c9ef95ee7..3d8f55ecb 100644 --- a/volatility3/framework/plugins/renderers/parquet_renderer.py +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -53,8 +53,8 @@ class ArrowRenderer(CLIRenderer): float: pa.float64, str: pa.utf8, datetime.datetime: lambda: pa.timestamp("ms"), - format_hints.Bin: pa.int64, - format_hints.Hex: pa.int64, + format_hints.Bin: pa.uint64, + format_hints.Hex: pa.uint64, format_hints.MultiTypeData: pa.utf8, format_hints.HexBytes: pa.binary, renderers.LayerData: pa.binary, From e7185b298f11345e8bbd9e41850e43813627ca03 Mon Sep 17 00:00:00 2001 From: tvanegro Date: Wed, 23 Jul 2025 11:06:20 +0200 Subject: [PATCH 1226/1352] PR comments --- .../framework/plugins/linux/malware/malfind.py | 7 +------ .../symbols/linux/extensions/__init__.py | 16 +++++++++++++--- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index b9a03c616..306bdc3b0 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -61,12 +61,7 @@ class Malfind(interfaces.plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] - # Allowing a dump_size of 0 (no dump) - dump_size = ( - self.config.get("dump-size") - if self.config.get("dump-size") is not None - else 64 - ) + dump_size = self.config.get("dump-size", None) or 64 # Dumping page defaults to off, as in case a whole r-xp region is dirty # this would likely dump 1000's of pages which might not always be wise nor necessary diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 99b2c989c..e48035102 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -1273,10 +1273,20 @@ class vm_area_struct(objects.StructType): except exceptions.InvalidAddressException: return None - def get_malicious_pages(self, proclayer=None): - """ - This function will return a list of all malicious pages inside a given dirty region + def get_malicious_pages(self, proclayer) -> List[int]: + """Identifies and returns a list of potentially malicious memory pages. + + A page is considered malicious if it is: + - Executable (protection flags match 'r-x') + - Dirty (modified since process start, according to proclayer.is_dirty()) + + Args: + proclayer: The process's memory layer + + Returns: + List[int]: A list of virtual addresses for pages flagged as potentially malicious. """ + malicious_pages = [] flags_str = self.get_protection() From 533b305afbb3a85a92e9f8466279cac38da4a1ed Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Sat, 2 Aug 2025 18:07:05 +0200 Subject: [PATCH 1227/1352] Added tests for the Parquet and Arrow renderers --- test/renderers/__init__.py | 0 test/renderers/test_parquet_renderers.py | 108 +++++++++++++++++++++++ 2 files changed, 108 insertions(+) create mode 100644 test/renderers/__init__.py create mode 100644 test/renderers/test_parquet_renderers.py diff --git a/test/renderers/__init__.py b/test/renderers/__init__.py new file mode 100644 index 000000000..e69de29bb diff --git a/test/renderers/test_parquet_renderers.py b/test/renderers/test_parquet_renderers.py new file mode 100644 index 000000000..b45a602aa --- /dev/null +++ b/test/renderers/test_parquet_renderers.py @@ -0,0 +1,108 @@ +import io +import pytest +from abc import ABC, abstractmethod +from test import test_volatility + +HAS_PYARROW = False +try: + import pyarrow as pa + import pyarrow.parquet as pq + import pyarrow.compute as pc + HAS_PYARROW = True +except ImportError: + pass + + +@pytest.mark.skipif(not HAS_PYARROW, reason="pyarrow not installed") +class TestArrowRendererBase(ABC): + """Base class for testing Arrow-based renderers. + + Re-implements Windows and Linux plugin tests using PyArrow operations + instead of text-based assertions. + """ + + renderer_format = None # Override in subclasses + + @abstractmethod + def _get_table_from_output(self, output_bytes) -> "pa.Table": + """Parse output bytes into Arrow table. Override in subclasses.""" + + def test_windows_generic_pslist(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.pslist.PsList", + image, + volatility, + python, + globalargs=("-r", self.renderer_format), + ) + assert rc == 0 + + table = self._get_table_from_output(out) + assert table.num_rows > 10 + + assert table.filter(pc.match_substring(pc.utf8_lower(table.column('ImageFileName')), "system")).num_rows > 0 + assert table.filter(pc.match_substring(pc.utf8_lower(table.column('ImageFileName')), "csrss.exe")).num_rows > 0 + assert table.filter(pc.match_substring(pc.utf8_lower(table.column('ImageFileName')), "svchost.exe")).num_rows > 0 + assert table.filter(pc.greater(table.column('PID'), 0)).num_rows == table.num_rows + + def test_linux_generic_pslist(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "linux.pslist.PsList", + image, + volatility, + python, + globalargs=("-r", self.renderer_format), + ) + assert rc == 0 + + table = self._get_table_from_output(out) + assert table.num_rows > 10 + + init_rows = table.filter(pc.match_substring(pc.utf8_lower(table.column('COMM')), "init")) + systemd_rows = table.filter(pc.match_substring(pc.utf8_lower(table.column('COMM')), "systemd")) + assert (init_rows.num_rows > 0) or (systemd_rows.num_rows > 0) + + assert table.filter(pc.match_substring(pc.utf8_lower(table.column('COMM')), "watchdog")).num_rows > 0 + assert table.filter(pc.greater(table.column('PID'), 0)).num_rows == table.num_rows + + def test_windows_generic_handles(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "windows.handles.Handles", + image, + volatility, + python, + globalargs=("-r", self.renderer_format), + pluginargs=("--pid", "4"), + ) + assert rc == 0 + + table = self._get_table_from_output(out) + assert table.num_rows > 500 + assert table.filter(pc.match_substring(pc.utf8_lower(table.column('Name')), "machine\\system")).num_rows > 0 + + def test_linux_generic_lsof(self, volatility, python, image): + rc, out, _err = test_volatility.runvol_plugin( + "linux.lsof.Lsof", + image, + volatility, + python, + globalargs=("-r", self.renderer_format), + ) + assert rc == 0 + + table = self._get_table_from_output(out) + assert table.num_rows > 35 + +class TestParquetRenderer(TestArrowRendererBase): + renderer_format = "parquet" + + def _get_table_from_output(self, output_bytes): + return pq.read_table(io.BytesIO(output_bytes)) + + +class TestArrowRenderer(TestArrowRendererBase): + renderer_format = "arrow" + + def _get_table_from_output(self, output_bytes): + return pa.ipc.open_stream(io.BytesIO(output_bytes)).read_all() + From eb7daa95a0e19c9022d78361420646d60b706107 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Wed, 6 Aug 2025 15:38:09 +0200 Subject: [PATCH 1228/1352] flatten tree output --- .../plugins/renderers/parquet_renderer.py | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py index 3d8f55ecb..b596349e4 100644 --- a/volatility3/framework/plugins/renderers/parquet_renderer.py +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -61,6 +61,11 @@ class ArrowRenderer(CLIRenderer): bytes: pa.binary, } + # indicates if the output from the plugin is nested, e.g., pstree + # which would then need to be flattened + self._is_tree_result = False + self._node_id_counter = 0 + def get_render_options(self) -> List[interfaces.renderers.RenderOption]: return [] @@ -69,11 +74,58 @@ class ArrowRenderer(CLIRenderer): for column in grid.columns: arrow_type = self._to_arrow_type[column.type] fields.append(pa.field(column.name, arrow_type())) + + # if the output is nested, e.g., windows.pstree + if self._is_tree_result: + fields.append(pa.field("_vol_id", pa.uint64())) + fields.append(pa.field("_vol_parent_id", pa.uint64())) + return pa.schema(fields) + + def _flatten_tree_structure(self, nested: list[dict]) -> list[dict]: + """ + Flattens a list of nested dicts using the `__children` key. + + Each node gets a `_vol_id` and a `_vol_parent_id` to preserve + the original tree structure in a flat format suitable for tabular output. + + Args: + nested: A list of dicts with optional `__children` lists (tree nodes). + + Returns: + A flat list of dicts with `_vol_id` and `_vol_parent_id`. + """ + rows = [] + self._node_id_counter = 0 + + def _process_node(node: dict, parent_id: int | None): + current_id = self._node_id_counter + self._node_id_counter += 1 + + entry = {k: v for k, v in node.items() if k != "__children"} + entry["_vol_id"] = current_id + entry["_vol_parent_id"] = parent_id + rows.append(entry) + + for child in node.get("__children", []): + _process_node(child, current_id) + + for root in nested: + _process_node(root, None) + + return rows + + + + def output_result(self, schema: "pa.Schema", outfd: TextIO, result): """Outputs the JSON data to a file in a particular format""" + + if self._is_tree_result: + result = self._flatten_tree_structure(result) + t = pa.Table.from_pylist(result, schema=schema) self.write_table(t, outfd) @@ -128,6 +180,7 @@ class ArrowRenderer(CLIRenderer): if node.parent: acc_map[node.parent.path]["__children"].append(node_dict) + self._is_tree_result = True else: final_tree.append(node_dict) acc_map[node.path] = node_dict From 3c830e6e67ab5e2e1743165ef21fc63e13bb3448 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Wed, 6 Aug 2025 15:43:46 +0200 Subject: [PATCH 1229/1352] black & ruff --- volatility3/framework/plugins/renderers/parquet_renderer.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py index b596349e4..7593fa4ef 100644 --- a/volatility3/framework/plugins/renderers/parquet_renderer.py +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -82,7 +82,6 @@ class ArrowRenderer(CLIRenderer): return pa.schema(fields) - def _flatten_tree_structure(self, nested: list[dict]) -> list[dict]: """ Flattens a list of nested dicts using the `__children` key. @@ -116,13 +115,9 @@ class ArrowRenderer(CLIRenderer): return rows - - - def output_result(self, schema: "pa.Schema", outfd: TextIO, result): """Outputs the JSON data to a file in a particular format""" - if self._is_tree_result: result = self._flatten_tree_structure(result) From 47219aad67283653b482eccb69d18b6aa8300748 Mon Sep 17 00:00:00 2001 From: blitztide Date: Fri, 29 Aug 2025 03:06:23 +0100 Subject: [PATCH 1230/1352] Feature: vadyarascan enrichment This add contextual data to each hit with vadyarascan, saves running pslist after processing. Original didn't have imagename or PPID --- .../framework/plugins/windows/vadyarascan.py | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 04b9aadd9..452a2f774 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -4,6 +4,7 @@ import logging from typing import Iterable, List, Tuple +import datetime from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements @@ -102,6 +103,15 @@ class VadYaraScan(interfaces.plugins.PluginInterface): yield 0, ( format_hints.Hex(offset), task.UniqueProcessId, + task.get_create_time(), + task.InheritedFromUniqueProcessId, + task.ImageFileName.cast( + "string", + max_length=task.ImageFileName.vol.count, + errors="replace", + ), + task.get_session_id(), + task.ActiveThreads, rule_name, name, layer_data, @@ -130,6 +140,11 @@ class VadYaraScan(interfaces.plugins.PluginInterface): [ ("Offset", format_hints.Hex), ("PID", int), + ("CreateTime", datetime.datetime), + ("PPID", int), + ("ImageFileName", str), + ("SessionId", int), + ("Threads", int), ("Rule", str), ("Component", str), ("Value", renderers.LayerData), From 4012887e75457df98c93feb4d44ebb6ac3827fd8 Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Thu, 4 Sep 2025 14:50:30 -0500 Subject: [PATCH 1231/1352] #1780 - cast LoadCount --- .../framework/symbols/windows/extensions/__init__.py | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/windows/extensions/__init__.py b/volatility3/framework/symbols/windows/extensions/__init__.py index 61138a78c..f32415124 100755 --- a/volatility3/framework/symbols/windows/extensions/__init__.py +++ b/volatility3/framework/symbols/windows/extensions/__init__.py @@ -1715,13 +1715,11 @@ class SHARED_CACHE_MAP(objects.StructType): class LDR_DATA_TABLE_ENTRY(objects.StructType): def get_load_count(self) -> Optional[int]: try: - LoadCount = self.LoadCount + LoadCount = self.LoadCount.cast("short") except Exception: try: - LoadCount = self.ObsoleteLoadCount + LoadCount = self.ObsoleteLoadCount.cast("short") except Exception: LoadCount = None - if LoadCount == 65535: - LoadCount = -1 return LoadCount From d6a791cb675574c6cc35d68cf2e6932f6fe525ce Mon Sep 17 00:00:00 2001 From: blitztide Date: Thu, 4 Sep 2025 22:39:46 +0100 Subject: [PATCH 1232/1352] VadYaraScan: Increment version --- volatility3/framework/plugins/windows/vadyarascan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index 452a2f774..bbbe49f2d 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -19,7 +19,7 @@ class VadYaraScan(interfaces.plugins.PluginInterface): """Scans all the Virtual Address Descriptor memory maps using yara.""" _required_framework_version = (2, 22, 0) - _version = (1, 1, 3) + _version = (1, 1, 4) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From d21a81d8c328af72a7bb85edb89eaadf7ec1ff64 Mon Sep 17 00:00:00 2001 From: Kyrre-Wahl-Kongsgard Date: Fri, 5 Sep 2025 06:55:00 +0200 Subject: [PATCH 1233/1352] fix: update type hints to support Python 3.8 --- .../framework/plugins/renderers/parquet_renderer.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py index 7593fa4ef..7bc4b82ab 100644 --- a/volatility3/framework/plugins/renderers/parquet_renderer.py +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -8,6 +8,7 @@ from typing import ( Any, Dict, List, + Optional, Tuple, TextIO, ) @@ -39,7 +40,7 @@ class ArrowRenderer(CLIRenderer): _version = (1, 0, 0) def __init__( - self, options: List[interfaces.renderers.RenderOption] | None = None + self, options: Optional[List[interfaces.renderers.RenderOption]] = None ) -> None: super().__init__(options) @@ -82,7 +83,7 @@ class ArrowRenderer(CLIRenderer): return pa.schema(fields) - def _flatten_tree_structure(self, nested: list[dict]) -> list[dict]: + def _flatten_tree_structure(self, nested: List[Dict]) -> List[Dict]: """ Flattens a list of nested dicts using the `__children` key. @@ -98,7 +99,7 @@ class ArrowRenderer(CLIRenderer): rows = [] self._node_id_counter = 0 - def _process_node(node: dict, parent_id: int | None): + def _process_node(node: Dict, parent_id: Optional[int]): current_id = self._node_id_counter self._node_id_counter += 1 From 88c8bfe1ad30b7e8cdf0cd4aff03a80e119ce5cb Mon Sep 17 00:00:00 2001 From: Dave Lassalle Date: Fri, 5 Sep 2025 13:19:51 -0500 Subject: [PATCH 1234/1352] #1780 - bump versions --- volatility3/framework/constants/_version.py | 4 ++-- volatility3/framework/plugins/windows/dlllist.py | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 07b9e45ec..7f71c277e 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change -VERSION_MINOR = 26 # Number of changes that only add to the interface -VERSION_PATCH = 2 # Number of changes that do not change the interface +VERSION_MINOR = 27 # Number of changes that only add to the interface +VERSION_PATCH = 0 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( diff --git a/volatility3/framework/plugins/windows/dlllist.py b/volatility3/framework/plugins/windows/dlllist.py index 1e8ecd414..cb9d3b8bf 100644 --- a/volatility3/framework/plugins/windows/dlllist.py +++ b/volatility3/framework/plugins/windows/dlllist.py @@ -22,7 +22,7 @@ class DllList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): """Lists the loaded DLLs in a particular windows memory image.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 0) + _version = (3, 0, 1) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From bec2fb4c7f220daf4ebc0cbad51b3d2cbf914d17 Mon Sep 17 00:00:00 2001 From: j-t-1 <120829237+j-t-1@users.noreply.github.com> Date: Sat, 6 Sep 2025 10:09:28 +0100 Subject: [PATCH 1235/1352] Add newlines to README.md Purely for readability. --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index cf735fc8d..79401a18f 100644 --- a/README.md +++ b/README.md @@ -66,13 +66,17 @@ pip install -e ".[dev]" Symbol table packs for the various operating systems are available for download at: + + The hashes to verify whether any of the symbol pack files have downloaded successfully or have changed can be found at: + + Symbol tables zip files must be placed, as named, into the `volatility3/symbols` directory (or just the symbols directory next to the executable file). From 86fe4485f0abcb4c10a2f07ae369dfbaa02d1f4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kyrre=20Wahl=20Kongsg=C3=A5rd?= Date: Mon, 15 Sep 2025 09:31:20 +0200 Subject: [PATCH 1236/1352] Update volatility3/framework/plugins/renderers/parquet_renderer.py Co-authored-by: ikelos --- volatility3/framework/plugins/renderers/parquet_renderer.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py index 7bc4b82ab..ff2e07aea 100644 --- a/volatility3/framework/plugins/renderers/parquet_renderer.py +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -14,11 +14,7 @@ from typing import ( ) from volatility3.framework import interfaces, renderers from volatility3.framework.renderers import format_hints -from volatility3.cli.text_renderer import ( - CLIRenderer, - display_disassembly, - LayerDataRenderer, -) +from volatility3.cli import text_renderer vollog = logging.getLogger(__name__) From 4c7a9b517f45a50e58f5321ad041871ece98386a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kyrre=20Wahl=20Kongsg=C3=A5rd?= Date: Mon, 15 Sep 2025 09:31:28 +0200 Subject: [PATCH 1237/1352] Update volatility3/framework/plugins/renderers/parquet_renderer.py Co-authored-by: ikelos --- volatility3/framework/plugins/renderers/parquet_renderer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py index ff2e07aea..197944b85 100644 --- a/volatility3/framework/plugins/renderers/parquet_renderer.py +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -159,7 +159,7 @@ class ArrowRenderer(CLIRenderer): data = None if isinstance(data, renderers.Disassembly): - data = display_disassembly(data) + data = text_renderer.display_disassembly(data) if isinstance(data, renderers.LayerData): data = LayerDataRenderer().render_bytes(data)[0] From 4af48ae3b0c10911c8da526154da02fff2560373 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kyrre=20Wahl=20Kongsg=C3=A5rd?= Date: Mon, 15 Sep 2025 09:31:34 +0200 Subject: [PATCH 1238/1352] Update volatility3/framework/plugins/renderers/parquet_renderer.py Co-authored-by: ikelos --- volatility3/framework/plugins/renderers/parquet_renderer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py index 197944b85..4e8a4c043 100644 --- a/volatility3/framework/plugins/renderers/parquet_renderer.py +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -28,7 +28,7 @@ except ImportError: vollog.debug("Arrow/Parquet libraries not found") -class ArrowRenderer(CLIRenderer): +class ArrowRenderer(text_renderer.CLIRenderer): """Renderer that outputs Arrow IPC format data.""" name = "arrow" From 8090d72149f7b64c2512ef0370d4dfcd61bbb442 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kyrre=20Wahl=20Kongsg=C3=A5rd?= Date: Mon, 15 Sep 2025 09:32:10 +0200 Subject: [PATCH 1239/1352] Update volatility3/framework/plugins/renderers/parquet_renderer.py Co-authored-by: ikelos --- volatility3/framework/plugins/renderers/parquet_renderer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/renderers/parquet_renderer.py b/volatility3/framework/plugins/renderers/parquet_renderer.py index 4e8a4c043..f4eaf9c9b 100644 --- a/volatility3/framework/plugins/renderers/parquet_renderer.py +++ b/volatility3/framework/plugins/renderers/parquet_renderer.py @@ -162,7 +162,7 @@ class ArrowRenderer(text_renderer.CLIRenderer): data = text_renderer.display_disassembly(data) if isinstance(data, renderers.LayerData): - data = LayerDataRenderer().render_bytes(data)[0] + data = text_renderer.LayerDataRenderer().render_bytes(data)[0] node_dict[column.name] = data line.append(data) From 81f2e7376ad93a94930de6b11ea99e646229dc22 Mon Sep 17 00:00:00 2001 From: ikelos Date: Mon, 15 Sep 2025 08:58:04 +0100 Subject: [PATCH 1240/1352] Update test/renderers/test_parquet_renderers.py --- test/renderers/test_parquet_renderers.py | 1 + 1 file changed, 1 insertion(+) diff --git a/test/renderers/test_parquet_renderers.py b/test/renderers/test_parquet_renderers.py index b45a602aa..aa5474636 100644 --- a/test/renderers/test_parquet_renderers.py +++ b/test/renderers/test_parquet_renderers.py @@ -10,6 +10,7 @@ try: import pyarrow.compute as pc HAS_PYARROW = True except ImportError: + # The user doesn't have pyarrow installed, but HAS_PYARROW will be false so just continue pass From 1a1f3be633175b785ca30063e4daa545e8066182 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 15 Sep 2025 00:26:58 +0100 Subject: [PATCH 1241/1352] Swap ObjectInformation from namedtuple to dataclass --- volatility3/framework/interfaces/objects.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 2d8024465..e2ba8f380 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -7,6 +7,7 @@ import abc import collections import collections.abc import contextlib +import dataclasses import logging from typing import Any, Dict, List, Mapping, NamedTuple, Optional @@ -52,7 +53,8 @@ class ReadOnlyMapping(collections.abc.Mapping): return dict(self) == dict(other) -class ObjectInformation(NamedTuple): +@dataclasses.dataclass +class ObjectInformation: """Contains common information useful/pertinent only to an individual object (like an instance) @@ -71,12 +73,12 @@ class ObjectInformation(NamedTuple): size: Optional[int] = None def __getitem__(self, key): - if key in self._fields: + if key in self: return getattr(self, key) - raise KeyError(f"NamedTuple does not have a key {key}") + raise KeyError(f"No {key} present in ObjectInformation") def __contains__(self, key): - return key in self._fields + return key in [field.name for field in dataclasses.fields(self)] class ObjectInterface(metaclass=abc.ABCMeta): From 2a2f27a3999090d4f85256016081b5671f7276d1 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 15 Sep 2025 00:31:14 +0100 Subject: [PATCH 1242/1352] Fix ruff issue --- volatility3/framework/interfaces/objects.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index e2ba8f380..92ee5f7dc 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -9,7 +9,7 @@ import collections.abc import contextlib import dataclasses import logging -from typing import Any, Dict, List, Mapping, NamedTuple, Optional +from typing import Any, Dict, List, Mapping, Optional from volatility3.framework import constants, interfaces From 207941759dc47d14fc020701fae7053dbda78dac Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sun, 1 Jun 2025 19:38:04 +0300 Subject: [PATCH 1243/1352] pebmasquerade plugin --- .../plugins/windows/pebmasquerade.py | 328 ++++++++++++++++++ 1 file changed, 328 insertions(+) create mode 100644 volatility3/framework/plugins/windows/pebmasquerade.py diff --git a/volatility3/framework/plugins/windows/pebmasquerade.py b/volatility3/framework/plugins/windows/pebmasquerade.py new file mode 100644 index 000000000..dc5293271 --- /dev/null +++ b/volatility3/framework/plugins/windows/pebmasquerade.py @@ -0,0 +1,328 @@ +import logging +import re +from pathlib import PureWindowsPath +from typing import List, Union, Tuple + +from volatility3.framework import interfaces, renderers, exceptions +from volatility3.framework.configuration import requirements +from volatility3.plugins.windows import pslist + +vollog = logging.getLogger(__name__) + + +# https://www.ired.team/offensive-security/defense-evasion/masquerading-processes-in-userland-through-_peb +# https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/Masquerade-PEB.ps1 +class PebMasquerade(interfaces.plugins.PluginInterface): + """Detects potential process name spoofing by comparing EPROCESS and PEB data.""" + + _version = (1, 0, 0) + _required_framework_version = (2, 0, 0) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.ModuleRequirement( + name="kernel", + description="Windows kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(3, 0, 0) + ), + requirements.ListRequirement( + name="pid", + element_type=int, + description="Process ID to include (all other processes are excluded)", + optional=True, + ), + ] + + @staticmethod + def _get_cmdline_image(cmdline: str) -> Union[str, PureWindowsPath]: + """Extract the executable path from a command line string. + + Args: + cmdline (str): The command line string to parse. + + Returns: + Union[str, PureWindowsPath]: The executable path as a string or PureWindowsPath. + """ + if not cmdline: + return "" + + # Regex to extract first .exe ending string (handles quotes, paths, no quotes) + match = re.search(r'(?i)(["\']?)([^"\']*?\.exe)\1(?=\s|$)', cmdline) + if match: + exe_path = match.group(2) + return PureWindowsPath(exe_path) + + # If no .exe found, extract the first token (handles quotes) + # Matches either "quoted string" or unquoted word + first_token_match = re.match(r'\s*(?:"([^"]+)"|\'([^\']+)\'|(\S+))', cmdline) + if first_token_match: + # Extract whichever group matched + executable = ( + first_token_match.group(1) + or first_token_match.group(2) + or first_token_match.group(3) + ) + return PureWindowsPath(executable).name + ".exe" + + return "" + + @staticmethod + def _are_paths_equal(device_path: str, drive_path: str) -> Tuple[bool, str, str]: + """Compare two paths to see if they are equal, ignoring drive/device root and case. + + Args: + device_path (str): The device path (e.g. "\\Device\\HarddiskVolume1\\path") + drive_path (str): The drive path (e.g. "C:\\path") + + Returns: + tuple: (are_equal, device_path_without_drive, drive_path_without_drive) + - are_equal (bool): True if paths are equal, False otherwise + - device_path_without_drive (str): Device path without drive letter + - drive_path_without_drive (str): Drive path without drive letter + """ + pure_device_path = PureWindowsPath(device_path) + pure_drive_path = PureWindowsPath(drive_path) + device_parts = list(pure_device_path.parts) + drive_parts = list(pure_drive_path.parts) + + if pure_drive_path.is_absolute(): + new_drive_path = "/".join(drive_parts[1:]).lower() + new_device_path = "/".join(device_parts[3:]).lower() + else: + new_drive_path = "/".join(drive_parts[2:]).lower() + new_device_path = "/".join(device_parts[4:]).lower() + + return ( + new_drive_path == new_device_path, + new_device_path, + new_drive_path, + ) + + def get_process_names(self, proc: interfaces.objects.ObjectInterface) -> Tuple[ + Union[str, renderers.NotAvailableValue], + Union[str, renderers.NotAvailableValue], + Union[str, renderers.NotAvailableValue], + Union[str, renderers.NotAvailableValue], + ]: + """Extract process names and related information from various sources (EPROCESS and PEB). + + Args: + proc: The process object + + Returns: + tuple: (eprocess_imagefilename, eprocess_seaudit_imagefilename, peb_imagefilepath, peb_cmdline) + """ + eprocess_imagefilename = renderers.NotAvailableValue() + eprocess_seaudit_imagefilename = renderers.NotAvailableValue() + peb_imagefilepath = renderers.NotAvailableValue() + peb_cmdline = renderers.NotAvailableValue() + + try: + eprocess_imagefilename = proc.ImageFileName.cast( + "string", + max_length=proc.ImageFileName.vol.count, + errors="replace", + ) + except (AttributeError, exceptions.InvalidAddressException): + vollog.debug( + "Unable to read EPROCESS.ImageFileName for PID %d", proc.UniqueProcessId + ) + except Exception as e: + vollog.warning( + "Error reading EPROCESS.ImageFileName for PID %d: %s", + proc.UniqueProcessId, + str(e)[:50], + ) + + try: + audit = proc.SeAuditProcessCreationInfo.ImageFileName.Name + audit_string = audit.get_string() + if audit_string: + eprocess_seaudit_imagefilename = audit_string + except exceptions.InvalidAddressException: + vollog.debug( + "Unable to read SeAuditProcessCreationInfo.ImageFileName for PID %d", + proc.UniqueProcessId, + ) + except AttributeError: + vollog.debug( + "SeAuditProcessCreationInfo structure not available for PID %d", + proc.UniqueProcessId, + ) + except Exception as e: + vollog.warning( + "Error reading SeAuditProcessCreationInfo for PID %d: %s", + proc.UniqueProcessId, + str(e)[:50], + ) + + try: + peb = proc.get_peb() + if peb and peb.ProcessParameters: + # Get ImagePathName + try: + image_path_str = peb.ProcessParameters.ImagePathName.get_string() + if image_path_str: + peb_imagefilepath = image_path_str + except (AttributeError, exceptions.InvalidAddressException): + vollog.debug( + "Unable to read PEB.ImagePathName for PID %d", + proc.UniqueProcessId, + ) + except Exception as e: + vollog.warning( + "Error reading PEB.ImagePathName for PID %d: %s", + proc.UniqueProcessId, + str(e)[:50], + ) + + try: + cmdline_str = peb.ProcessParameters.CommandLine.get_string() + if cmdline_str: + peb_cmdline = cmdline_str + except (AttributeError, exceptions.InvalidAddressException): + vollog.debug( + "Unable to read PEB.ProcessParameters.CommandLine for PID %d", + proc.UniqueProcessId, + ) + except Exception as e: + vollog.warning( + "Error reading PEB.ProcessParameters.CommandLine for PID %d: %s", + proc.UniqueProcessId, + str(e)[:50], + ) + except (AttributeError, exceptions.InvalidAddressException): + # Important for cases where PEB does not exist or is inaccessible (e.g SYSTEM process) + vollog.debug("Unable to access PEB for PID %d", proc.UniqueProcessId) + except Exception as e: + vollog.warning( + "Error accessing PEB for PID %d: %s", proc.UniqueProcessId, str(e)[:50] + ) + + return ( + eprocess_imagefilename, + eprocess_seaudit_imagefilename, + peb_imagefilepath, + peb_cmdline, + ) + + def _generator(self): + pid_filter = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + + for proc in pslist.PsList.list_processes( + context=self.context, + kernel_module_name=self.config["kernel"], + filter_func=pid_filter, + ): + proc_id = proc.UniqueProcessId + notes = [] + + ( + eprocess_imagefilename, + eprocess_seaudit_imagefilename, + peb_imagefilepath, + peb_cmdline, + ) = self.get_process_names(proc) + proc_name_for_row = eprocess_imagefilename + + # Extract command line executable path for rendering + peb_cmdline_path_render = renderers.NotAvailableValue() + if isinstance(peb_cmdline, str): + try: + peb_cmdline_path_render = str( + PebMasquerade._get_cmdline_image(peb_cmdline) + ) + except Exception as e: + vollog.debug( + "Error extracting command line path for PID %d: %s", + proc_id, + str(e)[:50], + ) + + # Populate notes for enrichment + if isinstance(eprocess_imagefilename, str) and isinstance( + peb_imagefilepath, str + ): + try: + peb_imagefilepath_basename = PureWindowsPath(peb_imagefilepath).name + peb_imagefilepath_truncated = peb_imagefilepath_basename[:14] + + # Compare EPROCESS.ImageFileName with PEB.ImageFilePath truncated to 15 characters + if ( + eprocess_imagefilename.lower() + != peb_imagefilepath_truncated.lower() + ): + notes.append( + f"'Potential PEB.ImageFilePath Spoofing: EPROCESS={eprocess_imagefilename};PEB={peb_imagefilepath_truncated}'" + ) + except Exception as e: + notes.append(f"ImageFilePath Comparison error: {str(e)[:30]}") + + if isinstance(eprocess_imagefilename, str) and isinstance(peb_cmdline, str): + try: + # Compare EPROCESS.ImageFileName with PEB.CommandLine executable path truncated to 15 characters + peb_cmdline_path = PebMasquerade._get_cmdline_image(peb_cmdline) + if isinstance(peb_cmdline_path, PureWindowsPath): + peb_cmdline_path = peb_cmdline_path.name + peb_cmdline_basename_truncated = peb_cmdline_path[:14] + if ( + eprocess_imagefilename.lower() + != peb_cmdline_basename_truncated.lower() + ): + notes.append( + f"'Potential PEB.CommandLine Spoofing: EPROCESS={eprocess_imagefilename};PEB={peb_cmdline_basename_truncated}'" + ) + except Exception as e: + notes.append(f"CommandLine comparison error: {str(e)}") + + if isinstance(eprocess_seaudit_imagefilename, str) and isinstance( + peb_imagefilepath, str + ): + try: + ( + are_equal, + eprocess_seaudit_normalized, + peb_imagefilepath_normalized, + ) = PebMasquerade._are_paths_equal( + device_path=eprocess_seaudit_imagefilename, + drive_path=peb_imagefilepath, + ) + if not are_equal: + notes.append( + f"'Potential PEB.ImageFilePath Spoofing (via _EPROCESS.SeAuditProcessCreationInfo): EPROCESS={eprocess_seaudit_normalized};PEB={peb_imagefilepath_normalized}'" + ) + except Exception as e: + notes.append( + f"SeAuditProcessCreationInfo comparison error: {str(e)[:30]}" + ) + + yield ( + 0, + ( + proc_id, + proc_name_for_row, + eprocess_imagefilename, + eprocess_seaudit_imagefilename, + peb_imagefilepath, + peb_cmdline_path_render, + "[" + ", ".join(notes) + "]" if notes else "OK", + ), + ) + + def run(self): + return renderers.TreeGrid( + [ + ("PID", int), + ("ProcessName", str), + ("EPROCESS_ImageFileName", str), + ("EPROCESS_SeAudit_ImageFileName", str), + ("PEB_ImageFilePath", str), + ("PEB_CommandLine_Path", str), + ("Notes", str), + ], + self._generator(), + ) From 72f0bd1bbafe69cc6695985a13aded63d7edc576 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Fri, 6 Jun 2025 17:22:39 +0300 Subject: [PATCH 1244/1352] UNICODE_STRING length checks to further detect spoofing --- .../plugins/windows/pebmasquerade.py | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/volatility3/framework/plugins/windows/pebmasquerade.py b/volatility3/framework/plugins/windows/pebmasquerade.py index dc5293271..c1bfca67f 100644 --- a/volatility3/framework/plugins/windows/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/pebmasquerade.py @@ -219,6 +219,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface): filter_func=pid_filter, ): proc_id = proc.UniqueProcessId + try: + peb = proc.get_peb() + except (exceptions.InvalidAddressException, AttributeError): + vollog.debug( + "Unable to access PEB for PID %d, skipping process", proc_id + ) notes = [] ( @@ -300,6 +306,46 @@ class PebMasquerade(interfaces.plugins.PluginInterface): f"SeAuditProcessCreationInfo comparison error: {str(e)[:30]}" ) + if isinstance(peb_imagefilepath, str) and peb: + try: + + # Length values are of type USHORT + peb_imagefilepath_length = ( + peb.ProcessParameters.ImagePathName.Length // 2 + ) + peb_imagefilepath_maxlength = ( + peb.ProcessParameters.ImagePathName.MaximumLength // 2 - 1 + ) + + if (peb_imagefilepath_length != len(peb_imagefilepath)) or ( + peb_imagefilepath_maxlength != len(peb_imagefilepath) + ): + notes.append( + f"'PEB.ImageFilePath Length Mismatch: Length={peb_imagefilepath_length}, MaximumLength={peb_imagefilepath_maxlength}, Actual={len(peb_imagefilepath)}'" + ) + except Exception as e: + notes.append( + f"PEB.ImageFilePath Length comparison error: {str(e)[:30]}" + ) + + if isinstance(peb_cmdline, str) and peb: + try: + # Length values are of type USHORT + peb_cmdline_length = peb.ProcessParameters.CommandLine.Length // 2 + peb_cmdline_maxlength = ( + peb.ProcessParameters.CommandLine.MaximumLength // 2 - 1 + ) + + if (peb_cmdline_length != len(peb_cmdline)) or ( + peb_cmdline_maxlength != len(peb_cmdline) + ): + notes.append( + f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'" + ) + except Exception as e: + notes.append( + f"PEB.CommandLine Length comparison error: {str(e)[:30]}" + ) yield ( 0, ( From 231033428df243efe16a60cd2daafef02c4ccfc7 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Fri, 6 Jun 2025 18:26:47 +0300 Subject: [PATCH 1245/1352] replace to utility function --- volatility3/framework/plugins/windows/pebmasquerade.py | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/plugins/windows/pebmasquerade.py b/volatility3/framework/plugins/windows/pebmasquerade.py index c1bfca67f..78676bc0d 100644 --- a/volatility3/framework/plugins/windows/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/pebmasquerade.py @@ -5,6 +5,7 @@ from typing import List, Union, Tuple from volatility3.framework import interfaces, renderers, exceptions from volatility3.framework.configuration import requirements +from volatility3.framework.objects import utility from volatility3.plugins.windows import pslist vollog = logging.getLogger(__name__) @@ -122,11 +123,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): peb_cmdline = renderers.NotAvailableValue() try: - eprocess_imagefilename = proc.ImageFileName.cast( - "string", - max_length=proc.ImageFileName.vol.count, - errors="replace", - ) + eprocess_imagefilename = utility.array_to_string(proc.ImageFileName) except (AttributeError, exceptions.InvalidAddressException): vollog.debug( "Unable to read EPROCESS.ImageFileName for PID %d", proc.UniqueProcessId From 22ea3d55428cfde26a8ae7c4307b597696e9a9ce Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 13:35:27 +0300 Subject: [PATCH 1246/1352] moved to malware category --- .../framework/plugins/windows/{ => malware}/pebmasquerade.py | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename volatility3/framework/plugins/windows/{ => malware}/pebmasquerade.py (100%) diff --git a/volatility3/framework/plugins/windows/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py similarity index 100% rename from volatility3/framework/plugins/windows/pebmasquerade.py rename to volatility3/framework/plugins/windows/malware/pebmasquerade.py From 156ca005ded0bc0abc00e9da8ef6e0eca703333c Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 21:56:19 +0300 Subject: [PATCH 1247/1352] changed staticmethods to classmethods --- .../framework/plugins/windows/malware/pebmasquerade.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index 78676bc0d..be54300ff 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -38,8 +38,8 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ), ] - @staticmethod - def _get_cmdline_image(cmdline: str) -> Union[str, PureWindowsPath]: + @classmethod + def _get_cmdline_image(cls, cmdline: str) -> Union[str, PureWindowsPath]: """Extract the executable path from a command line string. Args: @@ -71,8 +71,10 @@ class PebMasquerade(interfaces.plugins.PluginInterface): return "" - @staticmethod - def _are_paths_equal(device_path: str, drive_path: str) -> Tuple[bool, str, str]: + @classmethod + def _are_paths_equal( + cls, device_path: str, drive_path: str + ) -> Tuple[bool, str, str]: """Compare two paths to see if they are equal, ignoring drive/device root and case. Args: From 36ce047ec0e1e41a2c2340381a0d62871027e4ed Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 22:01:49 +0300 Subject: [PATCH 1248/1352] PEBMASQ: return None instead of empty string --- volatility3/framework/plugins/windows/malware/pebmasquerade.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index be54300ff..72b138bae 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -49,7 +49,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): Union[str, PureWindowsPath]: The executable path as a string or PureWindowsPath. """ if not cmdline: - return "" + return None # Regex to extract first .exe ending string (handles quotes, paths, no quotes) match = re.search(r'(?i)(["\']?)([^"\']*?\.exe)\1(?=\s|$)', cmdline) From f79a6d6643da54777dce147a8c4af4b1d3094c7b Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 22:10:43 +0300 Subject: [PATCH 1249/1352] PEBMASQ: parameterize _generator --- .../framework/plugins/windows/malware/pebmasquerade.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index 72b138bae..2e1e47b39 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -209,8 +209,8 @@ class PebMasquerade(interfaces.plugins.PluginInterface): peb_cmdline, ) - def _generator(self): - pid_filter = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + def _generator(self, pids): + pid_filter = pslist.PsList.create_pid_filter(pids) for proc in pslist.PsList.list_processes( context=self.context, @@ -359,6 +359,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ) def run(self): + pids = self.config.get("pid", None) return renderers.TreeGrid( [ ("PID", int), @@ -369,5 +370,5 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ("PEB_CommandLine_Path", str), ("Notes", str), ], - self._generator(), + self._generator(pids), ) From bcc6ce68c51a4ed6fd287813ddd84b5e800152f9 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 22:13:52 +0300 Subject: [PATCH 1250/1352] PEBMASQ: parameterize _generator v2 --- .../framework/plugins/windows/malware/pebmasquerade.py | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index 2e1e47b39..e4bd219e2 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -209,12 +209,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface): peb_cmdline, ) - def _generator(self, pids): + def _generator(self, pids, context, kernel_module_name): pid_filter = pslist.PsList.create_pid_filter(pids) for proc in pslist.PsList.list_processes( - context=self.context, - kernel_module_name=self.config["kernel"], + context=context, + kernel_module_name=kernel_module_name, filter_func=pid_filter, ): proc_id = proc.UniqueProcessId @@ -360,6 +360,8 @@ class PebMasquerade(interfaces.plugins.PluginInterface): def run(self): pids = self.config.get("pid", None) + context = self.context + kernel_module_name = self.config["kernel"] return renderers.TreeGrid( [ ("PID", int), @@ -370,5 +372,5 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ("PEB_CommandLine_Path", str), ("Notes", str), ], - self._generator(pids), + self._generator(pids, context, kernel_module_name), ) From 4adc3305a3883f33d3751ed4f6c21cf5fbcf5366 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Thu, 12 Jun 2025 20:04:49 +0300 Subject: [PATCH 1251/1352] remove error truncate --- .../plugins/windows/malware/pebmasquerade.py | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index e4bd219e2..8c6c0b4b0 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -134,7 +134,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): vollog.warning( "Error reading EPROCESS.ImageFileName for PID %d: %s", proc.UniqueProcessId, - str(e)[:50], + str(e), ) try: @@ -156,7 +156,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): vollog.warning( "Error reading SeAuditProcessCreationInfo for PID %d: %s", proc.UniqueProcessId, - str(e)[:50], + str(e), ) try: @@ -176,7 +176,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): vollog.warning( "Error reading PEB.ImagePathName for PID %d: %s", proc.UniqueProcessId, - str(e)[:50], + str(e), ) try: @@ -192,14 +192,14 @@ class PebMasquerade(interfaces.plugins.PluginInterface): vollog.warning( "Error reading PEB.ProcessParameters.CommandLine for PID %d: %s", proc.UniqueProcessId, - str(e)[:50], + str(e), ) except (AttributeError, exceptions.InvalidAddressException): # Important for cases where PEB does not exist or is inaccessible (e.g SYSTEM process) vollog.debug("Unable to access PEB for PID %d", proc.UniqueProcessId) except Exception as e: vollog.warning( - "Error accessing PEB for PID %d: %s", proc.UniqueProcessId, str(e)[:50] + "Error accessing PEB for PID %d: %s", proc.UniqueProcessId, str(e) ) return ( @@ -245,7 +245,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): vollog.debug( "Error extracting command line path for PID %d: %s", proc_id, - str(e)[:50], + str(e), ) # Populate notes for enrichment From 32def71eb5a42d44709a2a1477194c8f2f61215a Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 22 Jul 2025 21:34:55 +0300 Subject: [PATCH 1252/1352] remove notes --- .../plugins/windows/malware/pebmasquerade.py | 86 ++++--------------- 1 file changed, 16 insertions(+), 70 deletions(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index 8c6c0b4b0..cc3ee73bc 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -225,14 +225,14 @@ class PebMasquerade(interfaces.plugins.PluginInterface): "Unable to access PEB for PID %d, skipping process", proc_id ) notes = [] - + peb_imagefilepath_length_check = False + peb_cmdline_length_check = False ( eprocess_imagefilename, eprocess_seaudit_imagefilename, peb_imagefilepath, peb_cmdline, ) = self.get_process_names(proc) - proc_name_for_row = eprocess_imagefilename # Extract command line executable path for rendering peb_cmdline_path_render = renderers.NotAvailableValue() @@ -248,63 +248,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface): str(e), ) - # Populate notes for enrichment - if isinstance(eprocess_imagefilename, str) and isinstance( - peb_imagefilepath, str - ): - try: - peb_imagefilepath_basename = PureWindowsPath(peb_imagefilepath).name - peb_imagefilepath_truncated = peb_imagefilepath_basename[:14] - - # Compare EPROCESS.ImageFileName with PEB.ImageFilePath truncated to 15 characters - if ( - eprocess_imagefilename.lower() - != peb_imagefilepath_truncated.lower() - ): - notes.append( - f"'Potential PEB.ImageFilePath Spoofing: EPROCESS={eprocess_imagefilename};PEB={peb_imagefilepath_truncated}'" - ) - except Exception as e: - notes.append(f"ImageFilePath Comparison error: {str(e)[:30]}") - - if isinstance(eprocess_imagefilename, str) and isinstance(peb_cmdline, str): - try: - # Compare EPROCESS.ImageFileName with PEB.CommandLine executable path truncated to 15 characters - peb_cmdline_path = PebMasquerade._get_cmdline_image(peb_cmdline) - if isinstance(peb_cmdline_path, PureWindowsPath): - peb_cmdline_path = peb_cmdline_path.name - peb_cmdline_basename_truncated = peb_cmdline_path[:14] - if ( - eprocess_imagefilename.lower() - != peb_cmdline_basename_truncated.lower() - ): - notes.append( - f"'Potential PEB.CommandLine Spoofing: EPROCESS={eprocess_imagefilename};PEB={peb_cmdline_basename_truncated}'" - ) - except Exception as e: - notes.append(f"CommandLine comparison error: {str(e)}") - - if isinstance(eprocess_seaudit_imagefilename, str) and isinstance( - peb_imagefilepath, str - ): - try: - ( - are_equal, - eprocess_seaudit_normalized, - peb_imagefilepath_normalized, - ) = PebMasquerade._are_paths_equal( - device_path=eprocess_seaudit_imagefilename, - drive_path=peb_imagefilepath, - ) - if not are_equal: - notes.append( - f"'Potential PEB.ImageFilePath Spoofing (via _EPROCESS.SeAuditProcessCreationInfo): EPROCESS={eprocess_seaudit_normalized};PEB={peb_imagefilepath_normalized}'" - ) - except Exception as e: - notes.append( - f"SeAuditProcessCreationInfo comparison error: {str(e)[:30]}" - ) - if isinstance(peb_imagefilepath, str) and peb: try: @@ -319,12 +262,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface): if (peb_imagefilepath_length != len(peb_imagefilepath)) or ( peb_imagefilepath_maxlength != len(peb_imagefilepath) ): - notes.append( - f"'PEB.ImageFilePath Length Mismatch: Length={peb_imagefilepath_length}, MaximumLength={peb_imagefilepath_maxlength}, Actual={len(peb_imagefilepath)}'" - ) + peb_imagefilepath_length_check = True except Exception as e: - notes.append( - f"PEB.ImageFilePath Length comparison error: {str(e)[:30]}" + vollog.warning( + "PEB.ImagePathName Length comparison error for PID %d: %s", + proc_id, + str(e), ) if isinstance(peb_cmdline, str) and peb: @@ -338,23 +281,26 @@ class PebMasquerade(interfaces.plugins.PluginInterface): if (peb_cmdline_length != len(peb_cmdline)) or ( peb_cmdline_maxlength != len(peb_cmdline) ): + peb_cmdline_length_check = True notes.append( f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'" ) except Exception as e: - notes.append( - f"PEB.CommandLine Length comparison error: {str(e)[:30]}" + vollog.warning( + "PEB.CommandLine Length comparison error for PID %d: %s", + proc_id, + str(e), ) yield ( 0, ( proc_id, - proc_name_for_row, eprocess_imagefilename, eprocess_seaudit_imagefilename, peb_imagefilepath, peb_cmdline_path_render, - "[" + ", ".join(notes) + "]" if notes else "OK", + peb_cmdline_length_check, + peb_imagefilepath_length_check, ), ) @@ -365,12 +311,12 @@ class PebMasquerade(interfaces.plugins.PluginInterface): return renderers.TreeGrid( [ ("PID", int), - ("ProcessName", str), ("EPROCESS_ImageFileName", str), ("EPROCESS_SeAudit_ImageFileName", str), ("PEB_ImageFilePath", str), ("PEB_CommandLine_Path", str), - ("Notes", str), + ("PEB_ImageFilePath_Spoofed", bool), + ("PEB_CommandLine_Spoofed", bool), ], self._generator(pids, context, kernel_module_name), ) From 035b60863308afd31d0d6ee543d296e856c54a13 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 22 Jul 2025 21:49:16 +0300 Subject: [PATCH 1253/1352] Plugins: pebmasquerade remove unused code --- .../plugins/windows/malware/pebmasquerade.py | 94 +------------------ 1 file changed, 3 insertions(+), 91 deletions(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index cc3ee73bc..070716503 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -1,6 +1,4 @@ import logging -import re -from pathlib import PureWindowsPath from typing import List, Union, Tuple from volatility3.framework import interfaces, renderers, exceptions @@ -38,74 +36,8 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ), ] - @classmethod - def _get_cmdline_image(cls, cmdline: str) -> Union[str, PureWindowsPath]: - """Extract the executable path from a command line string. - - Args: - cmdline (str): The command line string to parse. - - Returns: - Union[str, PureWindowsPath]: The executable path as a string or PureWindowsPath. - """ - if not cmdline: - return None - - # Regex to extract first .exe ending string (handles quotes, paths, no quotes) - match = re.search(r'(?i)(["\']?)([^"\']*?\.exe)\1(?=\s|$)', cmdline) - if match: - exe_path = match.group(2) - return PureWindowsPath(exe_path) - - # If no .exe found, extract the first token (handles quotes) - # Matches either "quoted string" or unquoted word - first_token_match = re.match(r'\s*(?:"([^"]+)"|\'([^\']+)\'|(\S+))', cmdline) - if first_token_match: - # Extract whichever group matched - executable = ( - first_token_match.group(1) - or first_token_match.group(2) - or first_token_match.group(3) - ) - return PureWindowsPath(executable).name + ".exe" - - return "" - - @classmethod - def _are_paths_equal( - cls, device_path: str, drive_path: str - ) -> Tuple[bool, str, str]: - """Compare two paths to see if they are equal, ignoring drive/device root and case. - - Args: - device_path (str): The device path (e.g. "\\Device\\HarddiskVolume1\\path") - drive_path (str): The drive path (e.g. "C:\\path") - - Returns: - tuple: (are_equal, device_path_without_drive, drive_path_without_drive) - - are_equal (bool): True if paths are equal, False otherwise - - device_path_without_drive (str): Device path without drive letter - - drive_path_without_drive (str): Drive path without drive letter - """ - pure_device_path = PureWindowsPath(device_path) - pure_drive_path = PureWindowsPath(drive_path) - device_parts = list(pure_device_path.parts) - drive_parts = list(pure_drive_path.parts) - - if pure_drive_path.is_absolute(): - new_drive_path = "/".join(drive_parts[1:]).lower() - new_device_path = "/".join(device_parts[3:]).lower() - else: - new_drive_path = "/".join(drive_parts[2:]).lower() - new_device_path = "/".join(device_parts[4:]).lower() - - return ( - new_drive_path == new_device_path, - new_device_path, - new_drive_path, - ) - - def get_process_names(self, proc: interfaces.objects.ObjectInterface) -> Tuple[ + @staticmethod + def get_process_names(proc: interfaces.objects.ObjectInterface) -> Tuple[ Union[str, renderers.NotAvailableValue], Union[str, renderers.NotAvailableValue], Union[str, renderers.NotAvailableValue], @@ -224,7 +156,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface): vollog.debug( "Unable to access PEB for PID %d, skipping process", proc_id ) - notes = [] peb_imagefilepath_length_check = False peb_cmdline_length_check = False ( @@ -232,21 +163,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): eprocess_seaudit_imagefilename, peb_imagefilepath, peb_cmdline, - ) = self.get_process_names(proc) - - # Extract command line executable path for rendering - peb_cmdline_path_render = renderers.NotAvailableValue() - if isinstance(peb_cmdline, str): - try: - peb_cmdline_path_render = str( - PebMasquerade._get_cmdline_image(peb_cmdline) - ) - except Exception as e: - vollog.debug( - "Error extracting command line path for PID %d: %s", - proc_id, - str(e), - ) + ) = PebMasquerade.get_process_names(proc) if isinstance(peb_imagefilepath, str) and peb: try: @@ -282,9 +199,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface): peb_cmdline_maxlength != len(peb_cmdline) ): peb_cmdline_length_check = True - notes.append( - f"'PEB.CommandLine Length Mismatch: Commandline={peb_cmdline}, Length={peb_cmdline_length}, MaximumLength={peb_cmdline_maxlength}, Actual={len(peb_cmdline)}'" - ) except Exception as e: vollog.warning( "PEB.CommandLine Length comparison error for PID %d: %s", @@ -298,7 +212,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface): eprocess_imagefilename, eprocess_seaudit_imagefilename, peb_imagefilepath, - peb_cmdline_path_render, peb_cmdline_length_check, peb_imagefilepath_length_check, ), @@ -314,7 +227,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ("EPROCESS_ImageFileName", str), ("EPROCESS_SeAudit_ImageFileName", str), ("PEB_ImageFilePath", str), - ("PEB_CommandLine_Path", str), ("PEB_ImageFilePath_Spoofed", bool), ("PEB_CommandLine_Spoofed", bool), ], From 2dd0bec92744d376fb649d7b1d759c5282db2cda Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 17 Sep 2025 02:03:48 +0300 Subject: [PATCH 1254/1352] Plugins: pebmasq - change staticmethod to classmethod --- volatility3/framework/plugins/windows/malware/pebmasquerade.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index 070716503..c2636820b 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -36,7 +36,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ), ] - @staticmethod + @classmethod def get_process_names(proc: interfaces.objects.ObjectInterface) -> Tuple[ Union[str, renderers.NotAvailableValue], Union[str, renderers.NotAvailableValue], From a6d1b34d36ab8a3d63dc3d1f1f07bf965e9712dc Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 17 Sep 2025 13:46:34 +0300 Subject: [PATCH 1255/1352] Plugins: pebmasq fix classmethod --- volatility3/framework/plugins/windows/malware/pebmasquerade.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index c2636820b..3d662789a 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -37,7 +37,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): ] @classmethod - def get_process_names(proc: interfaces.objects.ObjectInterface) -> Tuple[ + def get_process_names(cls, proc: interfaces.objects.ObjectInterface) -> Tuple[ Union[str, renderers.NotAvailableValue], Union[str, renderers.NotAvailableValue], Union[str, renderers.NotAvailableValue], From 0e17057b0b6a01425cf3f4c66c42233e7ccb7f83 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 23 Sep 2025 21:16:47 +0300 Subject: [PATCH 1256/1352] Plugins - pebmasq required framework version --- volatility3/framework/plugins/windows/malware/pebmasquerade.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index 3d662789a..dd85fb570 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -15,7 +15,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): """Detects potential process name spoofing by comparing EPROCESS and PEB data.""" _version = (1, 0, 0) - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 27, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: From 438acddab635553b9820e8bdc6815a59ed99b222 Mon Sep 17 00:00:00 2001 From: ikelos Date: Sun, 28 Sep 2025 22:11:26 +0100 Subject: [PATCH 1257/1352] Update volatility3/framework/plugins/linux/malware/malfind.py --- volatility3/framework/plugins/linux/malware/malfind.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 306bdc3b0..721e1953d 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -41,6 +41,7 @@ class Malfind(interfaces.plugins.PluginInterface): name="dump-size", description="Amount of bytes to dump for each dirty region/page found - Default 64 bytes", optional=True, + default=64, ), requirements.BooleanRequirement( name="dump-page", From 16412537c0065ba284d83e5dc41d6b1d01a37a43 Mon Sep 17 00:00:00 2001 From: ikelos Date: Sun, 28 Sep 2025 22:11:33 +0100 Subject: [PATCH 1258/1352] Update volatility3/framework/plugins/linux/malware/malfind.py --- volatility3/framework/plugins/linux/malware/malfind.py | 1 + 1 file changed, 1 insertion(+) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 721e1953d..09b64768f 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -47,6 +47,7 @@ class Malfind(interfaces.plugins.PluginInterface): name="dump-page", description="Dump each dirty page and content - Default off", optional=True, + default=False, ), ] From d41afc444e7590b83dd9f14702f76ed094371856 Mon Sep 17 00:00:00 2001 From: ikelos Date: Sun, 28 Sep 2025 22:11:40 +0100 Subject: [PATCH 1259/1352] Update volatility3/framework/plugins/linux/malware/malfind.py --- volatility3/framework/plugins/linux/malware/malfind.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 09b64768f..10fa71d36 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -63,7 +63,7 @@ class Malfind(interfaces.plugins.PluginInterface): proc_layer = self.context.layers[proc_layer_name] - dump_size = self.config.get("dump-size", None) or 64 + dump_size = self.config["dump-size"] # Dumping page defaults to off, as in case a whole r-xp region is dirty # this would likely dump 1000's of pages which might not always be wise nor necessary From f72b8ee21d72751907a16ea66cba692fe5c78790 Mon Sep 17 00:00:00 2001 From: ikelos Date: Sun, 28 Sep 2025 22:11:48 +0100 Subject: [PATCH 1260/1352] Update volatility3/framework/plugins/linux/malware/malfind.py --- volatility3/framework/plugins/linux/malware/malfind.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/malfind.py b/volatility3/framework/plugins/linux/malware/malfind.py index 10fa71d36..cbd9f87c1 100644 --- a/volatility3/framework/plugins/linux/malware/malfind.py +++ b/volatility3/framework/plugins/linux/malware/malfind.py @@ -68,7 +68,7 @@ class Malfind(interfaces.plugins.PluginInterface): # Dumping page defaults to off, as in case a whole r-xp region is dirty # this would likely dump 1000's of pages which might not always be wise nor necessary - dump_page = self.config.get("dump-page") or False + dump_page = self.config["dump-page"] for vma in task.mm.get_vma_iter(): vma_name = vma.get_name(self.context, task) From 841b2b6435911221c09ce4028a541d081ea621a8 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Mon, 29 Sep 2025 23:04:01 +0100 Subject: [PATCH 1261/1352] Ruff fixes that black agrees with --- development/banner_server.py | 2 - development/compare-vol.py | 1 - development/pdbparse-to-json.py | 1 - development/stock-linux-json.py | 1 - test/plugins/windows/test_scheduled_tasks.py | 2036 +++++++++++++++-- test/renderers/test_parquet_renderers.py | 64 +- test/volatility3_code_analysis.py | 10 +- volatility3/__init__.py | 1 + volatility3/cli/__init__.py | 10 +- volatility3/cli/text_renderer.py | 2 - volatility3/cli/volshell/__init__.py | 5 +- volatility3/cli/volshell/generic.py | 6 +- volatility3/framework/__init__.py | 1 + volatility3/framework/automagic/pdbscan.py | 1 + volatility3/framework/automagic/stacker.py | 5 +- volatility3/framework/automagic/windows.py | 1 + .../framework/configuration/requirements.py | 1 + .../framework/constants/linux/__init__.py | 1 + volatility3/framework/contexts/__init__.py | 1 + volatility3/framework/deprecation.py | 2 +- volatility3/framework/exceptions.py | 3 +- volatility3/framework/interfaces/automagic.py | 1 + volatility3/framework/interfaces/context.py | 1 + volatility3/framework/interfaces/layers.py | 1 + volatility3/framework/interfaces/objects.py | 1 + volatility3/framework/interfaces/symbols.py | 1 + volatility3/framework/layers/avml.py | 1 + .../framework/layers/codecs/__init__.py | 5 +- volatility3/framework/layers/intel.py | 16 +- volatility3/framework/layers/msf.py | 10 +- volatility3/framework/layers/resources.py | 5 +- volatility3/framework/layers/segmented.py | 8 +- volatility3/framework/layers/vmware.py | 8 +- volatility3/framework/plugins/banners.py | 5 +- volatility3/framework/plugins/isfinfo.py | 9 +- .../framework/plugins/linux/graphics/fbdev.py | 1 - volatility3/framework/plugins/linux/ip.py | 58 +- volatility3/framework/plugins/linux/kmsg.py | 15 +- volatility3/framework/plugins/linux/lsof.py | 6 +- .../plugins/linux/malware/check_afinfo.py | 1 + .../plugins/linux/malware/check_syscall.py | 1 + .../plugins/linux/malware/netfilter.py | 11 +- .../plugins/linux/malware/tty_check.py | 13 +- .../framework/plugins/linux/module_extract.py | 11 +- .../framework/plugins/linux/pagecache.py | 7 +- volatility3/framework/plugins/linux/pslist.py | 27 +- .../plugins/linux/tracing/perf_events.py | 1 - .../framework/plugins/linux/vmaregexscan.py | 16 +- .../framework/plugins/linux/vmayarascan.py | 15 +- volatility3/framework/plugins/mac/lsmod.py | 1 + volatility3/framework/plugins/mac/mount.py | 1 + volatility3/framework/plugins/mac/psaux.py | 1 + .../framework/plugins/windows/callbacks.py | 7 +- .../framework/plugins/windows/deskscan.py | 11 +- .../framework/plugins/windows/desktops.py | 11 +- .../framework/plugins/windows/kpcrs.py | 1 - .../windows/malware/direct_system_calls.py | 15 +- .../windows/malware/hollowprocesses.py | 11 +- .../plugins/windows/malware/malfind.py | 7 +- .../plugins/windows/malware/pebmasquerade.py | 1 - .../windows/malware/processghosting.py | 28 +- .../windows/malware/skeleton_key_check.py | 15 +- .../windows/malware/suspicious_threads.py | 19 +- .../framework/plugins/windows/mftscan.py | 140 +- .../framework/plugins/windows/modules.py | 17 +- .../framework/plugins/windows/poolscanner.py | 1 - .../plugins/windows/registry/amcache.py | 120 +- .../windows/registry/scheduled_tasks.py | 22 +- .../framework/plugins/windows/sessions.py | 17 +- .../framework/plugins/windows/shimcachemem.py | 14 +- .../framework/plugins/windows/svcscan.py | 1 - .../framework/plugins/windows/thrdscan.py | 23 +- .../framework/plugins/windows/vadregexscan.py | 16 +- .../framework/plugins/windows/vadyarascan.py | 31 +- .../framework/plugins/windows/windows.py | 21 +- volatility3/framework/renderers/__init__.py | 1 + .../framework/renderers/format_hints.py | 1 + volatility3/framework/symbols/__init__.py | 7 +- volatility3/framework/symbols/intermed.py | 9 +- .../symbols/linux/extensions/__init__.py | 3 - .../symbols/linux/utilities/modules.py | 18 +- .../symbols/windows/extensions/callbacks.py | 1 - .../symbols/windows/extensions/gui.py | 1 - .../symbols/windows/extensions/mft.py | 1 - .../symbols/windows/extensions/shimcache.py | 1 - .../framework/symbols/windows/pdbconv.py | 2 +- volatility3/plugins/__init__.py | 1 + volatility3/plugins/linux/__init__.py | 1 + volatility3/plugins/mac/__init__.py | 1 + volatility3/plugins/windows/__init__.py | 1 + .../plugins/windows/registry/__init__.py | 1 + volatility3/symbols/__init__.py | 1 + 92 files changed, 2425 insertions(+), 588 deletions(-) diff --git a/development/banner_server.py b/development/banner_server.py index b62477a26..dd1df96ab 100644 --- a/development/banner_server.py +++ b/development/banner_server.py @@ -14,7 +14,6 @@ vollog = logging.getLogger(__name__) class BannerCacheGenerator: - def __init__(self, path: str, url_prefix: str): self._path = path self._url_prefix = url_prefix @@ -79,7 +78,6 @@ class BannerCacheGenerator: if __name__ == "__main__": - parser = argparse.ArgumentParser() parser.add_argument("--path", default=os.path.dirname(__file__)) parser.add_argument( diff --git a/development/compare-vol.py b/development/compare-vol.py index 717d81d3e..ccfcd9f4a 100644 --- a/development/compare-vol.py +++ b/development/compare-vol.py @@ -208,7 +208,6 @@ class Volatility3PyPyTest(VolatilityTest): class VolatilityTester: - def __init__( self, images: List[VolatilityImage], diff --git a/development/pdbparse-to-json.py b/development/pdbparse-to-json.py index 49b4da009..fe4b8ab60 100644 --- a/development/pdbparse-to-json.py +++ b/development/pdbparse-to-json.py @@ -22,7 +22,6 @@ if __name__ == "__main__": class PDBRetreiver: - def retreive_pdb(self, guid: str, file_name: str) -> Optional[str]: logger.info("Download PDB file...") file_name = ".".join(file_name.split(".")[:-1] + ["pdb"]) diff --git a/development/stock-linux-json.py b/development/stock-linux-json.py index 967cc7e18..713283e66 100644 --- a/development/stock-linux-json.py +++ b/development/stock-linux-json.py @@ -13,7 +13,6 @@ DWARF2JSON = "./dwarf2json" class Downloader: - def __init__(self, url_lists: List[List[str]]) -> None: self.url_lists = url_lists diff --git a/test/plugins/windows/test_scheduled_tasks.py b/test/plugins/windows/test_scheduled_tasks.py index 15d7f79a6..ce66ee23e 100644 --- a/test/plugins/windows/test_scheduled_tasks.py +++ b/test/plugins/windows/test_scheduled_tasks.py @@ -101,233 +101,1815 @@ class TestTriggersDecoding(unittest.TestCase): "1808B", # fmt: off *[ - 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x38, 0x21, 0x41, 0x42, 0x48, 0x48, 0x48, 0x48, - 0xa0, 0x12, 0xa0, 0xa4, 0x48, 0x48, 0x48, 0x48, - 0x0e, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x41, 0x00, 0x75, 0x00, 0x74, 0x00, 0x68, 0x00, - 0x6f, 0x00, 0x72, 0x00, 0x00, 0x00, 0x48, 0x48, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x01, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x1c, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, - 0x15, 0x00, 0x00, 0x00, 0x69, 0xce, 0x28, 0x2a, - 0xce, 0xd8, 0x1f, 0x77, 0x37, 0x9c, 0xe2, 0x44, - 0xf4, 0x01, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x40, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x44, 0x00, 0x45, 0x00, 0x53, 0x00, 0x4b, 0x00, - 0x54, 0x00, 0x4f, 0x00, 0x50, 0x00, 0x2d, 0x00, - 0x45, 0x00, 0x33, 0x00, 0x38, 0x00, 0x38, 0x00, - 0x44, 0x00, 0x38, 0x00, 0x50, 0x00, 0x5c, 0x00, - 0x41, 0x00, 0x64, 0x00, 0x6d, 0x00, 0x69, 0x00, - 0x6e, 0x00, 0x69, 0x00, 0x73, 0x00, 0x74, 0x00, - 0x72, 0x00, 0x61, 0x00, 0x74, 0x00, 0x6f, 0x00, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x2c, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x80, 0xf4, 0x03, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0xdd, 0xdd, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x07, 0x0a, 0x00, 0x00, 0x00, 0x09, 0x00, - 0x80, 0x48, 0x11, 0xf8, 0x36, 0x1a, 0xdb, 0x01, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x01, 0x2e, 0xe2, 0x01, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xc2, 0x31, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0xaa, 0xaa, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x01, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0xee, 0xee, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xda, 0xaf, 0x8d, 0x09, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0xcc, 0xcc, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x65, 0x00, 0x78, 0x00, 0x65, 0x00, - 0x22, 0x00, 0x20, 0x00, 0x53, 0x00, 0x74, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x84, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x3c, 0x00, 0x51, 0x00, 0x75, 0x00, 0x65, 0x00, - 0x72, 0x00, 0x79, 0x00, 0x4c, 0x00, 0x69, 0x00, - 0x73, 0x00, 0x74, 0x00, 0x3e, 0x00, 0x3c, 0x00, - 0x51, 0x00, 0x75, 0x00, 0x65, 0x00, 0x72, 0x00, - 0x79, 0x00, 0x20, 0x00, 0x49, 0x00, 0x64, 0x00, - 0x3d, 0x00, 0x22, 0x00, 0x30, 0x00, 0x22, 0x00, - 0x20, 0x00, 0x50, 0x00, 0x61, 0x00, 0x74, 0x00, - 0x68, 0x00, 0x3d, 0x00, 0x22, 0x00, 0x49, 0x00, - 0x6e, 0x00, 0x74, 0x00, 0x65, 0x00, 0x72, 0x00, - 0x6e, 0x00, 0x65, 0x00, 0x74, 0x00, 0x20, 0x00, - 0x45, 0x00, 0x78, 0x00, 0x70, 0x00, 0x6c, 0x00, - 0x6f, 0x00, 0x72, 0x00, 0x65, 0x00, 0x72, 0x00, - 0x22, 0x00, 0x3e, 0x00, 0x3c, 0x00, 0x53, 0x00, - 0x65, 0x00, 0x6c, 0x00, 0x65, 0x00, 0x63, 0x00, - 0x74, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00, - 0x74, 0x00, 0x68, 0x00, 0x3d, 0x00, 0x22, 0x00, - 0x49, 0x00, 0x6e, 0x00, 0x74, 0x00, 0x65, 0x00, - 0x72, 0x00, 0x6e, 0x00, 0x65, 0x00, 0x74, 0x00, - 0x20, 0x00, 0x45, 0x00, 0x78, 0x00, 0x70, 0x00, - 0x6c, 0x00, 0x6f, 0x00, 0x72, 0x00, 0x65, 0x00, - 0x72, 0x00, 0x22, 0x00, 0x3e, 0x00, 0x2a, 0x00, - 0x5b, 0x00, 0x53, 0x00, 0x79, 0x00, 0x73, 0x00, - 0x74, 0x00, 0x65, 0x00, 0x6d, 0x00, 0x5b, 0x00, - 0x45, 0x00, 0x76, 0x00, 0x65, 0x00, 0x6e, 0x00, - 0x74, 0x00, 0x49, 0x00, 0x44, 0x00, 0x3d, 0x00, - 0x32, 0x00, 0x5d, 0x00, 0x5d, 0x00, 0x3c, 0x00, - 0x2f, 0x00, 0x53, 0x00, 0x65, 0x00, 0x6c, 0x00, - 0x65, 0x00, 0x63, 0x00, 0x74, 0x00, 0x3e, 0x00, - 0x3c, 0x00, 0x2f, 0x00, 0x51, 0x00, 0x75, 0x00, - 0x65, 0x00, 0x72, 0x00, 0x79, 0x00, 0x3e, 0x00, - 0x3c, 0x00, 0x2f, 0x00, 0x51, 0x00, 0x75, 0x00, - 0x65, 0x00, 0x72, 0x00, 0x79, 0x00, 0x4c, 0x00, - 0x69, 0x00, 0x73, 0x00, 0x74, 0x00, 0x3e, 0x00, - 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x88, 0x88, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x77, 0x77, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, - 0x01, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x77, 0x77, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x01, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x1c, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, - 0x15, 0x00, 0x00, 0x00, 0x69, 0xce, 0x28, 0x2a, - 0xce, 0xd8, 0x1f, 0x77, 0x37, 0x9c, 0xe2, 0x44, - 0xf4, 0x01, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x40, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x44, 0x00, 0x45, 0x00, 0x53, 0x00, 0x4b, 0x00, - 0x54, 0x00, 0x4f, 0x00, 0x50, 0x00, 0x2d, 0x00, - 0x45, 0x00, 0x33, 0x00, 0x38, 0x00, 0x38, 0x00, - 0x44, 0x00, 0x38, 0x00, 0x50, 0x00, 0x5c, 0x00, - 0x41, 0x00, 0x64, 0x00, 0x6d, 0x00, 0x69, 0x00, - 0x6e, 0x00, 0x69, 0x00, 0x73, 0x00, 0x74, 0x00, - 0x72, 0x00, 0x61, 0x00, 0x74, 0x00, 0x6f, 0x00, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x77, 0x77, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, - 0x01, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x01, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x77, 0x77, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, - 0x01, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x00, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, 0x48, - 0x01, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x1c, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, - 0x15, 0x00, 0x00, 0x00, 0x69, 0xce, 0x28, 0x2a, - 0xce, 0xd8, 0x1f, 0x77, 0x37, 0x9c, 0xe2, 0x44, - 0xf4, 0x01, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x40, 0x00, 0x00, 0x00, 0x48, 0x48, 0x48, 0x48, - 0x44, 0x00, 0x45, 0x00, 0x53, 0x00, 0x4b, 0x00, - 0x54, 0x00, 0x4f, 0x00, 0x50, 0x00, 0x2d, 0x00, - 0x45, 0x00, 0x33, 0x00, 0x38, 0x00, 0x38, 0x00, - 0x44, 0x00, 0x38, 0x00, 0x50, 0x00, 0x5c, 0x00, - 0x41, 0x00, 0x64, 0x00, 0x6d, 0x00, 0x69, 0x00, - 0x6e, 0x00, 0x69, 0x00, 0x73, 0x00, 0x74, 0x00, - 0x72, 0x00, 0x61, 0x00, 0x74, 0x00, 0x6f, 0x00, - 0x72, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 - ] + 0x17, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xDA, + 0xAF, + 0x8D, + 0x09, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xDA, + 0xAF, + 0x8D, + 0x09, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x38, + 0x21, + 0x41, + 0x42, + 0x48, + 0x48, + 0x48, + 0x48, + 0xA0, + 0x12, + 0xA0, + 0xA4, + 0x48, + 0x48, + 0x48, + 0x48, + 0x0E, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x41, + 0x00, + 0x75, + 0x00, + 0x74, + 0x00, + 0x68, + 0x00, + 0x6F, + 0x00, + 0x72, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x01, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x1C, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x01, + 0x05, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x05, + 0x15, + 0x00, + 0x00, + 0x00, + 0x69, + 0xCE, + 0x28, + 0x2A, + 0xCE, + 0xD8, + 0x1F, + 0x77, + 0x37, + 0x9C, + 0xE2, + 0x44, + 0xF4, + 0x01, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x40, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x44, + 0x00, + 0x45, + 0x00, + 0x53, + 0x00, + 0x4B, + 0x00, + 0x54, + 0x00, + 0x4F, + 0x00, + 0x50, + 0x00, + 0x2D, + 0x00, + 0x45, + 0x00, + 0x33, + 0x00, + 0x38, + 0x00, + 0x38, + 0x00, + 0x44, + 0x00, + 0x38, + 0x00, + 0x50, + 0x00, + 0x5C, + 0x00, + 0x41, + 0x00, + 0x64, + 0x00, + 0x6D, + 0x00, + 0x69, + 0x00, + 0x6E, + 0x00, + 0x69, + 0x00, + 0x73, + 0x00, + 0x74, + 0x00, + 0x72, + 0x00, + 0x61, + 0x00, + 0x74, + 0x00, + 0x6F, + 0x00, + 0x72, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x2C, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x80, + 0xF4, + 0x03, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x07, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0xDD, + 0xDD, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x07, + 0x0A, + 0x00, + 0x00, + 0x00, + 0x09, + 0x00, + 0x80, + 0x48, + 0x11, + 0xF8, + 0x36, + 0x1A, + 0xDB, + 0x01, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x2E, + 0xE2, + 0x01, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xC2, + 0x31, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0xAA, + 0xAA, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xDA, + 0xAF, + 0x8D, + 0x09, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xDA, + 0xAF, + 0x8D, + 0x09, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x01, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xDA, + 0xAF, + 0x8D, + 0x09, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xDA, + 0xAF, + 0x8D, + 0x09, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0xEE, + 0xEE, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xDA, + 0xAF, + 0x8D, + 0x09, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xDA, + 0xAF, + 0x8D, + 0x09, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0xCC, + 0xCC, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x65, + 0x00, + 0x78, + 0x00, + 0x65, + 0x00, + 0x22, + 0x00, + 0x20, + 0x00, + 0x53, + 0x00, + 0x74, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x84, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x3C, + 0x00, + 0x51, + 0x00, + 0x75, + 0x00, + 0x65, + 0x00, + 0x72, + 0x00, + 0x79, + 0x00, + 0x4C, + 0x00, + 0x69, + 0x00, + 0x73, + 0x00, + 0x74, + 0x00, + 0x3E, + 0x00, + 0x3C, + 0x00, + 0x51, + 0x00, + 0x75, + 0x00, + 0x65, + 0x00, + 0x72, + 0x00, + 0x79, + 0x00, + 0x20, + 0x00, + 0x49, + 0x00, + 0x64, + 0x00, + 0x3D, + 0x00, + 0x22, + 0x00, + 0x30, + 0x00, + 0x22, + 0x00, + 0x20, + 0x00, + 0x50, + 0x00, + 0x61, + 0x00, + 0x74, + 0x00, + 0x68, + 0x00, + 0x3D, + 0x00, + 0x22, + 0x00, + 0x49, + 0x00, + 0x6E, + 0x00, + 0x74, + 0x00, + 0x65, + 0x00, + 0x72, + 0x00, + 0x6E, + 0x00, + 0x65, + 0x00, + 0x74, + 0x00, + 0x20, + 0x00, + 0x45, + 0x00, + 0x78, + 0x00, + 0x70, + 0x00, + 0x6C, + 0x00, + 0x6F, + 0x00, + 0x72, + 0x00, + 0x65, + 0x00, + 0x72, + 0x00, + 0x22, + 0x00, + 0x3E, + 0x00, + 0x3C, + 0x00, + 0x53, + 0x00, + 0x65, + 0x00, + 0x6C, + 0x00, + 0x65, + 0x00, + 0x63, + 0x00, + 0x74, + 0x00, + 0x20, + 0x00, + 0x50, + 0x00, + 0x61, + 0x00, + 0x74, + 0x00, + 0x68, + 0x00, + 0x3D, + 0x00, + 0x22, + 0x00, + 0x49, + 0x00, + 0x6E, + 0x00, + 0x74, + 0x00, + 0x65, + 0x00, + 0x72, + 0x00, + 0x6E, + 0x00, + 0x65, + 0x00, + 0x74, + 0x00, + 0x20, + 0x00, + 0x45, + 0x00, + 0x78, + 0x00, + 0x70, + 0x00, + 0x6C, + 0x00, + 0x6F, + 0x00, + 0x72, + 0x00, + 0x65, + 0x00, + 0x72, + 0x00, + 0x22, + 0x00, + 0x3E, + 0x00, + 0x2A, + 0x00, + 0x5B, + 0x00, + 0x53, + 0x00, + 0x79, + 0x00, + 0x73, + 0x00, + 0x74, + 0x00, + 0x65, + 0x00, + 0x6D, + 0x00, + 0x5B, + 0x00, + 0x45, + 0x00, + 0x76, + 0x00, + 0x65, + 0x00, + 0x6E, + 0x00, + 0x74, + 0x00, + 0x49, + 0x00, + 0x44, + 0x00, + 0x3D, + 0x00, + 0x32, + 0x00, + 0x5D, + 0x00, + 0x5D, + 0x00, + 0x3C, + 0x00, + 0x2F, + 0x00, + 0x53, + 0x00, + 0x65, + 0x00, + 0x6C, + 0x00, + 0x65, + 0x00, + 0x63, + 0x00, + 0x74, + 0x00, + 0x3E, + 0x00, + 0x3C, + 0x00, + 0x2F, + 0x00, + 0x51, + 0x00, + 0x75, + 0x00, + 0x65, + 0x00, + 0x72, + 0x00, + 0x79, + 0x00, + 0x3E, + 0x00, + 0x3C, + 0x00, + 0x2F, + 0x00, + 0x51, + 0x00, + 0x75, + 0x00, + 0x65, + 0x00, + 0x72, + 0x00, + 0x79, + 0x00, + 0x4C, + 0x00, + 0x69, + 0x00, + 0x73, + 0x00, + 0x74, + 0x00, + 0x3E, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x88, + 0x88, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x77, + 0x77, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x01, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x03, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x77, + 0x77, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x04, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x01, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x1C, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x01, + 0x05, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x05, + 0x15, + 0x00, + 0x00, + 0x00, + 0x69, + 0xCE, + 0x28, + 0x2A, + 0xCE, + 0xD8, + 0x1F, + 0x77, + 0x37, + 0x9C, + 0xE2, + 0x44, + 0xF4, + 0x01, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x40, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x44, + 0x00, + 0x45, + 0x00, + 0x53, + 0x00, + 0x4B, + 0x00, + 0x54, + 0x00, + 0x4F, + 0x00, + 0x50, + 0x00, + 0x2D, + 0x00, + 0x45, + 0x00, + 0x33, + 0x00, + 0x38, + 0x00, + 0x38, + 0x00, + 0x44, + 0x00, + 0x38, + 0x00, + 0x50, + 0x00, + 0x5C, + 0x00, + 0x41, + 0x00, + 0x64, + 0x00, + 0x6D, + 0x00, + 0x69, + 0x00, + 0x6E, + 0x00, + 0x69, + 0x00, + 0x73, + 0x00, + 0x74, + 0x00, + 0x72, + 0x00, + 0x61, + 0x00, + 0x74, + 0x00, + 0x6F, + 0x00, + 0x72, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x77, + 0x77, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x01, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x07, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x77, + 0x77, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0xFF, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x01, + 0x00, + 0x00, + 0x01, + 0xFF, + 0xFF, + 0xFF, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x08, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x48, + 0x01, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x1C, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x01, + 0x05, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x05, + 0x15, + 0x00, + 0x00, + 0x00, + 0x69, + 0xCE, + 0x28, + 0x2A, + 0xCE, + 0xD8, + 0x1F, + 0x77, + 0x37, + 0x9C, + 0xE2, + 0x44, + 0xF4, + 0x01, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x40, + 0x00, + 0x00, + 0x00, + 0x48, + 0x48, + 0x48, + 0x48, + 0x44, + 0x00, + 0x45, + 0x00, + 0x53, + 0x00, + 0x4B, + 0x00, + 0x54, + 0x00, + 0x4F, + 0x00, + 0x50, + 0x00, + 0x2D, + 0x00, + 0x45, + 0x00, + 0x33, + 0x00, + 0x38, + 0x00, + 0x38, + 0x00, + 0x44, + 0x00, + 0x38, + 0x00, + 0x50, + 0x00, + 0x5C, + 0x00, + 0x41, + 0x00, + 0x64, + 0x00, + 0x6D, + 0x00, + 0x69, + 0x00, + 0x6E, + 0x00, + 0x69, + 0x00, + 0x73, + 0x00, + 0x74, + 0x00, + 0x72, + 0x00, + 0x61, + 0x00, + 0x74, + 0x00, + 0x6F, + 0x00, + 0x72, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + 0x00, + ], # fmt: on ) triggers = scheduled_tasks.TriggerSet.decode(buf) diff --git a/test/renderers/test_parquet_renderers.py b/test/renderers/test_parquet_renderers.py index aa5474636..c9c07b2db 100644 --- a/test/renderers/test_parquet_renderers.py +++ b/test/renderers/test_parquet_renderers.py @@ -8,9 +8,10 @@ try: import pyarrow as pa import pyarrow.parquet as pq import pyarrow.compute as pc + HAS_PYARROW = True except ImportError: - # The user doesn't have pyarrow installed, but HAS_PYARROW will be false so just continue + # The user doesn't have pyarrow installed, but HAS_PYARROW will be false so just continue pass @@ -41,10 +42,33 @@ class TestArrowRendererBase(ABC): table = self._get_table_from_output(out) assert table.num_rows > 10 - assert table.filter(pc.match_substring(pc.utf8_lower(table.column('ImageFileName')), "system")).num_rows > 0 - assert table.filter(pc.match_substring(pc.utf8_lower(table.column('ImageFileName')), "csrss.exe")).num_rows > 0 - assert table.filter(pc.match_substring(pc.utf8_lower(table.column('ImageFileName')), "svchost.exe")).num_rows > 0 - assert table.filter(pc.greater(table.column('PID'), 0)).num_rows == table.num_rows + assert ( + table.filter( + pc.match_substring( + pc.utf8_lower(table.column("ImageFileName")), "system" + ) + ).num_rows + > 0 + ) + assert ( + table.filter( + pc.match_substring( + pc.utf8_lower(table.column("ImageFileName")), "csrss.exe" + ) + ).num_rows + > 0 + ) + assert ( + table.filter( + pc.match_substring( + pc.utf8_lower(table.column("ImageFileName")), "svchost.exe" + ) + ).num_rows + > 0 + ) + assert ( + table.filter(pc.greater(table.column("PID"), 0)).num_rows == table.num_rows + ) def test_linux_generic_pslist(self, volatility, python, image): rc, out, _err = test_volatility.runvol_plugin( @@ -59,12 +83,23 @@ class TestArrowRendererBase(ABC): table = self._get_table_from_output(out) assert table.num_rows > 10 - init_rows = table.filter(pc.match_substring(pc.utf8_lower(table.column('COMM')), "init")) - systemd_rows = table.filter(pc.match_substring(pc.utf8_lower(table.column('COMM')), "systemd")) + init_rows = table.filter( + pc.match_substring(pc.utf8_lower(table.column("COMM")), "init") + ) + systemd_rows = table.filter( + pc.match_substring(pc.utf8_lower(table.column("COMM")), "systemd") + ) assert (init_rows.num_rows > 0) or (systemd_rows.num_rows > 0) - assert table.filter(pc.match_substring(pc.utf8_lower(table.column('COMM')), "watchdog")).num_rows > 0 - assert table.filter(pc.greater(table.column('PID'), 0)).num_rows == table.num_rows + assert ( + table.filter( + pc.match_substring(pc.utf8_lower(table.column("COMM")), "watchdog") + ).num_rows + > 0 + ) + assert ( + table.filter(pc.greater(table.column("PID"), 0)).num_rows == table.num_rows + ) def test_windows_generic_handles(self, volatility, python, image): rc, out, _err = test_volatility.runvol_plugin( @@ -79,7 +114,14 @@ class TestArrowRendererBase(ABC): table = self._get_table_from_output(out) assert table.num_rows > 500 - assert table.filter(pc.match_substring(pc.utf8_lower(table.column('Name')), "machine\\system")).num_rows > 0 + assert ( + table.filter( + pc.match_substring( + pc.utf8_lower(table.column("Name")), "machine\\system" + ) + ).num_rows + > 0 + ) def test_linux_generic_lsof(self, volatility, python, image): rc, out, _err = test_volatility.runvol_plugin( @@ -94,6 +136,7 @@ class TestArrowRendererBase(ABC): table = self._get_table_from_output(out) assert table.num_rows > 35 + class TestParquetRenderer(TestArrowRendererBase): renderer_format = "parquet" @@ -106,4 +149,3 @@ class TestArrowRenderer(TestArrowRendererBase): def _get_table_from_output(self, output_bytes): return pa.ipc.open_stream(io.BytesIO(output_bytes)).read_all() - diff --git a/test/volatility3_code_analysis.py b/test/volatility3_code_analysis.py index 100ad3074..43fed459b 100644 --- a/test/volatility3_code_analysis.py +++ b/test/volatility3_code_analysis.py @@ -82,7 +82,6 @@ class CodeViolation(metaclass=abc.ABCMeta): class UnrequiredVersionableUsage(CodeViolation): - def __init__( self, module: types.ModuleType, @@ -107,7 +106,6 @@ class UnrequiredVersionableUsage(CodeViolation): class DirectVolatilityImportUsage(CodeViolation): - def __init__( self, module: types.ModuleType, @@ -174,8 +172,11 @@ class ModuleVisitor(NodeVisitor): """ if ( node.module - and node.module.startswith("volatility3.") # Give a pass to volatility3 module - and node.module != "volatility3.framework.constants._version" # make an exception for this + and node.module.startswith( + "volatility3." + ) # Give a pass to volatility3 module + and node.module + != "volatility3.framework.constants._version" # make an exception for this ): for name in node.names: try: @@ -204,7 +205,6 @@ class ModuleVisitor(NodeVisitor): def enter_ImportFrom(self, node: ast.ImportFrom): self._check_vol3_import_from(node) - def enter_ClassDef(self, node: ast.ClassDef) -> Any: logger.debug("Entering class %s", node.name) clazz = None diff --git a/volatility3/__init__.py b/volatility3/__init__.py index 94a6721e1..9867f5d94 100644 --- a/volatility3/__init__.py +++ b/volatility3/__init__.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Volatility 3 - An open-source memory forensics framework""" + import inspect import sys from importlib import abc diff --git a/volatility3/cli/__init__.py b/volatility3/cli/__init__.py index 4c379a15e..15e6cc7b4 100644 --- a/volatility3/cli/__init__.py +++ b/volatility3/cli/__init__.py @@ -10,6 +10,7 @@ User interfaces make use of the framework to: * run the plugin * display the results """ + import argparse import inspect import io @@ -458,8 +459,9 @@ class CommandLine: raise ValueError( "Invalid extension (extensions must be of the format \"conf.path.value='value'\")" ) - address, value = extension[: extension.find("=")], json.loads( - extension[extension.find("=") + 1 :] + address, value = ( + extension[: extension.find("=")], + json.loads(extension[extension.find("=") + 1 :]), ) ctx.config[address] = value @@ -574,7 +576,7 @@ class CommandLine: delayed_logs.append( ( logging.DEBUG, - f"Loaded configuration: {json.dumps(result, indent = 2, sort_keys = True)}", + f"Loaded configuration: {json.dumps(result, indent=2, sort_keys=True)}", ) ) return delayed_logs, result @@ -763,7 +765,7 @@ class CommandLine: constants.LOGLEVEL_VVVV, ] ): - logging.addLevelName(level_value, f"DETAIL {level+1}") + logging.addLevelName(level_value, f"DETAIL {level + 1}") def file_handler_class_factory(self, direct=True): output_dir = self.output_dir diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index 1e437a0be..d55201371 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -278,7 +278,6 @@ class CLIRenderer(interfaces.renderers.Renderer): class QuickTextRenderer(CLIRenderer): - name = "quick" def get_render_options(self): @@ -348,7 +347,6 @@ class NoneRenderer(CLIRenderer): class CSVRenderer(CLIRenderer): - name = "csv" structured_output = True diff --git a/volatility3/cli/volshell/__init__.py b/volatility3/cli/volshell/__init__.py index 0affe5d59..5bc29f220 100644 --- a/volatility3/cli/volshell/__init__.py +++ b/volatility3/cli/volshell/__init__.py @@ -344,8 +344,9 @@ class VolShell(cli.CommandLine): raise ValueError( "Invalid extension (extensions must be of the format \"conf.path.value='value'\")" ) - address, value = extension[: extension.find("=")], json.loads( - extension[extension.find("=") + 1 :] + address, value = ( + extension[: extension.find("=")], + json.loads(extension[extension.find("=") + 1 :]), ) ctx.config[address] = value diff --git a/volatility3/cli/volshell/generic.py b/volatility3/cli/volshell/generic.py index ace4b2119..2a8039ff2 100644 --- a/volatility3/cli/volshell/generic.py +++ b/volatility3/cli/volshell/generic.py @@ -469,7 +469,7 @@ class Volshell(interfaces.plugins.PluginInterface): and dereference_count < MAX_DEREFERENCE_COUNT ): # before defreerencing the pointer, show it's information - print(f'{" " * dereference_count}{self._display_simple_type(volobject)}') + print(f"{' ' * dereference_count}{self._display_simple_type(volobject)}") # check that we can follow the pointer before dereferencing and do not # attempt to follow null pointers. @@ -486,7 +486,7 @@ class Volshell(interfaces.plugins.PluginInterface): if hasattr(volobject.vol, "members"): # display the header for this object, if the original object was just a type string, display the type information - struct_header = f'{" " * dereference_count}{volobject.vol.type_name} ({volobject.vol.size} bytes)' + struct_header = f"{' ' * dereference_count}{volobject.vol.type_name} ({volobject.vol.size} bytes)" if isinstance(object, str) and offset is None: suffix = ":" else: @@ -523,7 +523,7 @@ class Volshell(interfaces.plugins.PluginInterface): len_typename = len(member_type_name) if len(member_type_name) > MAX_TYPENAME_DISPLAY_LENGTH: len_typename = MAX_TYPENAME_DISPLAY_LENGTH - member_type_name = f"{member_type_name[:len_typename - 3]}..." + member_type_name = f"{member_type_name[: len_typename - 3]}..." if isinstance(volobject, interfaces.objects.ObjectInterface): # We're an instance, so also display the data diff --git a/volatility3/framework/__init__.py b/volatility3/framework/__init__.py index 1c899f434..6943598cf 100644 --- a/volatility3/framework/__init__.py +++ b/volatility3/framework/__init__.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Volatility 3 framework.""" + # Check the python version to ensure it's suitable import glob import sys diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 55b9b81e1..8e2233840 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -7,6 +7,7 @@ from loaded PE files. This module contains a standalone scanner, and also a :class:`~volatility3.framework.interfaces.layers.ScannerInterface` based scanner for use within the framework by calling :func:`~volatility3.framework.interfaces.layers.DataLayerInterface.scan`. """ + import contextlib import logging import math diff --git a/volatility3/framework/automagic/stacker.py b/volatility3/framework/automagic/stacker.py index 596864264..2e9875086 100644 --- a/volatility3/framework/automagic/stacker.py +++ b/volatility3/framework/automagic/stacker.py @@ -153,8 +153,9 @@ class LayerStacker(interfaces.automagic.AutomagicInterface): constructor(context, config_path, requirement) # Stash the changed config items - self._cached = context.config.get(path, None), context.config.branch( - path + self._cached = ( + context.config.get(path, None), + context.config.branch(path), ) vollog.debug( f"physical_layer maximum_address: {physical_layer.maximum_address}" diff --git a/volatility3/framework/automagic/windows.py b/volatility3/framework/automagic/windows.py index 52296f5ad..7d56b01b3 100644 --- a/volatility3/framework/automagic/windows.py +++ b/volatility3/framework/automagic/windows.py @@ -26,6 +26,7 @@ The self-referential indices for older versions of windows are listed below: | x64 | 0x1ED | +--------------+-------+ """ + import logging import struct from typing import Generator, Iterable, List, Optional, Tuple, Type diff --git a/volatility3/framework/configuration/requirements.py b/volatility3/framework/configuration/requirements.py index 6d978e2a9..b1cc716e5 100644 --- a/volatility3/framework/configuration/requirements.py +++ b/volatility3/framework/configuration/requirements.py @@ -8,6 +8,7 @@ These requirement types allow plugins to request simple information types (such as strings, integers, etc) as well as indicating what they expect to be in the context (such as particular layers or symboltables). """ + import abc import logging import os diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index f45bed926..3f8c52b43 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -5,6 +5,7 @@ Linux-specific values that aren't found in debug symbols """ + import enum from dataclasses import dataclass diff --git a/volatility3/framework/contexts/__init__.py b/volatility3/framework/contexts/__init__.py index 32d33f657..125f41f8a 100644 --- a/volatility3/framework/contexts/__init__.py +++ b/volatility3/framework/contexts/__init__.py @@ -8,6 +8,7 @@ This has been made an object to allow quick swapping and changing of contexts, to allow a plugin to act on multiple different contexts without them interfering with each other. """ + import functools import hashlib import logging diff --git a/volatility3/framework/deprecation.py b/volatility3/framework/deprecation.py index 90fa9bce0..581647922 100644 --- a/volatility3/framework/deprecation.py +++ b/volatility3/framework/deprecation.py @@ -79,7 +79,7 @@ def deprecated_method( "This is a bug, the deprecated call needs to be removed and the caller needs to update their code to use the new method.", ) - deprecation_msg = f"Method \"{deprecated_func.__module__ + '.' + deprecated_func.__qualname__}\" is deprecated and will be removed in the first release after {removal_date}, use \"{replacement.__module__ + '.' + replacement.__qualname__}\" instead. {additional_information}" + deprecation_msg = f'Method "{deprecated_func.__module__ + "." + deprecated_func.__qualname__}" is deprecated and will be removed in the first release after {removal_date}, use "{replacement.__module__ + "." + replacement.__qualname__}" instead. {additional_information}' warnings.warn(deprecation_msg, FutureWarning) # Return the wrapped function with its original arguments return deprecated_func(*args, **kwargs) diff --git a/volatility3/framework/exceptions.py b/volatility3/framework/exceptions.py index 34b41727a..3b70c5c29 100644 --- a/volatility3/framework/exceptions.py +++ b/volatility3/framework/exceptions.py @@ -8,6 +8,7 @@ space or symbol tables, and by layers when an address is invalid. The :class:`PagedInvalidAddressException` contains information about the size of the invalid page. """ + from typing import Callable, Dict, Optional, Tuple from volatility3.framework import interfaces @@ -161,4 +162,4 @@ class VersionMismatchException(VolatilityException): self.failure_reason = failure_reason def __str__(self): - return f"{self.source_component.__module__+ '.' + self.source_component.__qualname__}: Version {self.target_version} dependency on {self.target_component.__module__+ '.' + self.target_component.__name__} {self.target_component.version} unmet." + return f"{self.source_component.__module__ + '.' + self.source_component.__qualname__}: Version {self.target_version} dependency on {self.target_component.__module__ + '.' + self.target_component.__name__} {self.target_component.version} unmet." diff --git a/volatility3/framework/interfaces/automagic.py b/volatility3/framework/interfaces/automagic.py index 4ac386fc0..744a33bab 100644 --- a/volatility3/framework/interfaces/automagic.py +++ b/volatility3/framework/interfaces/automagic.py @@ -7,6 +7,7 @@ runs. Automagic objects attempt to automatically fill configuration values that a user has not filled. """ + import logging from abc import ABCMeta from typing import Any, List, Optional, Tuple, Type, Union diff --git a/volatility3/framework/interfaces/context.py b/volatility3/framework/interfaces/context.py index 4f863898e..0b71e4cb2 100644 --- a/volatility3/framework/interfaces/context.py +++ b/volatility3/framework/interfaces/context.py @@ -11,6 +11,7 @@ convenience functions, most notably the object constructor function, `object`, which will construct a symbol on a layer at a particular offset. """ + import collections import copy from abc import ABCMeta, abstractmethod diff --git a/volatility3/framework/interfaces/layers.py b/volatility3/framework/interfaces/layers.py index 6c4e4b419..2e328124d 100644 --- a/volatility3/framework/interfaces/layers.py +++ b/volatility3/framework/interfaces/layers.py @@ -6,6 +6,7 @@ One layer may combine other layers, map data based on the data itself, or map a procedure (such as decryption) across another layer of data. """ + import collections.abc import functools import logging diff --git a/volatility3/framework/interfaces/objects.py b/volatility3/framework/interfaces/objects.py index 2d8024465..7f67cf586 100644 --- a/volatility3/framework/interfaces/objects.py +++ b/volatility3/framework/interfaces/objects.py @@ -3,6 +3,7 @@ # """Objects are the core of volatility, and provide pythonic access to interpreted values of data from a layer.""" + import abc import collections import collections.abc diff --git a/volatility3/framework/interfaces/symbols.py b/volatility3/framework/interfaces/symbols.py index 925be72c9..1159fd290 100644 --- a/volatility3/framework/interfaces/symbols.py +++ b/volatility3/framework/interfaces/symbols.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """Symbols provide structural information about a set of bytes.""" + import bisect import collections.abc from abc import ABC, abstractmethod diff --git a/volatility3/framework/layers/avml.py b/volatility3/framework/layers/avml.py index 2e5572192..7c052f70a 100644 --- a/volatility3/framework/layers/avml.py +++ b/volatility3/framework/layers/avml.py @@ -6,6 +6,7 @@ The user of the file doesn't have to worry about the compression, but random access is not allowed.""" + import ctypes import logging import struct diff --git a/volatility3/framework/layers/codecs/__init__.py b/volatility3/framework/layers/codecs/__init__.py index e019bcbcd..5b9f2602b 100644 --- a/volatility3/framework/layers/codecs/__init__.py +++ b/volatility3/framework/layers/codecs/__init__.py @@ -2,7 +2,4 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -"""Codecs used for encoding or decoding data should live here - - -""" +"""Codecs used for encoding or decoding data should live here""" diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 696c33353..848580004 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -315,7 +315,13 @@ class Intel(linear.LinearlyMappedLayer): ): # The block isn't contiguous if stashed_offset is not None: - yield stashed_offset, stashed_size, stashed_mapped_offset, stashed_mapped_size, stashed_map_layer + yield ( + stashed_offset, + stashed_size, + stashed_mapped_offset, + stashed_mapped_size, + stashed_map_layer, + ) # Update all the stashed values after output stashed_offset = offset stashed_mapped_offset = mapped_offset @@ -334,7 +340,13 @@ class Intel(linear.LinearlyMappedLayer): and stashed_mapped_size is not None and stashed_map_layer is not None ): - yield stashed_offset, stashed_size, stashed_mapped_offset, stashed_mapped_size, stashed_map_layer + yield ( + stashed_offset, + stashed_size, + stashed_mapped_offset, + stashed_mapped_size, + stashed_map_layer, + ) def _mapping( self, offset: int, length: int, ignore_errors: bool = False diff --git a/volatility3/framework/layers/msf.py b/volatility3/framework/layers/msf.py index 2b4fae963..a7bf6466e 100644 --- a/volatility3/framework/layers/msf.py +++ b/volatility3/framework/layers/msf.py @@ -234,9 +234,13 @@ class PdbMSFStream(linear.LinearlyMappedLayer): layer_name=self.name, invalid_address=offset + returned ) else: - yield offset + returned, chunk_size, ( - self._pages[page] * page_size - ) + page_position, chunk_size, self._base_layer + yield ( + offset + returned, + chunk_size, + (self._pages[page] * page_size) + page_position, + chunk_size, + self._base_layer, + ) returned += chunk_size length -= chunk_size diff --git a/volatility3/framework/layers/resources.py b/volatility3/framework/layers/resources.py index 6121c2cff..66fb617af 100644 --- a/volatility3/framework/layers/resources.py +++ b/volatility3/framework/layers/resources.py @@ -305,8 +305,9 @@ class JarHandler(VolatilityHandler): def default_open(req: urllib.request.Request) -> Optional[Any]: """Handles the request if it's the jar scheme.""" if req.type == "jar": - subscheme, remainder = req.full_url.split(":")[1], ":".join( - req.full_url.split(":")[2:] + subscheme, remainder = ( + req.full_url.split(":")[1], + ":".join(req.full_url.split(":")[2:]), ) if subscheme != "file": vollog.log( diff --git a/volatility3/framework/layers/segmented.py b/volatility3/framework/layers/segmented.py index 9825ae15c..96b9618dc 100644 --- a/volatility3/framework/layers/segmented.py +++ b/volatility3/framework/layers/segmented.py @@ -129,7 +129,13 @@ class NonLinearlySegmentedLayer( return None # Crop it to the amount we need left chunk_size = min(size, length + offset - logical_offset) - yield logical_offset, chunk_size, mapped_offset, mapped_size, self._base_layer + yield ( + logical_offset, + chunk_size, + mapped_offset, + mapped_size, + self._base_layer, + ) current_offset += chunk_size # Terminate if we've gone (or reached) our required limit if current_offset >= offset + length: diff --git a/volatility3/framework/layers/vmware.py b/volatility3/framework/layers/vmware.py index 39fb21b63..5dc00f344 100644 --- a/volatility3/framework/layers/vmware.py +++ b/volatility3/framework/layers/vmware.py @@ -65,10 +65,10 @@ class VmwareLayer(segmented.SegmentedLayer): data = meta_layer.read(0, header_size) magic, unknown, groupCount = struct.unpack(self.header_structure, data) if magic not in [ - b"\xD0\xBE\xD2\xBE", - b"\xD1\xBA\xD1\xBA", - b"\xD2\xBE\xD2\xBE", - b"\xD3\xBE\xD3\xBE", + b"\xd0\xbe\xd2\xbe", + b"\xd1\xba\xd1\xba", + b"\xd2\xbe\xd2\xbe", + b"\xd3\xbe\xd3\xbe", ]: raise VmwareFormatException( self.name, f"Wrong magic bytes for Vmware layer: {repr(magic)}" diff --git a/volatility3/framework/plugins/banners.py b/volatility3/framework/plugins/banners.py index d4e6e2aa8..eea39206d 100644 --- a/volatility3/framework/plugins/banners.py +++ b/volatility3/framework/plugins/banners.py @@ -60,8 +60,9 @@ class Banners(interfaces.plugins.PluginInterface): not in b" #()+,;/-.0123456789:@ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz~" ] if not failed: - yield format_hints.Hex(offset), str( - data, encoding="latin-1", errors="?" + yield ( + format_hints.Hex(offset), + str(data, encoding="latin-1", errors="?"), ) def run(self): diff --git a/volatility3/framework/plugins/isfinfo.py b/volatility3/framework/plugins/isfinfo.py index 1c2ac52e9..10f391321 100644 --- a/volatility3/framework/plugins/isfinfo.py +++ b/volatility3/framework/plugins/isfinfo.py @@ -72,9 +72,12 @@ class IsfInfo(plugins.PluginInterface): for extension in constants.ISF_EXTENSIONS: # By ending with an extension (and therefore, not /), we should not return any directories if name.endswith(extension): - yield "jar:file:" + str( - pathlib.Path(base_name) - ) + "!" + name + yield ( + "jar:file:" + + str(pathlib.Path(base_name)) + + "!" + + name + ) else: for extension in constants.ISF_EXTENSIONS: diff --git a/volatility3/framework/plugins/linux/graphics/fbdev.py b/volatility3/framework/plugins/linux/graphics/fbdev.py index 1f9fd74b5..ebdbd1706 100644 --- a/volatility3/framework/plugins/linux/graphics/fbdev.py +++ b/volatility3/framework/plugins/linux/graphics/fbdev.py @@ -245,7 +245,6 @@ You can try using ffmpeg to decode the raw buffer. Example usage: return fb def _generator(self): - if not has_pil: vollog.error( "PIL (pillow) module is required to use this plugin. Please install it manually or through pyproject.toml." diff --git a/volatility3/framework/plugins/linux/ip.py b/volatility3/framework/plugins/linux/ip.py index 348f3c13f..164fe62dd 100644 --- a/volatility3/framework/plugins/linux/ip.py +++ b/volatility3/framework/plugins/linux/ip.py @@ -47,7 +47,17 @@ class Addr(plugins.PluginInterface): prefix_len = in_ifaddr.get_prefix_len() scope_type = in_ifaddr.get_scope_type() ip_addr = in_ifaddr.get_address() - yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip_addr, prefix_len, scope_type, operational_state + yield ( + net_ns_id, + iface_ifindex, + iface_name, + mac_addr, + promisc, + ip_addr, + prefix_len, + scope_type, + operational_state, + ) # Interface IPv6 Addresses inet6_dev = net_dev.ip6_ptr.dereference().cast("inet6_dev") @@ -55,7 +65,17 @@ class Addr(plugins.PluginInterface): prefix_len = inet6_ifaddr.get_prefix_len() scope_type = inet6_ifaddr.get_scope_type() ip6_addr = inet6_ifaddr.get_address() - yield net_ns_id, iface_ifindex, iface_name, mac_addr, promisc, ip6_addr, prefix_len, scope_type, operational_state + yield ( + net_ns_id, + iface_ifindex, + iface_name, + mac_addr, + promisc, + ip6_addr, + prefix_len, + scope_type, + operational_state, + ) def _enumerate_net_namespace_list(self): vmlinux = self.context.modules[self.config["kernel"]] @@ -82,16 +102,19 @@ class Addr(plugins.PluginInterface): scope_type, operational_state, ) in self._gather_net_dev_info(net_dev): - yield 0, ( - net_ns_id or renderers.NotAvailableValue(), - iface_ifindex, - iface_name, - mac_addr, - promisc, - ip6_addr, - prefix_len, - scope_type, - operational_state, + yield ( + 0, + ( + net_ns_id or renderers.NotAvailableValue(), + iface_ifindex, + iface_name, + mac_addr, + promisc, + ip6_addr, + prefix_len, + scope_type, + operational_state, + ), ) def run(self): @@ -150,7 +173,16 @@ class Link(plugins.PluginInterface): ] flags_str = ",".join(flags_list) - yield net_ns_id or renderers.NotAvailableValue(), iface_name, mac_addr, operational_state, mtu, qdisc_name or renderers.NotAvailableValue(), qlen, flags_str + yield ( + net_ns_id or renderers.NotAvailableValue(), + iface_name, + mac_addr, + operational_state, + mtu, + qdisc_name or renderers.NotAvailableValue(), + qlen, + flags_str, + ) def _generator(self): vmlinux = self.context.modules[self.config["kernel"]] diff --git a/volatility3/framework/plugins/linux/kmsg.py b/volatility3/framework/plugins/linux/kmsg.py index 1069a312f..ba02763d0 100644 --- a/volatility3/framework/plugins/linux/kmsg.py +++ b/volatility3/framework/plugins/linux/kmsg.py @@ -551,12 +551,15 @@ class Kmsg(interfaces.plugins.PluginInterface): for facility, level, timestamp, caller, line in ABCKmsg.run_all( context=self.context, config=self.config ): - yield 0, ( - facility, - level, - timestamp, - caller or renderers.NotAvailableValue(), - line, + yield ( + 0, + ( + facility, + level, + timestamp, + caller or renderers.NotAvailableValue(), + line, + ), ) def run(self): diff --git a/volatility3/framework/plugins/linux/lsof.py b/volatility3/framework/plugins/linux/lsof.py index 283eabca0..be521750a 100644 --- a/volatility3/framework/plugins/linux/lsof.py +++ b/volatility3/framework/plugins/linux/lsof.py @@ -220,5 +220,9 @@ class Lsof(plugins.PluginInterface, timeliner.TimeLinerInterface): ) yield description, timeliner.TimeLinerType.CHANGED, fd_user.change_time - yield description, timeliner.TimeLinerType.MODIFIED, fd_user.modification_time + yield ( + description, + timeliner.TimeLinerType.MODIFIED, + fd_user.modification_time, + ) yield description, timeliner.TimeLinerType.ACCESSED, fd_user.access_time diff --git a/volatility3/framework/plugins/linux/malware/check_afinfo.py b/volatility3/framework/plugins/linux/malware/check_afinfo.py index 47da21615..4ecf5f788 100644 --- a/volatility3/framework/plugins/linux/malware/check_afinfo.py +++ b/volatility3/framework/plugins/linux/malware/check_afinfo.py @@ -3,6 +3,7 @@ # """A module containing a plugin that verifies the operation function pointers of network protocols.""" + import logging from typing import List, Tuple, Generator diff --git a/volatility3/framework/plugins/linux/malware/check_syscall.py b/volatility3/framework/plugins/linux/malware/check_syscall.py index 1188bf250..6476d6621 100644 --- a/volatility3/framework/plugins/linux/malware/check_syscall.py +++ b/volatility3/framework/plugins/linux/malware/check_syscall.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """A module containing a plugin that checks the system call table for hooks.""" + import contextlib import logging from typing import List diff --git a/volatility3/framework/plugins/linux/malware/netfilter.py b/volatility3/framework/plugins/linux/malware/netfilter.py index d724d4296..6bc5cd1bf 100644 --- a/volatility3/framework/plugins/linux/malware/netfilter.py +++ b/volatility3/framework/plugins/linux/malware/netfilter.py @@ -223,7 +223,16 @@ class AbstractNetfilter(ABC): ) hooked = module_info is None - yield netns, proto_name, hook_name, priority, hook_ops_hook, module_info, symbol_name, hooked + yield ( + netns, + proto_name, + hook_name, + priority, + hook_ops_hook, + module_info, + symbol_name, + hooked, + ) @classmethod @abstractmethod diff --git a/volatility3/framework/plugins/linux/malware/tty_check.py b/volatility3/framework/plugins/linux/malware/tty_check.py index 1547c5cc6..00e85f251 100644 --- a/volatility3/framework/plugins/linux/malware/tty_check.py +++ b/volatility3/framework/plugins/linux/malware/tty_check.py @@ -100,11 +100,14 @@ class Tty_Check(plugins.PluginInterface): else: module_name = renderers.NotAvailableValue() - yield 0, ( - name, - format_hints.Hex(recv_buf), - module_name, - symbol_name or renderers.NotAvailableValue(), + yield ( + 0, + ( + name, + format_hints.Hex(recv_buf), + module_name, + symbol_name or renderers.NotAvailableValue(), + ), ) def run(self): diff --git a/volatility3/framework/plugins/linux/module_extract.py b/volatility3/framework/plugins/linux/module_extract.py index 97824aca0..a8864281a 100644 --- a/volatility3/framework/plugins/linux/module_extract.py +++ b/volatility3/framework/plugins/linux/module_extract.py @@ -75,10 +75,13 @@ class ModuleExtract(interfaces.plugins.PluginInterface): with self.open(file_name) as file_handle: file_handle.write(elf_data) - yield 0, ( - format_hints.Hex(base_address), - len(elf_data), - file_handle.preferred_filename, + yield ( + 0, + ( + format_hints.Hex(base_address), + len(elf_data), + file_handle.preferred_filename, + ), ) def run(self): diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 1fd96d5d2..2d20a2fb1 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -386,7 +386,11 @@ class Files(plugins.PluginInterface, timeliner.TimeLinerInterface): inode_out = inode_in.to_user(vmlinux_layer) description = f"Cached Inode for {inode_out.path}" yield description, timeliner.TimeLinerType.ACCESSED, inode_out.access_time - yield description, timeliner.TimeLinerType.MODIFIED, inode_out.modification_time + yield ( + description, + timeliner.TimeLinerType.MODIFIED, + inode_out.modification_time, + ) yield description, timeliner.TimeLinerType.CHANGED, inode_out.change_time @classmethod @@ -813,7 +817,6 @@ class RecoverFs(plugins.PluginInterface): visited_paths = seen_prefixes = set() for inode_in in inodes_iter: - # Code is slightly duplicated here with the if-block below. # However this prevents unneeded tar manipulation if fifo # or sock inodes come through for example. diff --git a/volatility3/framework/plugins/linux/pslist.py b/volatility3/framework/plugins/linux/pslist.py index 9b31976ec..71caa0853 100644 --- a/volatility3/framework/plugins/linux/pslist.py +++ b/volatility3/framework/plugins/linux/pslist.py @@ -225,18 +225,21 @@ class PsList(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): task_euid = self._format_cred(task_fields.euid) task_egid = self._format_cred(task_fields.egid) - yield 0, ( - format_hints.Hex(task_fields.offset), - task_fields.user_pid, - task_fields.user_tid, - task_fields.user_ppid, - task_fields.name, - task_uid, - task_gid, - task_euid, - task_egid, - task_fields.creation_time or renderers.NotAvailableValue(), - file_output, + yield ( + 0, + ( + format_hints.Hex(task_fields.offset), + task_fields.user_pid, + task_fields.user_tid, + task_fields.user_ppid, + task_fields.name, + task_uid, + task_gid, + task_euid, + task_egid, + task_fields.creation_time or renderers.NotAvailableValue(), + file_output, + ), ) @classmethod diff --git a/volatility3/framework/plugins/linux/tracing/perf_events.py b/volatility3/framework/plugins/linux/tracing/perf_events.py index 23b2f2c72..ff922784d 100644 --- a/volatility3/framework/plugins/linux/tracing/perf_events.py +++ b/volatility3/framework/plugins/linux/tracing/perf_events.py @@ -70,7 +70,6 @@ class PerfEvents(plugins.PluginInterface): for task in pslist.PsList.list_tasks( context, vmlinux_module_name, include_threads=True ): - # walk the list of perf_event entries for this process for event in task.perf_event_list.to_list( vmlinux.symbol_table_name + constants.BANG + "perf_event", "owner_entry" diff --git a/volatility3/framework/plugins/linux/vmaregexscan.py b/volatility3/framework/plugins/linux/vmaregexscan.py index fb757beb5..2fde3aadc 100644 --- a/volatility3/framework/plugins/linux/vmaregexscan.py +++ b/volatility3/framework/plugins/linux/vmaregexscan.py @@ -64,7 +64,6 @@ class VmaRegExScan(plugins.PluginInterface): vollog.debug(f"RegEx Pattern: {regex_pattern}") for task in tasks: - if not task.mm: continue name = utility.array_to_string(task.comm) @@ -106,12 +105,15 @@ class VmaRegExScan(plugins.PluginInterface): bytes_result = result_data user_pid = task.tgid - yield 0, ( - user_pid, - name, - format_hints.Hex(offset), - text_result, - bytes_result, + yield ( + 0, + ( + user_pid, + name, + format_hints.Hex(offset), + text_result, + bytes_result, + ), ) def run(self): diff --git a/volatility3/framework/plugins/linux/vmayarascan.py b/volatility3/framework/plugins/linux/vmayarascan.py index 64f5827c1..d9466f512 100644 --- a/volatility3/framework/plugins/linux/vmayarascan.py +++ b/volatility3/framework/plugins/linux/vmayarascan.py @@ -103,12 +103,15 @@ class VmaYaraScan(interfaces.plugins.PluginInterface): layer_name=proc_layer.name, length=len(value), ) - yield 0, ( - format_hints.Hex(offset), - task.tgid, - rule_name, - name, - layer_data, + yield ( + 0, + ( + format_hints.Hex(offset), + task.tgid, + rule_name, + name, + layer_data, + ), ) @classmethod diff --git a/volatility3/framework/plugins/mac/lsmod.py b/volatility3/framework/plugins/mac/lsmod.py index c6f57f889..05a0ee72f 100644 --- a/volatility3/framework/plugins/mac/lsmod.py +++ b/volatility3/framework/plugins/mac/lsmod.py @@ -3,6 +3,7 @@ # """A module containing a collection of plugins that produce data typically found in Mac's lsmod command.""" + from typing import Set from volatility3.framework import renderers, interfaces, exceptions diff --git a/volatility3/framework/plugins/mac/mount.py b/volatility3/framework/plugins/mac/mount.py index 0f3aa745c..3d9dcd916 100644 --- a/volatility3/framework/plugins/mac/mount.py +++ b/volatility3/framework/plugins/mac/mount.py @@ -3,6 +3,7 @@ # """A module containing a collection of plugins that produce data typically found in Mac's mount command.""" + from volatility3.framework import renderers, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins diff --git a/volatility3/framework/plugins/mac/psaux.py b/volatility3/framework/plugins/mac/psaux.py index ba9b7b5f6..bdcfb1466 100644 --- a/volatility3/framework/plugins/mac/psaux.py +++ b/volatility3/framework/plugins/mac/psaux.py @@ -2,6 +2,7 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # """In-memory artifacts from OSX systems.""" + from typing import Iterator, Tuple, Any, Generator, List from volatility3.framework import exceptions, renderers, interfaces diff --git a/volatility3/framework/plugins/windows/callbacks.py b/volatility3/framework/plugins/windows/callbacks.py index b8c9fe751..2a65f76bb 100644 --- a/volatility3/framework/plugins/windows/callbacks.py +++ b/volatility3/framework/plugins/windows/callbacks.py @@ -78,7 +78,6 @@ class Callbacks(interfaces.plugins.PluginInterface): def _create_default_scan_constraints( context: interfaces.context.ContextInterface, symbol_table: str ) -> List[poolscanner.PoolConstraint]: - shutdown_packet_size = context.symbol_space.get_type( symbol_table + constants.BANG + "_SHUTDOWN_PACKET" ).size @@ -590,7 +589,11 @@ class Callbacks(interfaces.plugins.PluginInterface): except exceptions.InvalidAddressException: component = renderers.UnreadableValue() - yield "KeBugCheckReasonCallbackListHead", callback.CallbackRoutine, component + yield ( + "KeBugCheckReasonCallbackListHead", + callback.CallbackRoutine, + component, + ) @classmethod def list_bugcheck_callbacks( diff --git a/volatility3/framework/plugins/windows/deskscan.py b/volatility3/framework/plugins/windows/deskscan.py index 35430be5d..202eaf330 100644 --- a/volatility3/framework/plugins/windows/deskscan.py +++ b/volatility3/framework/plugins/windows/deskscan.py @@ -77,6 +77,11 @@ class DeskScan(desktops.Desktops): continue for _thread, process_name, process_pid in desktop.get_threads(): - yield format_hints.Hex( - desktop.vol.offset - ), winsta_name, session_id, desktop_name, process_name, process_pid + yield ( + format_hints.Hex(desktop.vol.offset), + winsta_name, + session_id, + desktop_name, + process_name, + process_pid, + ) diff --git a/volatility3/framework/plugins/windows/desktops.py b/volatility3/framework/plugins/windows/desktops.py index c6557085e..f2a985c6b 100644 --- a/volatility3/framework/plugins/windows/desktops.py +++ b/volatility3/framework/plugins/windows/desktops.py @@ -63,9 +63,14 @@ class Desktops(interfaces.plugins.PluginInterface): for desktop, desktop_name in winsta.desktops(kernel.symbol_table_name): # for each desktop, walk its threads for _thread, process_name, process_pid in desktop.get_threads(): - yield format_hints.Hex( - desktop.vol.offset - ), station_name, session_id, desktop_name, process_name, process_pid + yield ( + format_hints.Hex(desktop.vol.offset), + station_name, + session_id, + desktop_name, + process_name, + process_pid, + ) def _generator(self): kernel_name = self.config["kernel"] diff --git a/volatility3/framework/plugins/windows/kpcrs.py b/volatility3/framework/plugins/windows/kpcrs.py index 213e3833c..d544fd498 100644 --- a/volatility3/framework/plugins/windows/kpcrs.py +++ b/volatility3/framework/plugins/windows/kpcrs.py @@ -96,7 +96,6 @@ class KPCRs(interfaces.plugins.PluginInterface): yield kpcr, kpcr.member(kpcr_member) def _generator(self) -> Iterator[Tuple]: - for kpcr, current_prcb in self.list_kpcrs(self.context, self.config["kernel"]): yield ( 0, diff --git a/volatility3/framework/plugins/windows/malware/direct_system_calls.py b/volatility3/framework/plugins/windows/malware/direct_system_calls.py index dce09605b..f6b9e53bb 100644 --- a/volatility3/framework/plugins/windows/malware/direct_system_calls.py +++ b/volatility3/framework/plugins/windows/malware/direct_system_calls.py @@ -451,12 +451,15 @@ class DirectSystemCalls(interfaces.plugins.PluginInterface): address, disasm_bytes = syscall_info - yield 0, ( - proc_name, - proc.UniqueProcessId, - vad_path, - format_hints.Hex(address), - disasm_bytes, + yield ( + 0, + ( + proc_name, + proc.UniqueProcessId, + vad_path, + format_hints.Hex(address), + disasm_bytes, + ), ) def run(self) -> renderers.TreeGrid: diff --git a/volatility3/framework/plugins/windows/malware/hollowprocesses.py b/volatility3/framework/plugins/windows/malware/hollowprocesses.py index f981ae340..1ea46b540 100644 --- a/volatility3/framework/plugins/windows/malware/hollowprocesses.py +++ b/volatility3/framework/plugins/windows/malware/hollowprocesses.py @@ -198,10 +198,13 @@ class HollowProcesses(interfaces.plugins.PluginInterface): for check in checks: for note in check(proc, vads, dlls): - yield 0, ( - pid, - proc_name, - note, + yield ( + 0, + ( + pid, + proc_name, + note, + ), ) def run(self): diff --git a/volatility3/framework/plugins/windows/malware/malfind.py b/volatility3/framework/plugins/windows/malware/malfind.py index 01da93e1f..2f6d9eb56 100644 --- a/volatility3/framework/plugins/windows/malware/malfind.py +++ b/volatility3/framework/plugins/windows/malware/malfind.py @@ -92,8 +92,11 @@ class Malfind(interfaces.plugins.PluginInterface): for vad, data_object in cls.list_injection_sites( context, kernel_layer_name, symbol_table, proc ): - yield vad, data_object.context.layers[data_object.layer_name].read( - data_object.offset, data_object.length + yield ( + vad, + data_object.context.layers[data_object.layer_name].read( + data_object.offset, data_object.length + ), ) @classmethod diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index dd85fb570..cd898239f 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -167,7 +167,6 @@ class PebMasquerade(interfaces.plugins.PluginInterface): if isinstance(peb_imagefilepath, str) and peb: try: - # Length values are of type USHORT peb_imagefilepath_length = ( peb.ProcessParameters.ImagePathName.Length // 2 diff --git a/volatility3/framework/plugins/windows/malware/processghosting.py b/volatility3/framework/plugins/windows/malware/processghosting.py index f234bc2e7..fb8ec527d 100644 --- a/volatility3/framework/plugins/windows/malware/processghosting.py +++ b/volatility3/framework/plugins/windows/malware/processghosting.py @@ -149,9 +149,12 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): for file_object_address, delete_pending, delete_on_close in cls._vad_checks( control_area, path ): - yield format_hints.Hex( - file_object_address - ), delete_pending, delete_on_close, vad_base + yield ( + format_hints.Hex(file_object_address), + delete_pending, + delete_on_close, + vad_base, + ) def _generator(self, procs): kernel = self.context.modules[self.config["kernel"]] @@ -187,14 +190,17 @@ class ProcessGhosting(interfaces.plugins.PluginInterface): else: path = renderers.NotAvailableValue() - yield 0, ( - pid, - process_name, - format_hints.Hex(base_address), - format_hints.Hex(file_object_address), - delete_pending or renderers.NotApplicableValue(), - delete_on_close or renderers.NotApplicableValue(), - path, + yield ( + 0, + ( + pid, + process_name, + format_hints.Hex(base_address), + format_hints.Hex(file_object_address), + delete_pending or renderers.NotApplicableValue(), + delete_on_close or renderers.NotApplicableValue(), + path, + ), ) def run(self): diff --git a/volatility3/framework/plugins/windows/malware/skeleton_key_check.py b/volatility3/framework/plugins/windows/malware/skeleton_key_check.py index d9cba0704..10c6222bc 100644 --- a/volatility3/framework/plugins/windows/malware/skeleton_key_check.py +++ b/volatility3/framework/plugins/windows/malware/skeleton_key_check.py @@ -648,12 +648,15 @@ class Skeleton_Key_Check(interfaces.plugins.PluginInterface): csystem, cryptdll_base, cryptdll_size ) - yield 0, ( - lsass_proc.UniqueProcessId, - "lsass.exe", - skeleton_key_present, - format_hints.Hex(csystem.Initialize), - format_hints.Hex(csystem.Decrypt), + yield ( + 0, + ( + lsass_proc.UniqueProcessId, + "lsass.exe", + skeleton_key_present, + format_hints.Hex(csystem.Initialize), + format_hints.Hex(csystem.Decrypt), + ), ) def _lsass_proc_filter(self, proc): diff --git a/volatility3/framework/plugins/windows/malware/suspicious_threads.py b/volatility3/framework/plugins/windows/malware/suspicious_threads.py index 3da8cb21a..803a0b04b 100644 --- a/volatility3/framework/plugins/windows/malware/suspicious_threads.py +++ b/volatility3/framework/plugins/windows/malware/suspicious_threads.py @@ -196,14 +196,17 @@ class SuspiciousThreads(interfaces.plugins.PluginInterface): for vad_path, note in self._check_thread_address( exe_path, ranges, address ): - yield 0, ( - proc_name, - pid, - tid, - context, - format_hints.Hex(address), - vad_path, - note, + yield ( + 0, + ( + proc_name, + pid, + tid, + context, + format_hints.Hex(address), + vad_path, + note, + ), ) def run(self): diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index f0be3cf7f..2dfecb93b 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -132,19 +132,22 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # There should only be one STANDARD_INFORMATION attribute, but we # do this just in case. for std_information in mft_record.standard_information_entries(): - yield 0, cls.MFTScanResult( - format_hints.Hex(std_information.vol.offset), - str(mft_record.get_signature()), - mft_record.RecordNumber, - mft_record.LinkCount, - mft_flag, - renderers.NotApplicableValue(), - "STANDARD_INFORMATION", - conversion.wintime_to_datetime(std_information.CreationTime), - conversion.wintime_to_datetime(std_information.ModifiedTime), - conversion.wintime_to_datetime(std_information.UpdatedTime), - conversion.wintime_to_datetime(std_information.AccessedTime), - renderers.NotApplicableValue(), + yield ( + 0, + cls.MFTScanResult( + format_hints.Hex(std_information.vol.offset), + str(mft_record.get_signature()), + mft_record.RecordNumber, + mft_record.LinkCount, + mft_flag, + renderers.NotApplicableValue(), + "STANDARD_INFORMATION", + conversion.wintime_to_datetime(std_information.CreationTime), + conversion.wintime_to_datetime(std_information.ModifiedTime), + conversion.wintime_to_datetime(std_information.UpdatedTime), + conversion.wintime_to_datetime(std_information.AccessedTime), + renderers.NotApplicableValue(), + ), ) except exceptions.InvalidAddressException: pass @@ -163,26 +166,28 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # File Name Attribute try: for filename_info in mft_record.filename_entries(): - # If we don't have a valid enum, coerce to hex so we can keep the record try: permissions = filename_info.Flags.lookup() except ValueError: permissions = hex(filename_info.Flags) - yield 1, cls.MFTScanResult( - format_hints.Hex(filename_info.vol.offset), - str(mft_record.get_signature()), - mft_record.RecordNumber, - mft_record.LinkCount, - mft_flag, - permissions, - "FILE_NAME", - conversion.wintime_to_datetime(filename_info.CreationTime), - conversion.wintime_to_datetime(filename_info.ModifiedTime), - conversion.wintime_to_datetime(filename_info.UpdatedTime), - conversion.wintime_to_datetime(filename_info.AccessedTime), - filename_info.get_full_name(), + yield ( + 1, + cls.MFTScanResult( + format_hints.Hex(filename_info.vol.offset), + str(mft_record.get_signature()), + mft_record.RecordNumber, + mft_record.LinkCount, + mft_flag, + permissions, + "FILE_NAME", + conversion.wintime_to_datetime(filename_info.CreationTime), + conversion.wintime_to_datetime(filename_info.ModifiedTime), + conversion.wintime_to_datetime(filename_info.UpdatedTime), + conversion.wintime_to_datetime(filename_info.AccessedTime), + filename_info.get_full_name(), + ), ) except exceptions.InvalidAddressException: return @@ -214,22 +219,25 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): # but in this case memory usage is so extreme due to the number of # records that it becomes necessary. The rich types are still # exposed through classmethods. - yield level, ( - record.offset, - record.record_type, - int(record.record_number), - int(record.link_count), - record.mft_type, - record.permissions, - record.attribute_type, - record.created, - record.modified, - record.updated, - record.accessed, + yield ( + level, ( - str(record.filename) - if isinstance(record.filename, objects.String) - else record.filename + record.offset, + record.record_type, + int(record.record_number), + int(record.link_count), + record.mft_type, + record.permissions, + record.attribute_type, + record.created, + record.modified, + record.updated, + record.accessed, + ( + str(record.filename) + if isinstance(record.filename, objects.String) + else record.filename + ), ), ) @@ -344,22 +352,25 @@ class ADS(interfaces.plugins.PluginInterface): # but in this case memory usage is so extreme due to the number of # records that it becomes necessary. The rich types are still # exposed through classmethods. - yield 0, ( - record.offset, - str(record.signature), - int(record.record_number), - record.attribute_type, + yield ( + 0, ( - str(record.filename) - if isinstance(record.filename, objects.String) - else record.filename + record.offset, + str(record.signature), + int(record.record_number), + record.attribute_type, + ( + str(record.filename) + if isinstance(record.filename, objects.String) + else record.filename + ), + ( + str(record.stream_name) + if isinstance(record.stream_name, objects.String) + else record.stream_name + ), + record.content, ), - ( - str(record.stream_name) - if isinstance(record.stream_name, objects.String) - else record.stream_name - ), - record.content, ) def run(self): @@ -454,13 +465,16 @@ class ResidentData(interfaces.plugins.PluginInterface): # but in this case memory usage is so extreme due to the number of # records that it becomes necessary. The rich types are still # exposed through classmethods. - yield 0, ( - resident_data_entry.offset, - str(resident_data_entry.signature), - int(resident_data_entry.record_number), - resident_data_entry.attribute_type, - str(resident_data_entry.filename), - resident_data_entry.content, + yield ( + 0, + ( + resident_data_entry.offset, + str(resident_data_entry.signature), + int(resident_data_entry.record_number), + resident_data_entry.attribute_type, + str(resident_data_entry.filename), + resident_data_entry.content, + ), ) def run(self): diff --git a/volatility3/framework/plugins/windows/modules.py b/volatility3/framework/plugins/windows/modules.py index 1ec965737..18a7b5919 100644 --- a/volatility3/framework/plugins/windows/modules.py +++ b/volatility3/framework/plugins/windows/modules.py @@ -119,13 +119,16 @@ class Modules(interfaces.plugins.PluginInterface): if self.config["dump"]: file_output = self.dump_module(session_layers, pe_table_name, mod) - yield 0, ( - format_hints.Hex(mod.vol.offset), - format_hints.Hex(mod.DllBase), - format_hints.Hex(mod.SizeOfImage), - BaseDllName, - FullDllName, - file_output, + yield ( + 0, + ( + format_hints.Hex(mod.vol.offset), + format_hints.Hex(mod.DllBase), + format_hints.Hex(mod.SizeOfImage), + BaseDllName, + FullDllName, + file_output, + ), ) @classmethod diff --git a/volatility3/framework/plugins/windows/poolscanner.py b/volatility3/framework/plugins/windows/poolscanner.py index 157282ce1..43dcd0482 100644 --- a/volatility3/framework/plugins/windows/poolscanner.py +++ b/volatility3/framework/plugins/windows/poolscanner.py @@ -436,7 +436,6 @@ class PoolScanner(plugins.PluginInterface): constraints, alignment=alignment, ): - mem_objects = header.get_object( constraint=constraint, use_top_down=is_windows_8_or_later, diff --git a/volatility3/framework/plugins/windows/registry/amcache.py b/volatility3/framework/plugins/windows/registry/amcache.py index a6ad1848e..ed078993c 100644 --- a/volatility3/framework/plugins/windows/registry/amcache.py +++ b/volatility3/framework/plugins/windows/registry/amcache.py @@ -246,13 +246,29 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) -> Iterator[Tuple[str, timeliner.TimeLinerType, datetime.datetime]]: for _, entry in self._generator(): if isinstance(entry.last_modify_time, datetime.datetime): - yield f"Amcache: {entry.entry_type} {entry.path} registry key modified", timeliner.TimeLinerType.MODIFIED, entry.last_modify_time + yield ( + f"Amcache: {entry.entry_type} {entry.path} registry key modified", + timeliner.TimeLinerType.MODIFIED, + entry.last_modify_time, + ) if isinstance(entry.last_modify_time_2, datetime.datetime): - yield f"Amcache: {entry.entry_type} {entry.path} STANDARD_INFORMATION create time", timeliner.TimeLinerType.CREATED, entry.last_modify_time_2 + yield ( + f"Amcache: {entry.entry_type} {entry.path} STANDARD_INFORMATION create time", + timeliner.TimeLinerType.CREATED, + entry.last_modify_time_2, + ) if isinstance(entry.install_time, datetime.datetime): - yield f"Amcache: {entry.entry_type} {entry.path} installed", timeliner.TimeLinerType.CREATED, entry.install_time + yield ( + f"Amcache: {entry.entry_type} {entry.path} installed", + timeliner.TimeLinerType.CREATED, + entry.install_time, + ) if isinstance(entry.compile_time, datetime.datetime): - yield f"Amcache: {entry.entry_type} {entry.path} compiled (PE metadata)", timeliner.TimeLinerType.MODIFIED, entry.compile_time + yield ( + f"Amcache: {entry.entry_type} {entry.path} compiled (PE metadata)", + timeliner.TimeLinerType.MODIFIED, + entry.compile_time, + ) @classmethod def get_amcache_hive( @@ -319,20 +335,23 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): vollog.debug(f"Found sha1hash {sha1_hash}") product_name = _get_string_value(values, val_enum.Product.value) - yield program_id, _AmcacheEntry( - AmcacheEntryType.File.name, - path=path, - company=company, - last_modify_time=last_mod_time, - last_modify_time_2=last_mod_time_2, - install_time=install_time, - compile_time=compile_time, - sha1_hash=( - sha1_hash.lstrip("0000") - if isinstance(sha1_hash, str) - else sha1_hash + yield ( + program_id, + _AmcacheEntry( + AmcacheEntryType.File.name, + path=path, + company=company, + last_modify_time=last_mod_time, + last_modify_time_2=last_mod_time_2, + install_time=install_time, + compile_time=compile_time, + sha1_hash=( + sha1_hash.lstrip("0000") + if isinstance(sha1_hash, str) + else sha1_hash + ), + product_name=product_name, ), - product_name=product_name, ) @classmethod @@ -365,15 +384,18 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): ) version = _get_string_value(values, val_enum.Version.value) - yield program_id, _AmcacheEntry( - AmcacheEntryType.Program.name, - company=company, - last_modify_time=conversion.wintime_to_datetime( - program_key.LastWriteTime.QuadPart + yield ( + program_id, + _AmcacheEntry( + AmcacheEntryType.Program.name, + company=company, + last_modify_time=conversion.wintime_to_datetime( + program_key.LastWriteTime.QuadPart + ), + install_time=install_time, + product_name=product, + product_version=version, ), - install_time=install_time, - product_name=product, - product_version=version, ) @classmethod @@ -411,14 +433,17 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): product: str = name if isinstance(name, str) else "UNKNOWN" # type: ignore - yield program_id.strip().strip("\u0000"), _AmcacheEntry( - AmcacheEntryType.Program.name, - path=path, - last_modify_time=last_mod, - install_time=install_date, - product_name=product, - company=publisher, - product_version=version, + yield ( + program_id.strip().strip("\u0000"), + _AmcacheEntry( + AmcacheEntryType.Program.name, + path=path, + last_modify_time=last_mod, + install_time=install_date, + product_name=product, + company=publisher, + product_version=version, + ), ) @classmethod @@ -456,19 +481,22 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): prod_ver = _get_string_value(values, val_enum.ProductVersion.value) program_id = _get_string_value(values, val_enum.ProgramID.value) - yield program_id, _AmcacheEntry( - AmcacheEntryType.File.name, - path=path, - company=publisher, - last_modify_time=last_mod, - compile_time=linkdate, - sha1_hash=( - sha1_hash.lstrip("0000") - if isinstance(sha1_hash, str) - else sha1_hash + yield ( + program_id, + _AmcacheEntry( + AmcacheEntryType.File.name, + path=path, + company=publisher, + last_modify_time=last_mod, + compile_time=linkdate, + sha1_hash=( + sha1_hash.lstrip("0000") + if isinstance(sha1_hash, str) + else sha1_hash + ), + product_name=prod_name, + product_version=prod_ver, ), - product_name=prod_name, - product_version=prod_ver, ) @classmethod @@ -485,7 +513,6 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): wanted_values = [key.value for key in val_enum] for binary_key in driver_binary_key.get_subkeys(): - values = { str(value.get_name()): value for value in binary_key.get_values() @@ -636,7 +663,6 @@ class Amcache(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): yield 0, empty_program def run(self): - return renderers.TreeGrid( [ ("EntryType", str), diff --git a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py index 2c660229b..a3e5fabe2 100644 --- a/volatility3/framework/plugins/windows/registry/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/registry/scheduled_tasks.py @@ -185,7 +185,6 @@ NULL = "\u0000" class _ScheduledTasksReader(io.BytesIO): - def read_task_scheduler_time(self) -> Optional[datetime.datetime]: _ = bool(self.read_aligned_u1()) # is_localized filetime = self.decode_filetime() @@ -393,7 +392,6 @@ class TaskAction: num_attachment_filenames = reader.read_u4() if num_attachment_filenames is not None: - attachment_filenames = [ reader.read_bstring() for _ in range(num_attachment_filenames) ] @@ -1138,11 +1136,23 @@ class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInte ) -> Iterator[Tuple[str, timeliner.TimeLinerType, datetime.datetime]]: for _, task in self._generator(): if isinstance(task.last_run_time, datetime.datetime): - yield f"ScheduledTasks: task action {task.action_description} with trigger {task.trigger_description} ran", timeliner.TimeLinerType.ACCESSED, task.last_run_time + yield ( + f"ScheduledTasks: task action {task.action_description} with trigger {task.trigger_description} ran", + timeliner.TimeLinerType.ACCESSED, + task.last_run_time, + ) if isinstance(task.last_successful_run_time, datetime.datetime): - yield f"ScheduledTasks: task action {task.action_description} with trigger {task.trigger_description} ran successfully", timeliner.TimeLinerType.ACCESSED, task.last_successful_run_time + yield ( + f"ScheduledTasks: task action {task.action_description} with trigger {task.trigger_description} ran successfully", + timeliner.TimeLinerType.ACCESSED, + task.last_successful_run_time, + ) if isinstance(task.creation_time, datetime.datetime): - yield f"ScheduledTasks: Creation Time for task {task.guid} with trigger {task.trigger_description or ''}", timeliner.TimeLinerType.CREATED, task.creation_time + yield ( + f"ScheduledTasks: Creation Time for task {task.guid} with trigger {task.trigger_description or ''}", + timeliner.TimeLinerType.CREATED, + task.creation_time, + ) @classmethod def get_software_hive( @@ -1203,7 +1213,6 @@ class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInte def parse_dynamic_info_value( cls, dyn_info_value: reg_extensions.CM_KEY_VALUE ) -> Optional[DynamicInfo]: - try: data = dyn_info_value.decode_data() except exceptions.InvalidAddressException: @@ -1318,7 +1327,6 @@ class ScheduledTasks(interfaces.plugins.PluginInterface, timeliner.TimeLinerInte all_actions = action_set.actions or [None] if action_set is not None else [None] for action, trigger in itertools.product(all_actions, all_triggers): - if action is not None: if action.action_type in ( ActionType.Exe, diff --git a/volatility3/framework/plugins/windows/sessions.py b/volatility3/framework/plugins/windows/sessions.py index 29d0b2104..158820529 100644 --- a/volatility3/framework/plugins/windows/sessions.py +++ b/volatility3/framework/plugins/windows/sessions.py @@ -95,13 +95,16 @@ class Sessions(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) # Group and yield each row for rows in sessions.values(): for row in rows: - yield 0, ( - row.get("session_id"), - row.get("session_type"), - row.get("process_id"), - row.get("process_name"), - row.get("user_name"), - row.get("process_start"), + yield ( + 0, + ( + row.get("session_id"), + row.get("session_type"), + row.get("process_id"), + row.get("process_name"), + row.get("user_name"), + row.get("process_start"), + ), ) def generate_timeline(self): diff --git a/volatility3/framework/plugins/windows/shimcachemem.py b/volatility3/framework/plugins/windows/shimcachemem.py index 7a03ebbb6..8935757d4 100644 --- a/volatility3/framework/plugins/windows/shimcachemem.py +++ b/volatility3/framework/plugins/windows/shimcachemem.py @@ -51,9 +51,17 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf ) -> Iterator[Tuple[str, timeliner.TimeLinerType, datetime]]: for _, (_, last_modified, last_update, _, _, file_path) in self._generator(): if isinstance(last_update, datetime): - yield f"Shimcache: File {file_path} executed", timeliner.TimeLinerType.ACCESSED, last_update + yield ( + f"Shimcache: File {file_path} executed", + timeliner.TimeLinerType.ACCESSED, + last_update, + ) if isinstance(last_modified, datetime): - yield f"Shimcache: File {file_path} modified", timeliner.TimeLinerType.MODIFIED, last_modified + yield ( + f"Shimcache: File {file_path} modified", + timeliner.TimeLinerType.MODIFIED, + last_modified, + ) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: @@ -161,7 +169,7 @@ class ShimcacheMem(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterf continue try: - if proc_layer.read(vad.get_start(), 4) != b"\xEF\xBE\xAD\xDE": + if proc_layer.read(vad.get_start(), 4) != b"\xef\xbe\xad\xde": if pid == 624: vollog.debug("VAD magic bytes don't match DEADBEEF") continue diff --git a/volatility3/framework/plugins/windows/svcscan.py b/volatility3/framework/plugins/windows/svcscan.py index 5f0e4761e..1bfb98fda 100644 --- a/volatility3/framework/plugins/windows/svcscan.py +++ b/volatility3/framework/plugins/windows/svcscan.py @@ -150,7 +150,6 @@ class SvcScan(interfaces.plugins.PluginInterface): def _get_service_key( context, config_path: str, kernel_module_name: str ) -> Optional[objects.StructType]: - for hive in hivelist.HiveList.list_hives( context=context, base_config_path=interfaces.configuration.path_join( diff --git a/volatility3/framework/plugins/windows/thrdscan.py b/volatility3/framework/plugins/windows/thrdscan.py index 082b82284..1588f292e 100644 --- a/volatility3/framework/plugins/windows/thrdscan.py +++ b/volatility3/framework/plugins/windows/thrdscan.py @@ -167,16 +167,19 @@ class ThrdScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface) info = self.gather_thread_info(ethread, vads_cache) if info: - yield 0, ( - format_hints.Hex(info.offset), - info.pid, - info.tid, - format_hints.Hex(info.start_addr), - info.start_path or renderers.NotAvailableValue(), - format_hints.Hex(info.win32_start_addr), - info.win32_start_path or renderers.NotAvailableValue(), - info.create_time, - info.exit_time, + yield ( + 0, + ( + format_hints.Hex(info.offset), + info.pid, + info.tid, + format_hints.Hex(info.start_addr), + info.start_path or renderers.NotAvailableValue(), + format_hints.Hex(info.win32_start_addr), + info.win32_start_path or renderers.NotAvailableValue(), + info.create_time, + info.exit_time, + ), ) def generate_timeline(self): diff --git a/volatility3/framework/plugins/windows/vadregexscan.py b/volatility3/framework/plugins/windows/vadregexscan.py index 068838e35..6a3cc394f 100644 --- a/volatility3/framework/plugins/windows/vadregexscan.py +++ b/volatility3/framework/plugins/windows/vadregexscan.py @@ -62,7 +62,6 @@ class VadRegExScan(plugins.PluginInterface): vollog.debug(f"RegEx Pattern: {regex_pattern}") for proc in procs: - # attempt to create a process layer for each proc proc_layer_name = proc.add_process_layer() if not proc_layer_name: @@ -106,12 +105,15 @@ class VadRegExScan(plugins.PluginInterface): max_length=proc.ImageFileName.vol.count, errors="replace", ) - yield 0, ( - proc_id, - process_name, - format_hints.Hex(offset), - text_result, - bytes_result, + yield ( + 0, + ( + proc_id, + process_name, + format_hints.Hex(offset), + text_result, + bytes_result, + ), ) def run(self): diff --git a/volatility3/framework/plugins/windows/vadyarascan.py b/volatility3/framework/plugins/windows/vadyarascan.py index bbbe49f2d..9a38213fa 100644 --- a/volatility3/framework/plugins/windows/vadyarascan.py +++ b/volatility3/framework/plugins/windows/vadyarascan.py @@ -100,21 +100,24 @@ class VadYaraScan(interfaces.plugins.PluginInterface): layer_name=layer.name, length=len(value), ) - yield 0, ( - format_hints.Hex(offset), - task.UniqueProcessId, - task.get_create_time(), - task.InheritedFromUniqueProcessId, - task.ImageFileName.cast( - "string", - max_length=task.ImageFileName.vol.count, - errors="replace", + yield ( + 0, + ( + format_hints.Hex(offset), + task.UniqueProcessId, + task.get_create_time(), + task.InheritedFromUniqueProcessId, + task.ImageFileName.cast( + "string", + max_length=task.ImageFileName.vol.count, + errors="replace", + ), + task.get_session_id(), + task.ActiveThreads, + rule_name, + name, + layer_data, ), - task.get_session_id(), - task.ActiveThreads, - rule_name, - name, - layer_data, ) @classmethod diff --git a/volatility3/framework/plugins/windows/windows.py b/volatility3/framework/plugins/windows/windows.py index 9d4317df9..c98869665 100644 --- a/volatility3/framework/plugins/windows/windows.py +++ b/volatility3/framework/plugins/windows/windows.py @@ -112,15 +112,18 @@ class Windows(interfaces.plugins.PluginInterface): ) continue - yield 0, ( - format_hints.Hex(window.vol.offset), - station_name, - sess_id, - desktop_name, - window_name or renderers.NotAvailableValue(), - window_proc, - process_name, - process_pid, + yield ( + 0, + ( + format_hints.Hex(window.vol.offset), + station_name, + sess_id, + desktop_name, + window_name or renderers.NotAvailableValue(), + window_proc, + process_name, + process_pid, + ), ) def run(self): diff --git a/volatility3/framework/renderers/__init__.py b/volatility3/framework/renderers/__init__.py index 8732e6e88..899c19196 100644 --- a/volatility3/framework/renderers/__init__.py +++ b/volatility3/framework/renderers/__init__.py @@ -6,6 +6,7 @@ Renderers display the unified output format in some manner (be it text or file or graphical output """ + import collections import collections.abc import dataclasses diff --git a/volatility3/framework/renderers/format_hints.py b/volatility3/framework/renderers/format_hints.py index d57c7e9f1..83f36a1a0 100644 --- a/volatility3/framework/renderers/format_hints.py +++ b/volatility3/framework/renderers/format_hints.py @@ -8,6 +8,7 @@ These hints allow a plugin to indicate how they would like data from a particula Text renderers should attempt to honour all hints provided in this module where possible """ + from typing import Type, Union from volatility3.framework import interfaces diff --git a/volatility3/framework/symbols/__init__.py b/volatility3/framework/symbols/__init__.py index 87f2288d7..a050298ba 100644 --- a/volatility3/framework/symbols/__init__.py +++ b/volatility3/framework/symbols/__init__.py @@ -210,9 +210,10 @@ class SymbolSpace(interfaces.symbols.SymbolSpaceInterface): replacements = set() # Whole Symbols that still need traversing while traverse_list: - template_traverse_list, traverse_list = [ - self._resolved[traverse_list[0]] - ], traverse_list[1:] + template_traverse_list, traverse_list = ( + [self._resolved[traverse_list[0]]], + traverse_list[1:], + ) # Traverse a single symbol looking for any ReferenceTemplate objects while template_traverse_list: traverser, template_traverse_list = ( diff --git a/volatility3/framework/symbols/intermed.py b/volatility3/framework/symbols/intermed.py index 33035bc70..001f817bd 100644 --- a/volatility3/framework/symbols/intermed.py +++ b/volatility3/framework/symbols/intermed.py @@ -246,9 +246,12 @@ class IntermediateSymbolTable(interfaces.symbols.SymbolTableInterface): if name.endswith(zip_match + extension) or ( zip_match == "*" and name.endswith(extension) ): - yield "jar:file:" + str( - pathlib.Path(zip_path) - ) + "!" + name + yield ( + "jar:file:" + + str(pathlib.Path(zip_path)) + + "!" + + name + ) @classmethod def create( diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 3b9a73e7c..a40c58bf4 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -36,7 +36,6 @@ vollog = logging.getLogger(__name__) class module(generic.GenericIntelProcess): - def is_valid(self): """Determine whether it is a valid module object by verifying the self-referential in module_kobject. This also confirms that the module is actively allocated and @@ -991,7 +990,6 @@ class maple_tree(objects.StructType): class mm_struct(objects.StructType): - # TODO: As of version 3.0.0 this method should be removed def get_mmap_iter(self) -> Iterable[interfaces.objects.ObjectInterface]: """ @@ -3048,7 +3046,6 @@ class latch_tree_root(objects.StructType): class kernel_symbol(objects.StructType): - def _offset_to_ptr(self, off) -> int: layer = self._context.layers[self.vol.layer_name] long_mask = (1 << layer.bits_per_register) - 1 diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 0ae748814..804abd404 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -297,7 +297,6 @@ class Modules(interfaces.configuration.VersionableInterface): # process each module coming from back the current source for module in gatherer.gather_modules(context, kernel_module_name): - # the kernel sends back a ModuleInfo directly if isinstance(module, ModuleInfo): modinfo = module @@ -998,13 +997,16 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): with self.open(file_name) as file_handle: file_handle.write(elf_data) - yield 0, ( - format_hints.Hex(module.vol.offset), - name, - format_hints.Hex(code_size), - taints, - parameters, - file_name, + yield ( + 0, + ( + format_hints.Hex(module.vol.offset), + name, + format_hints.Hex(code_size), + taints, + parameters, + file_name, + ), ) def run(self): diff --git a/volatility3/framework/symbols/windows/extensions/callbacks.py b/volatility3/framework/symbols/windows/extensions/callbacks.py index f54db39f2..855933f59 100644 --- a/volatility3/framework/symbols/windows/extensions/callbacks.py +++ b/volatility3/framework/symbols/windows/extensions/callbacks.py @@ -48,7 +48,6 @@ class _SHUTDOWN_PACKET(objects.StructType, pool.ExecutiveObject): return False try: - device = self.DeviceObject if not device or not (device.DriverObject.DriverStart % 0x1000 == 0): vollog.debug( diff --git a/volatility3/framework/symbols/windows/extensions/gui.py b/volatility3/framework/symbols/windows/extensions/gui.py index 0d39f8173..000c50319 100644 --- a/volatility3/framework/symbols/windows/extensions/gui.py +++ b/volatility3/framework/symbols/windows/extensions/gui.py @@ -220,7 +220,6 @@ class GUIExtensions(interfaces.configuration.VersionableInterface): break class tagWND(objects.StructType, pool.ExecutiveObject): - def is_valid(self) -> bool: """ Enforce a valid sid diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index bf20c1ffc..ddc21798f 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -54,7 +54,6 @@ class MFTEntry(objects.StructType): return max(names, key=lambda x: len(str(x))) def _attributes(self) -> Iterator["MFTAttribute"]: - # We will update this on each pass in the next loop and use it as the new offset. attr_base_offset = self.FirstAttrOffset attribute_object_type_name = ( diff --git a/volatility3/framework/symbols/windows/extensions/shimcache.py b/volatility3/framework/symbols/windows/extensions/shimcache.py index 3b32d30c7..e7d92a48d 100644 --- a/volatility3/framework/symbols/windows/extensions/shimcache.py +++ b/volatility3/framework/symbols/windows/extensions/shimcache.py @@ -183,7 +183,6 @@ class SHIM_CACHE_ENTRY(objects.StructType): == self.ListEntry.Flink.Blink.dereference().vol.offset ) ): - return True else: return False diff --git a/volatility3/framework/symbols/windows/pdbconv.py b/volatility3/framework/symbols/windows/pdbconv.py index c23ffb350..5baf23fb2 100644 --- a/volatility3/framework/symbols/windows/pdbconv.py +++ b/volatility3/framework/symbols/windows/pdbconv.py @@ -489,7 +489,7 @@ class PdbReader: """Strips unnecessary components from the start of a symbol name.""" new_name = name - if new_name[:1] in ["_", "@", "\u007F"]: + if new_name[:1] in ["_", "@", "\u007f"]: new_name = new_name[1:] name_array = new_name.split("@") diff --git a/volatility3/plugins/__init__.py b/volatility3/plugins/__init__.py index 6afa8baf4..27fc0938c 100644 --- a/volatility3/plugins/__init__.py +++ b/volatility3/plugins/__init__.py @@ -12,6 +12,7 @@ are dependent upon, please DO NOT alter or remove this file unless you know the The framework is configured this way to allow plugin developers/users to override any plugin functionality whether existing or new. """ + from volatility3.framework import constants __path__ = constants.PLUGINS_PATH diff --git a/volatility3/plugins/linux/__init__.py b/volatility3/plugins/linux/__init__.py index 2d3e2386e..2ea8fb250 100644 --- a/volatility3/plugins/linux/__init__.py +++ b/volatility3/plugins/linux/__init__.py @@ -11,6 +11,7 @@ existing or new. When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary. """ + import os import sys diff --git a/volatility3/plugins/mac/__init__.py b/volatility3/plugins/mac/__init__.py index 3ac3f1553..3f8e81ce1 100644 --- a/volatility3/plugins/mac/__init__.py +++ b/volatility3/plugins/mac/__init__.py @@ -11,6 +11,7 @@ existing or new. When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary. """ + import os import sys diff --git a/volatility3/plugins/windows/__init__.py b/volatility3/plugins/windows/__init__.py index d74f4fcd5..468493508 100644 --- a/volatility3/plugins/windows/__init__.py +++ b/volatility3/plugins/windows/__init__.py @@ -11,6 +11,7 @@ existing or new. When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary. """ + import os import sys diff --git a/volatility3/plugins/windows/registry/__init__.py b/volatility3/plugins/windows/registry/__init__.py index aeeaa87f2..f012a52a0 100644 --- a/volatility3/plugins/windows/registry/__init__.py +++ b/volatility3/plugins/windows/registry/__init__.py @@ -11,6 +11,7 @@ existing or new. When overriding the plugins directory, you must include a file like this in any subdirectories that may be necessary. """ + import os import sys diff --git a/volatility3/symbols/__init__.py b/volatility3/symbols/__init__.py index c35f07cbe..162ea013e 100644 --- a/volatility3/symbols/__init__.py +++ b/volatility3/symbols/__init__.py @@ -6,6 +6,7 @@ This is the namespace for all volatility symbols, and determines the path for loading symbol ISF files """ + from volatility3.framework import constants __path__ = constants.SYMBOL_BASEPATHS From 7536e9dd14b7c80c3cdf868101af30c49d9a21c5 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 30 Sep 2025 19:07:59 +0100 Subject: [PATCH 1262/1352] Start to support uv installation of volatility --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 5837c3c9a..290a31abd 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -54,7 +54,7 @@ test = [ docs = [ "volatility3[dev]", "sphinx>=4.0.0,<9", - "sphinx-autodoc-typehints>=3.0.0,<4", + "sphinx-autodoc-typehints>=3.0.0,<4; python_version >= '3.11'", "sphinx-rtd-theme>=3.0.1,<4", ] From 46c508fff2b3cc6f173645964124f2d9c807cd44 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 16 Oct 2025 20:29:02 +0100 Subject: [PATCH 1263/1352] Bump removal of plugins by a year to ensure suitable time for transition --- test/plugins/windows/test_scheduled_tasks.py | 2 +- test/plugins/windows/windows.py | 7 ++++--- volatility3/framework/plugins/windows/amcache.py | 5 +++-- volatility3/framework/plugins/windows/cachedump.py | 5 +++-- volatility3/framework/plugins/windows/hashdump.py | 5 +++-- volatility3/framework/plugins/windows/lsadump.py | 5 +++-- volatility3/framework/plugins/windows/scheduled_tasks.py | 5 +++-- 7 files changed, 20 insertions(+), 14 deletions(-) diff --git a/test/plugins/windows/test_scheduled_tasks.py b/test/plugins/windows/test_scheduled_tasks.py index 15d7f79a6..3369a5a35 100644 --- a/test/plugins/windows/test_scheduled_tasks.py +++ b/test/plugins/windows/test_scheduled_tasks.py @@ -4,7 +4,7 @@ import traceback import unittest sys.path.insert(0, "../../volatility3") -from volatility3.plugins.windows import scheduled_tasks +from volatility3.plugins.windows.registry import scheduled_tasks class TestActionsDecoding(unittest.TestCase): diff --git a/test/plugins/windows/windows.py b/test/plugins/windows/windows.py index 431461b6d..ff31ac109 100644 --- a/test/plugins/windows/windows.py +++ b/test/plugins/windows/windows.py @@ -4,6 +4,7 @@ import json import os import shutil import tempfile + from test import WindowsSamples, test_volatility @@ -437,7 +438,7 @@ class TestWindowsVadyarascan: class TestWindowsAmcache: def test_windows_generic_amcache(self, volatility, python, image): rc, out, _err = test_volatility.runvol_plugin( - "windows.amcache.Amcache", + "windows.registry.amcache.Amcache", image, volatility, python, @@ -492,7 +493,7 @@ class TestWindowsBigPools: # class TestWindowsCachedump: # def test_windows_generic_cachedump(self, volatility, python, image): # rc, out, _err = test_volatility.runvol_plugin( -# "windows.cachedump.Cachedump", +# "windows.registry.cachedump.Cachedump", # image, # volatility, # python, @@ -820,7 +821,7 @@ class TestWindowsLsadump: def test_windows_specific_lsadump(self, volatility, python): image = WindowsSamples.WINDOWSXP_GENERIC.value.path rc, out, _err = test_volatility.runvol_plugin( - "windows.lsadump.Lsadump", + "windows.registry.lsadump.Lsadump", image, volatility, python, diff --git a/volatility3/framework/plugins/windows/amcache.py b/volatility3/framework/plugins/windows/amcache.py index be144be91..0d1450127 100644 --- a/volatility3/framework/plugins/windows/amcache.py +++ b/volatility3/framework/plugins/windows/amcache.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import amcache vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class Amcache( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=amcache.Amcache, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Extract information on executed applications from the AmCache (deprecated).""" diff --git a/volatility3/framework/plugins/windows/cachedump.py b/volatility3/framework/plugins/windows/cachedump.py index 35127c6f3..3c474bc2c 100644 --- a/volatility3/framework/plugins/windows/cachedump.py +++ b/volatility3/framework/plugins/windows/cachedump.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import cachedump vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class Cachedump( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=cachedump.Cachedump, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Dumps lsa secrets from memory (deprecated)""" diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py index e496e77a9..c4b99d86f 100644 --- a/volatility3/framework/plugins/windows/hashdump.py +++ b/volatility3/framework/plugins/windows/hashdump.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import hashdump vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class Hashdump( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=hashdump.Hashdump, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Dumps user hashes from memory (deprecated)""" diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 0b36ddef0..ab81f18df 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import lsadump vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class Lsadump( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=lsadump.Lsadump, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Dumps lsa secrets from memory (deprecated)""" diff --git a/volatility3/framework/plugins/windows/scheduled_tasks.py b/volatility3/framework/plugins/windows/scheduled_tasks.py index 62d8e3b88..104d062b2 100644 --- a/volatility3/framework/plugins/windows/scheduled_tasks.py +++ b/volatility3/framework/plugins/windows/scheduled_tasks.py @@ -2,7 +2,8 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from volatility3.framework import interfaces, deprecation + +from volatility3.framework import deprecation, interfaces from volatility3.plugins.windows.registry import scheduled_tasks vollog = logging.getLogger(__name__) @@ -12,7 +13,7 @@ class ScheduledTasks( interfaces.plugins.PluginInterface, deprecation.PluginRenameClass, replacement_class=scheduled_tasks.ScheduledTasks, - removal_date="2025-09-25", + removal_date="2026-09-25", ): """Decodes scheduled task information from the Windows registry, including information about triggers, actions, run times, and creation times (deprecated).""" From f13ad125d7e5d6e9e7d5b618a3a24ee8c5e5315b Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 16 Oct 2025 20:33:28 +0100 Subject: [PATCH 1264/1352] Update the expiry dates of various functions to at least a year's notice --- volatility3/framework/plugins/linux/lsmod.py | 6 ++--- .../plugins/linux/malware/check_modules.py | 8 +++--- .../plugins/linux/malware/hidden_modules.py | 19 +++++++------- .../plugins/linux/malware/modxview.py | 11 ++++---- .../plugins/linux/malware/netfilter.py | 25 +++++++++++++------ 5 files changed, 39 insertions(+), 30 deletions(-) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 8ed52e3b7..ac6475264 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -4,10 +4,10 @@ """A module containing a plugin that lists loaded kernel modules.""" import logging -from typing import List, Iterable +from typing import Iterable, List import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, deprecation +from volatility3.framework import deprecation, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins @@ -38,7 +38,7 @@ class Lsmod(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.list_modules, replacement_version=(3, 0, 0), - removal_date="2025-09-25", + removal_date="2026-03-25", ) def list_modules( cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str diff --git a/volatility3/framework/plugins/linux/malware/check_modules.py b/volatility3/framework/plugins/linux/malware/check_modules.py index 7805bbd8a..65d358a45 100644 --- a/volatility3/framework/plugins/linux/malware/check_modules.py +++ b/volatility3/framework/plugins/linux/malware/check_modules.py @@ -3,14 +3,14 @@ # import logging -from typing import List, Dict, Generator +from typing import Dict, Generator, List import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import interfaces, deprecation +from volatility3.framework import deprecation, interfaces from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions -from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) @@ -61,7 +61,7 @@ class Check_modules(plugins.PluginInterface): @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_kset_modules, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) def get_kset_modules( diff --git a/volatility3/framework/plugins/linux/malware/hidden_modules.py b/volatility3/framework/plugins/linux/malware/hidden_modules.py index dcd602c5d..f7944cea0 100644 --- a/volatility3/framework/plugins/linux/malware/hidden_modules.py +++ b/volatility3/framework/plugins/linux/malware/hidden_modules.py @@ -2,14 +2,15 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Set, Tuple, Iterable +from typing import Iterable, List, Set, Tuple + +from volatility3.framework import deprecation, exceptions, interfaces +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.symbols.linux import extensions from volatility3.framework.symbols.linux.utilities import ( modules as linux_utilities_modules, ) -from volatility3.framework import interfaces, exceptions, deprecation -from volatility3.framework.configuration import requirements -from volatility3.framework.symbols.linux import extensions -from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) @@ -103,7 +104,7 @@ class Hidden_modules(plugins.PluginInterface): @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) def get_modules_memory_boundaries( @@ -116,7 +117,7 @@ class Hidden_modules(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_module_address_alignment, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) @classmethod @@ -144,13 +145,13 @@ class Hidden_modules(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_hidden_modules, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.validate_alignment_patterns, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) def _validate_alignment_patterns( diff --git a/volatility3/framework/plugins/linux/malware/modxview.py b/volatility3/framework/plugins/linux/malware/modxview.py index c1707d26f..63b265202 100644 --- a/volatility3/framework/plugins/linux/malware/modxview.py +++ b/volatility3/framework/plugins/linux/malware/modxview.py @@ -2,15 +2,14 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Dict, Iterator +from typing import Dict, Iterator, List import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules - -from volatility3.framework import interfaces, deprecation, renderers +from volatility3.framework import deprecation, interfaces, renderers from volatility3.framework.configuration import requirements +from volatility3.framework.constants import architectures from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.linux import extensions -from volatility3.framework.constants import architectures from volatility3.framework.symbols.linux.utilities import tainting vollog = logging.getLogger(__name__) @@ -66,7 +65,7 @@ spot modules presence and taints.""" @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.flatten_run_modules_results, replacement_version=(3, 0, 0), - removal_date="2025-09-25", + removal_date="2026-03-25", ) def flatten_run_modules_results( cls, run_results: Dict[str, List[extensions.module]], deduplicate: bool = True @@ -89,7 +88,7 @@ spot modules presence and taints.""" @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.run_modules_scanners, replacement_version=(3, 0, 0), - removal_date="2025-09-25", + removal_date="2026-03-25", ) def run_modules_scanners( cls, diff --git a/volatility3/framework/plugins/linux/malware/netfilter.py b/volatility3/framework/plugins/linux/malware/netfilter.py index d724d4296..bd7f2b7cc 100644 --- a/volatility3/framework/plugins/linux/malware/netfilter.py +++ b/volatility3/framework/plugins/linux/malware/netfilter.py @@ -1,22 +1,22 @@ # This file is Copyright 2024 Volatility Foundation and licensed under the Volatility Software License 1.0 # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # -from dataclasses import dataclass, field -from abc import ABC, abstractmethod import logging +from abc import ABC, abstractmethod +from dataclasses import dataclass, field +from typing import Iterator, List, Optional, Tuple import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from typing import Iterator, List, Tuple, Optional from volatility3 import framework from volatility3.framework import ( constants, + deprecation, + exceptions, interfaces, renderers, - exceptions, - deprecation, ) -from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements +from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.linux import network vollog = logging.getLogger(__name__) @@ -223,7 +223,16 @@ class AbstractNetfilter(ABC): ) hooked = module_info is None - yield netns, proto_name, hook_name, priority, hook_ops_hook, module_info, symbol_name, hooked + yield ( + netns, + proto_name, + hook_name, + priority, + hook_ops_hook, + module_info, + symbol_name, + hooked, + ) @classmethod @abstractmethod @@ -304,7 +313,7 @@ class AbstractNetfilter(ABC): return ("IPV4", "ARP", "BRIDGE", "IPV6", "DECNET") @deprecation.method_being_removed( - removal_date="2025-09-25", + removal_date="2026-03-25", message="Callers to this method should adapt `linux_utilities_modules.Modules.run_module_scanners`", ) def get_module_name_for_address(self, addr) -> str: From 5ef5c027ec0a0cc9ff81798e64e8644fb370bcc5 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 10 Nov 2025 22:10:24 +0100 Subject: [PATCH 1265/1352] fix missing kernel_base increment in low stub scanner --- volatility3/framework/automagic/pdbscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/pdbscan.py b/volatility3/framework/automagic/pdbscan.py index 8e2233840..c03db7582 100644 --- a/volatility3/framework/automagic/pdbscan.py +++ b/volatility3/framework/automagic/pdbscan.py @@ -450,7 +450,7 @@ class KernelPDBScanner(interfaces.automagic.AutomagicInterface): while (kernel_base + 0x2000000) > kernel_hint: for i in range(0, 0x200000, 0x1000): valid_kernel = self.check_kernel_offset( - context, vlayer, kernel_base, progress_callback + context, vlayer, kernel_base + i, progress_callback ) if valid_kernel: return valid_kernel From 81f135f315d2beec9f1ab5cedad0fc26df40700f Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 8 May 2025 14:29:01 +0100 Subject: [PATCH 1266/1352] Linux: Rework module calls to parameterize rather than pull in methods --- volatility3/framework/plugins/linux/lsmod.py | 45 +++++++++--- .../plugins/linux/malware/check_modules.py | 43 +++++++++--- .../plugins/linux/malware/hidden_modules.py | 61 ++++++++++++----- .../symbols/linux/utilities/modules.py | 68 ++++++++----------- 4 files changed, 145 insertions(+), 72 deletions(-) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index ac6475264..8db47cb95 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -4,10 +4,10 @@ """A module containing a plugin that lists loaded kernel modules.""" import logging -from typing import Iterable, List +from typing import List, Iterable import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import deprecation, interfaces +from volatility3.framework import constants, interfaces, deprecation, renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins @@ -18,27 +18,41 @@ class Lsmod(plugins.PluginInterface): """Lists loaded kernel modules.""" _required_framework_version = (2, 0, 0) - _version = (3, 0, 1) + _version = (3, 0, 3) - run = linux_utilities_modules.ModuleDisplayPlugin.run - _generator = linux_utilities_modules.ModuleDisplayPlugin.generator implementation = linux_utilities_modules.Modules.list_modules @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=constants.architectures.LINUX_ARCHS, + ), + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 0), + ), requirements.VersionRequirement( name="linux_utilities_modules_module_display_plugin", component=linux_utilities_modules.ModuleDisplayPlugin, - version=(1, 0, 0), + version=(2, 0, 0), ), - ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() + requirements.BooleanRequirement( + name="dump", + description="Extract listed modules", + default=False, + optional=True, + ), + ] @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.list_modules, replacement_version=(3, 0, 0), - removal_date="2026-03-25", + removal_date="2025-09-25", ) def list_modules( cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str @@ -46,3 +60,18 @@ class Lsmod(plugins.PluginInterface): return linux_utilities_modules.Modules.list_modules( context, vmlinux_module_name ) + + def run(self): + return renderers.TreeGrid( + linux_utilities_modules.ModuleDisplayPlugin.columns_results, + self._generator(), + ) + + def _generator(self): + yield from linux_utilities_modules.ModuleDisplayPlugin.generate_results( + self.context, + self.implementation, + self.config["kernel"], + self.config["dump"], + self.open, + ) diff --git a/volatility3/framework/plugins/linux/malware/check_modules.py b/volatility3/framework/plugins/linux/malware/check_modules.py index 65d358a45..0844b3400 100644 --- a/volatility3/framework/plugins/linux/malware/check_modules.py +++ b/volatility3/framework/plugins/linux/malware/check_modules.py @@ -3,19 +3,18 @@ # import logging -from typing import Dict, Generator, List +from typing import List, Dict, Generator import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import deprecation, interfaces +from volatility3.framework import constants, interfaces, deprecation, renderers from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions vollog = logging.getLogger(__name__) -class Check_modules(plugins.PluginInterface): +class Check_modules(interfaces.plugins.PluginInterface): """Compares module list to sysfs info, if available""" _version = (3, 0, 1) @@ -23,7 +22,7 @@ class Check_modules(plugins.PluginInterface): @classmethod def compare_kset_and_lsmod( - cls, context: str, vmlinux_name: str + cls, context: interfaces.context.ContextInterface, vmlinux_name: str ) -> Generator[extensions.module, None, None]: kset_modules = linux_utilities_modules.Modules.get_kset_modules( context=context, vmlinux_name=vmlinux_name @@ -39,13 +38,16 @@ class Check_modules(plugins.PluginInterface): for mod_name in set(kset_modules.keys()).difference(lsmod_modules): yield kset_modules[mod_name] - run = linux_utilities_modules.ModuleDisplayPlugin.run - _generator = linux_utilities_modules.ModuleDisplayPlugin.generator implementation = compare_kset_and_lsmod @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=constants.architectures.LINUX_ARCHS, + ), requirements.VersionRequirement( name="modules", component=linux_utilities_modules.Modules, @@ -54,17 +56,38 @@ class Check_modules(plugins.PluginInterface): requirements.VersionRequirement( name="linux_utilities_modules_module_display_plugin", component=linux_utilities_modules.ModuleDisplayPlugin, - version=(1, 0, 0), + version=(2, 0, 0), ), - ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() + requirements.BooleanRequirement( + name="dump", + description="Extract listed modules", + default=False, + optional=True, + ), + ] @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_kset_modules, - removal_date="2026-03-25", + removal_date="2025-09-25", replacement_version=(3, 0, 0), ) def get_kset_modules( cls, context: interfaces.context.ContextInterface, vmlinux_name: str ) -> Dict[str, extensions.module]: return linux_utilities_modules.Modules.get_kset_modules(context, vmlinux_name) + + def run(self): + return renderers.TreeGrid( + linux_utilities_modules.ModuleDisplayPlugin.columns_results, + self._generator(), + ) + + def _generator(self): + yield from linux_utilities_modules.ModuleDisplayPlugin.generate_results( + self.context, + self.implementation, + self.config["kernel"], + self.config["dump"], + self.open, + ) diff --git a/volatility3/framework/plugins/linux/malware/hidden_modules.py b/volatility3/framework/plugins/linux/malware/hidden_modules.py index f7944cea0..66f27ff66 100644 --- a/volatility3/framework/plugins/linux/malware/hidden_modules.py +++ b/volatility3/framework/plugins/linux/malware/hidden_modules.py @@ -2,15 +2,20 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import Iterable, List, Set, Tuple - -from volatility3.framework import deprecation, exceptions, interfaces -from volatility3.framework.configuration import requirements -from volatility3.framework.interfaces import plugins -from volatility3.framework.symbols.linux import extensions +from typing import List, Set, Tuple, Iterable, Generator from volatility3.framework.symbols.linux.utilities import ( modules as linux_utilities_modules, ) +from volatility3.framework import ( + constants, + interfaces, + exceptions, + deprecation, + renderers, +) +from volatility3.framework.configuration import requirements +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.interfaces import plugins vollog = logging.getLogger(__name__) @@ -19,12 +24,12 @@ class Hidden_modules(plugins.PluginInterface): """Carves memory to find hidden kernel modules""" _required_framework_version = (2, 25, 0) - _version = (3, 0, 2) + _version = (3, 0, 3) @classmethod def find_hidden_modules( cls, context, vmlinux_module_name: str - ) -> extensions.module: + ) -> Generator[extensions.module, None, None]: if context.symbol_space.verify_table_versions( "dwarf2json", lambda version, _: (not version) or version < (0, 8, 0) ): @@ -82,29 +87,38 @@ class Hidden_modules(plugins.PluginInterface): vmlinux_module_name, known_module_addresses, modules_memory_boundaries ) - run = linux_utilities_modules.ModuleDisplayPlugin.run - _generator = linux_utilities_modules.ModuleDisplayPlugin.generator implementation = find_hidden_modules @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=constants.architectures.LINUX_ARCHS, + ), requirements.VersionRequirement( name="linux_utilities_modules_module_display_plugin", component=linux_utilities_modules.ModuleDisplayPlugin, - version=(1, 0, 0), + version=(2, 0, 0), ), requirements.VersionRequirement( name="linux_utilities_modules", component=linux_utilities_modules.Modules, version=(3, 0, 1), ), - ] + linux_utilities_modules.ModuleDisplayPlugin.get_requirements() + requirements.BooleanRequirement( + name="dump", + description="Extract listed modules", + default=False, + optional=True, + ), + ] @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, - removal_date="2026-03-25", + removal_date="2025-09-25", replacement_version=(3, 0, 0), ) def get_modules_memory_boundaries( @@ -117,7 +131,7 @@ class Hidden_modules(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_module_address_alignment, - removal_date="2026-03-25", + removal_date="2025-09-25", replacement_version=(3, 0, 0), ) @classmethod @@ -145,13 +159,13 @@ class Hidden_modules(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_hidden_modules, - removal_date="2026-03-25", + removal_date="2025-09-25", replacement_version=(3, 0, 0), ) @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.validate_alignment_patterns, - removal_date="2026-03-25", + removal_date="2025-09-25", replacement_version=(3, 0, 0), ) def _validate_alignment_patterns( @@ -196,3 +210,18 @@ class Hidden_modules(plugins.PluginInterface): ) } return known_module_addresses + + def run(self): + return renderers.TreeGrid( + linux_utilities_modules.ModuleDisplayPlugin.columns_results, + self._generator(), + ) + + def _generator(self): + yield from linux_utilities_modules.ModuleDisplayPlugin.generate_results( + self.context, + self.implementation, + self.config["kernel"], + self.config["dump"], + self.open, + ) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 804abd404..3bc348c71 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -1,6 +1,7 @@ import logging import warnings from typing import ( + Callable, Iterable, Iterator, List, @@ -23,7 +24,6 @@ from volatility3.framework import ( objects, renderers, ) -from volatility3.framework.constants import architectures from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility @@ -382,7 +382,7 @@ class Modules(interfaces.configuration.VersionableInterface): vmlinux_module_name: str, known_module_addresses: Set[int], modules_memory_boundaries: Tuple, - ) -> Iterable[interfaces.objects.ObjectInterface]: + ) -> Iterable[extensions.module]: """Enumerate hidden modules by taking advantage of memory address alignment patterns This technique is much faster and uses less memory than the traditional scan method @@ -919,19 +919,11 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): The constructor of the plugin must call super() with the `implementation` set """ - _version = (1, 0, 1) - _required_framework_version = (2, 0, 0) - - framework.require_interface_version(*_required_framework_version) + _version = (2, 0, 0) @classmethod def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: return [ - requirements.ModuleRequirement( - name="kernel", - description="Linux kernel", - architectures=architectures.LINUX_ARCHS, - ), requirements.VersionRequirement( name="linux_utilities_modules", component=Modules, @@ -940,25 +932,29 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): requirements.VersionRequirement( name="linux-tainting", component=tainting.Tainting, version=(1, 0, 0) ), - requirements.BooleanRequirement( - name="dump", - description="Extract listed modules", - default=False, - optional=True, - ), ] - def generator(self): + @classmethod + def generate_results( + cls, + context: interfaces.context.ContextInterface, + implementation: Callable[ + [interfaces.context.ContextInterface, str], Iterable[extensions.module] + ], + kernel_module_name: str, + dump: bool, + open_implementation: Optional[interfaces.plugins.FileHandlerInterface], + ): """ Uses the implementation set in the constructor call to produce consistent output fields across module gathering plugins """ - for module in self.implementation(self.context, self.config["kernel"]): + for module in implementation(context, kernel_module_name): try: name = utility.array_to_string(module.name) except exceptions.InvalidAddressException: vollog.debug( - f"Unable to recover name for module {module.vol.offset:#x} from implementation {self.implementation}" + f"Unable to recover name for module {module.vol.offset:#x} from implementation {implementation}" ) continue @@ -968,21 +964,21 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): taints = ",".join( tainting.Tainting.get_taints_parsed( - self.context, self.config["kernel"], module.taints, True + context, kernel_module_name, module.taints, True ) ) parameters_iter = Modules.get_load_parameters( - self.context, self.config["kernel"], module + context, kernel_module_name, module ) parameters = ", ".join([f"{key}={value}" for key, value in parameters_iter]) file_name = renderers.NotApplicableValue() - if self.config["dump"]: + if open_implementation: elf_data = linux_utilities_module_extract.ModuleExtract.extract_module( - self.context, self.config["kernel"], module + context, kernel_module_name, module ) if not elf_data: vollog.warning( @@ -990,11 +986,11 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): ) file_name = renderers.NotAvailableValue() else: - file_name = self.open.sanitize_filename( + file_name = open_implementation.sanitize_filename( f"kernel_module.{name}.{module.vol.offset:#x}.elf" ) - with self.open(file_name) as file_handle: + with open_implementation(file_name) as file_handle: file_handle.write(elf_data) yield ( @@ -1009,15 +1005,11 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): ), ) - def run(self): - return renderers.TreeGrid( - [ - ("Offset", format_hints.Hex), - ("Module Name", str), - ("Code Size", format_hints.Hex), - ("Taints", str), - ("Load Arguments", str), - ("File Output", str), - ], - self._generator(), - ) + columns_results = [ + ("Offset", format_hints.Hex), + ("Module Name", str), + ("Code Size", format_hints.Hex), + ("Taints", str), + ("Load Arguments", str), + ("File Output", str), + ] From 5c9c763f64a6e6be3946e70e03a19e44b4fc0f82 Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 19 Nov 2025 16:34:53 +0000 Subject: [PATCH 1267/1352] Update volatility3/framework/plugins/linux/lsmod.py --- volatility3/framework/plugins/linux/lsmod.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 8db47cb95..3d4c04b26 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -52,7 +52,7 @@ class Lsmod(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.list_modules, replacement_version=(3, 0, 0), - removal_date="2025-09-25", + removal_date="2026-03-25", ) def list_modules( cls, context: interfaces.context.ContextInterface, vmlinux_module_name: str From 9454fe1f270ec1bd81b6af56e9e9488ad47d121f Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 19 Nov 2025 16:35:01 +0000 Subject: [PATCH 1268/1352] Update volatility3/framework/symbols/linux/utilities/modules.py --- volatility3/framework/symbols/linux/utilities/modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 3bc348c71..0c5d6b38a 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -976,7 +976,7 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): file_name = renderers.NotApplicableValue() - if open_implementation: + if dump and open_implementation: elf_data = linux_utilities_module_extract.ModuleExtract.extract_module( context, kernel_module_name, module ) From 393abb2a2fcbddfade9cd692535460ad4087706b Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 19 Nov 2025 16:35:08 +0000 Subject: [PATCH 1269/1352] Update volatility3/framework/plugins/linux/malware/hidden_modules.py --- volatility3/framework/plugins/linux/malware/hidden_modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/hidden_modules.py b/volatility3/framework/plugins/linux/malware/hidden_modules.py index 66f27ff66..043a9ac26 100644 --- a/volatility3/framework/plugins/linux/malware/hidden_modules.py +++ b/volatility3/framework/plugins/linux/malware/hidden_modules.py @@ -118,7 +118,7 @@ class Hidden_modules(plugins.PluginInterface): @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_modules_memory_boundaries, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) def get_modules_memory_boundaries( From dfd6282f1738db850d0387f4e79b0f368cda7062 Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 19 Nov 2025 16:35:15 +0000 Subject: [PATCH 1270/1352] Update volatility3/framework/plugins/linux/malware/hidden_modules.py --- volatility3/framework/plugins/linux/malware/hidden_modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/hidden_modules.py b/volatility3/framework/plugins/linux/malware/hidden_modules.py index 043a9ac26..bf9c98b97 100644 --- a/volatility3/framework/plugins/linux/malware/hidden_modules.py +++ b/volatility3/framework/plugins/linux/malware/hidden_modules.py @@ -131,7 +131,7 @@ class Hidden_modules(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_module_address_alignment, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) @classmethod From 9bfb1bed3520f26726bf3ee83506585f78b79677 Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 19 Nov 2025 16:35:22 +0000 Subject: [PATCH 1271/1352] Update volatility3/framework/plugins/linux/malware/hidden_modules.py --- volatility3/framework/plugins/linux/malware/hidden_modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/hidden_modules.py b/volatility3/framework/plugins/linux/malware/hidden_modules.py index bf9c98b97..ece96101e 100644 --- a/volatility3/framework/plugins/linux/malware/hidden_modules.py +++ b/volatility3/framework/plugins/linux/malware/hidden_modules.py @@ -159,7 +159,7 @@ class Hidden_modules(plugins.PluginInterface): @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_hidden_modules, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) @staticmethod From 83bf743a27e1e7faf0b9027e768a204e874fd7c1 Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 19 Nov 2025 16:35:28 +0000 Subject: [PATCH 1272/1352] Update volatility3/framework/plugins/linux/malware/hidden_modules.py --- volatility3/framework/plugins/linux/malware/hidden_modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/hidden_modules.py b/volatility3/framework/plugins/linux/malware/hidden_modules.py index ece96101e..22e089c10 100644 --- a/volatility3/framework/plugins/linux/malware/hidden_modules.py +++ b/volatility3/framework/plugins/linux/malware/hidden_modules.py @@ -165,7 +165,7 @@ class Hidden_modules(plugins.PluginInterface): @staticmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.validate_alignment_patterns, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) def _validate_alignment_patterns( From c54daae32a53c6dc987770eb15bb07ddddac3152 Mon Sep 17 00:00:00 2001 From: ikelos Date: Wed, 19 Nov 2025 16:35:35 +0000 Subject: [PATCH 1273/1352] Update volatility3/framework/plugins/linux/malware/check_modules.py --- volatility3/framework/plugins/linux/malware/check_modules.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/check_modules.py b/volatility3/framework/plugins/linux/malware/check_modules.py index 0844b3400..bc7d270aa 100644 --- a/volatility3/framework/plugins/linux/malware/check_modules.py +++ b/volatility3/framework/plugins/linux/malware/check_modules.py @@ -69,7 +69,7 @@ class Check_modules(interfaces.plugins.PluginInterface): @classmethod @deprecation.deprecated_method( replacement=linux_utilities_modules.Modules.get_kset_modules, - removal_date="2025-09-25", + removal_date="2026-03-25", replacement_version=(3, 0, 0), ) def get_kset_modules( From ea4aab5652f552e5131806d2ffd369e470171884 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 19 Nov 2025 16:39:02 +0000 Subject: [PATCH 1274/1352] Fix black/ruff checks --- volatility3/framework/plugins/linux/lsmod.py | 4 ++-- .../plugins/linux/malware/check_modules.py | 4 ++-- .../plugins/linux/malware/hidden_modules.py | 15 ++++++++------- 3 files changed, 12 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/plugins/linux/lsmod.py b/volatility3/framework/plugins/linux/lsmod.py index 3d4c04b26..e0878647f 100644 --- a/volatility3/framework/plugins/linux/lsmod.py +++ b/volatility3/framework/plugins/linux/lsmod.py @@ -4,10 +4,10 @@ """A module containing a plugin that lists loaded kernel modules.""" import logging -from typing import List, Iterable +from typing import Iterable, List import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import constants, interfaces, deprecation, renderers +from volatility3.framework import constants, deprecation, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins diff --git a/volatility3/framework/plugins/linux/malware/check_modules.py b/volatility3/framework/plugins/linux/malware/check_modules.py index bc7d270aa..1834a616e 100644 --- a/volatility3/framework/plugins/linux/malware/check_modules.py +++ b/volatility3/framework/plugins/linux/malware/check_modules.py @@ -3,10 +3,10 @@ # import logging -from typing import List, Dict, Generator +from typing import Dict, Generator, List import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules -from volatility3.framework import constants, interfaces, deprecation, renderers +from volatility3.framework import constants, deprecation, interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.symbols.linux import extensions diff --git a/volatility3/framework/plugins/linux/malware/hidden_modules.py b/volatility3/framework/plugins/linux/malware/hidden_modules.py index 22e089c10..a9f0b5b51 100644 --- a/volatility3/framework/plugins/linux/malware/hidden_modules.py +++ b/volatility3/framework/plugins/linux/malware/hidden_modules.py @@ -2,20 +2,21 @@ # which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 # import logging -from typing import List, Set, Tuple, Iterable, Generator -from volatility3.framework.symbols.linux.utilities import ( - modules as linux_utilities_modules, -) +from typing import Generator, Iterable, List, Set, Tuple + from volatility3.framework import ( constants, - interfaces, - exceptions, deprecation, + exceptions, + interfaces, renderers, ) from volatility3.framework.configuration import requirements -from volatility3.framework.symbols.linux import extensions from volatility3.framework.interfaces import plugins +from volatility3.framework.symbols.linux import extensions +from volatility3.framework.symbols.linux.utilities import ( + modules as linux_utilities_modules, +) vollog = logging.getLogger(__name__) From 4ce58a636dd3facabb11b17a13c744c9ac15fe3e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Wed, 19 Nov 2025 16:49:50 +0000 Subject: [PATCH 1275/1352] Reorder imports and fix black issue --- .../symbols/linux/utilities/modules.py | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 0c5d6b38a..2b16ec6e0 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -1,37 +1,36 @@ import logging import warnings +from abc import ABCMeta, abstractmethod from typing import ( Callable, + Dict, + Generator, Iterable, Iterator, List, - Optional, - Tuple, NamedTuple, - Dict, + Optional, Set, - Generator, + Tuple, Union, ) -from abc import ABCMeta, abstractmethod +import volatility3.framework.symbols.linux.utilities.module_extract as linux_utilities_module_extract from volatility3 import framework from volatility3.framework import ( constants, - interfaces, deprecation, exceptions, + interfaces, objects, renderers, ) -from volatility3.framework.renderers import format_hints from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility +from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.linux import extensions from volatility3.framework.symbols.linux.utilities import tainting -import volatility3.framework.symbols.linux.utilities.module_extract as linux_utilities_module_extract - vollog = logging.getLogger(__name__) @@ -976,7 +975,7 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): file_name = renderers.NotApplicableValue() - if dump and open_implementation: + if dump and open_implementation: elf_data = linux_utilities_module_extract.ModuleExtract.extract_module( context, kernel_module_name, module ) From 735f5933ba72a261d2687ca2ba0fdeb0cd72a15e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 15 Apr 2025 15:05:28 +0200 Subject: [PATCH 1276/1352] make module_sect_attr and bin_attribute optional --- volatility3/framework/symbols/linux/__init__.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/__init__.py b/volatility3/framework/symbols/linux/__init__.py index 19fb8f1d4..7560da3ec 100644 --- a/volatility3/framework/symbols/linux/__init__.py +++ b/volatility3/framework/symbols/linux/__init__.py @@ -52,7 +52,6 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.set_type_class("idr", extensions.IDR) self.set_type_class("address_space", extensions.address_space) self.set_type_class("page", extensions.page) - self.set_type_class("module_sect_attr", extensions.module_sect_attr) # Might not exist in the current symbols self.optional_set_type_class("module", extensions.module) @@ -61,6 +60,8 @@ class LinuxKernelIntermedSymbols(intermed.IntermediateSymbolTable): self.optional_set_type_class("kernel_cap_struct", extensions.kernel_cap_struct) self.optional_set_type_class("kernel_cap_t", extensions.kernel_cap_t) self.optional_set_type_class("scatterlist", extensions.scatterlist) + self.optional_set_type_class("module_sect_attr", extensions.module_sect_attr) + self.optional_set_type_class("bin_attribute", extensions.bin_attribute) # kernels >= 4.18 self.optional_set_type_class("timespec64", extensions.timespec64) From ac4326f4780dce79d31bb6c92f1c00a3961c1f7f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 15 Apr 2025 15:06:00 +0200 Subject: [PATCH 1277/1352] determine sect_attrs.attrs subtype dynamically --- .../symbols/linux/extensions/__init__.py | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 0136d749a..f7c60d617 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -211,9 +211,7 @@ class module(generic.GenericIntelProcess): symbol_table_name + constants.BANG + "array", layer_name=self.vol.layer_name, offset=self.sect_attrs.attrs.vol.offset, - subtype=self._context.symbol_space.get_type( - symbol_table_name + constants.BANG + "module_sect_attr" - ), + subtype=self.sect_attrs.attrs.vol.subtype, count=self.number_of_sections, ) @@ -3189,3 +3187,17 @@ class module_sect_attr(objects.StructType): ) return None + +class bin_attribute(objects.StructType): + def get_name(self) -> Optional[str]: + """ + Performs extraction of the bin_attribute name + """ + if hasattr(self, "attr"): + try: + return utility.pointer_to_string(self.attr.name, count=32) + except exceptions.InvalidAddressException: + vollog.debug(f"Invalid attr name for bin_attribute at {self.vol.offset:#x}") + return None + + return None \ No newline at end of file From 4f296f7f2d8b2d146b59c37ee954489bd9d7a321 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 15 Apr 2025 15:08:27 +0200 Subject: [PATCH 1278/1352] black formatting --- volatility3/framework/symbols/linux/extensions/__init__.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index f7c60d617..0fed4d71f 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3188,6 +3188,7 @@ class module_sect_attr(objects.StructType): return None + class bin_attribute(objects.StructType): def get_name(self) -> Optional[str]: """ @@ -3197,7 +3198,9 @@ class bin_attribute(objects.StructType): try: return utility.pointer_to_string(self.attr.name, count=32) except exceptions.InvalidAddressException: - vollog.debug(f"Invalid attr name for bin_attribute at {self.vol.offset:#x}") + vollog.debug( + f"Invalid attr name for bin_attribute at {self.vol.offset:#x}" + ) return None - return None \ No newline at end of file + return None From 75e0d041a2ac1df274ffa845961477934d1b5652 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 15 Apr 2025 17:11:44 +0200 Subject: [PATCH 1279/1352] sections manual enumeration adjustment --- .../symbols/linux/extensions/__init__.py | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 0fed4d71f..2830a8e58 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -179,16 +179,27 @@ class module(generic.GenericIntelProcess): return None def _get_sect_count(self, grp: interfaces.objects.ObjectInterface) -> int: - """Try to determine the number of valid sections""" + """Try to determine the number of valid sections. Support for kernels > 6.14-rc1. + + Resources: + - https://github.com/torvalds/linux/commit/d8959b947a8dfab1047c6fd5e982808f65717bfe + - https://github.com/torvalds/linux/commit/e0349c46cb4fbbb507fa34476bd70f9c82bad359 + """ + + if grp.has_member("bin_attrs"): + arr_offset = grp.bin_attrs + else: + arr_offset = grp.attrs + symbol_table_name = self.get_symbol_table_name() arr = self._context.object( symbol_table_name + constants.BANG + "array", layer_name=self.vol.layer_name, - offset=grp.attrs, + offset=arr_offset, subtype=self._context.symbol_space.get_type( symbol_table_name + constants.BANG + "pointer" ), - count=25, + count=50, ) idx = 0 @@ -198,6 +209,7 @@ class module(generic.GenericIntelProcess): @functools.cached_property def number_of_sections(self) -> int: + # Dropped in 6.14-rc1: d8959b947a8dfab1047c6fd5e982808f65717bfe if self.sect_attrs.has_member("nsections"): return self.sect_attrs.nsections From 825cb321a58ae211a60a1419fa1ea98d7122ceb5 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 15 Apr 2025 17:11:53 +0200 Subject: [PATCH 1280/1352] sections manual enumeration adjustment --- .../framework/symbols/linux/utilities/module_extract.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index e55f77668..c2732f216 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -38,7 +38,7 @@ vollog = logging.getLogger(__name__) class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" - _version = (1, 0, 0) + _version = (1, 0, 1) _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) @@ -60,9 +60,14 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): count = 0 try: + if grp.has_member("bin_attrs"): + arr_offset = grp.bin_attrs + else: + arr_offset = grp.attrs + array = kernel.object( object_type="array", - offset=grp.attrs, + offset=arr_offset, sub_type=kernel.get_type("pointer"), count=50, absolute=True, From 9478d36d7cc13123cfe20e5a369cfc58a719bade Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 2 May 2025 14:31:25 +0200 Subject: [PATCH 1281/1352] get_sections() sanity check --- volatility3/framework/symbols/linux/extensions/__init__.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 2830a8e58..d41386e7e 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -217,6 +217,11 @@ class module(generic.GenericIntelProcess): def get_sections(self) -> Iterable[interfaces.objects.ObjectInterface]: """Get a list of section attributes for the given module.""" + if self.number_of_sections == 0: + vollog.debug( + f"Invalid number of sections ({self.number_of_sections}) for module at offset {self.vol.offset:#x}" + ) + return [] symbol_table_name = self.get_symbol_table_name() arr = self._context.object( From 70dfa09b26c66bcb8996e6399522e1053dd121b1 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 2 May 2025 14:31:34 +0200 Subject: [PATCH 1282/1352] add bin_attribute address virtual member --- volatility3/framework/symbols/linux/extensions/__init__.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index d41386e7e..b02dc3dd2 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3221,3 +3221,10 @@ class bin_attribute(objects.StructType): return None return None + + @property + def address(self) -> int: + """Equivalent to module_sect_attr.address: + - https://github.com/torvalds/linux/commit/4b2c11e4aaf7e3d7fd9ce8e5995a32ff5e27d74f + """ + return self.private From d8518b387896a18d4ea04a75791f12fe8d28f062 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 2 May 2025 14:32:22 +0200 Subject: [PATCH 1283/1352] 1774: consolidate module helpers --- .../symbols/linux/utilities/module_extract.py | 105 ++---------------- 1 file changed, 7 insertions(+), 98 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index c2732f216..64740b682 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -38,56 +38,11 @@ vollog = logging.getLogger(__name__) class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" - _version = (1, 0, 1) + _version = (1, 0, 2) _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) - @classmethod - def _get_module_section_count( - cls, - context: interfaces.context.ContextInterface, - vmlinux_name: str, - module: extensions.module, - grp: interfaces.objects.ObjectInterface, - ) -> int: - """ - Used to manually determine the section count for kernels that do not track - this count directly within the attribute structures - """ - kernel = context.modules[vmlinux_name] - - count = 0 - - try: - if grp.has_member("bin_attrs"): - arr_offset = grp.bin_attrs - else: - arr_offset = grp.attrs - - array = kernel.object( - object_type="array", - offset=arr_offset, - sub_type=kernel.get_type("pointer"), - count=50, - absolute=True, - ) - - # Walk up to 50 sections counting until we reach the end or a page fault - for sect in array: - if sect.vol.offset == 0: - break - - count += 1 - - except exceptions.InvalidAddressException: - # Use whatever count we reached before the error - vollog.debug( - f"Exception hit counting sections for module at {module.vol.offset:#x}" - ) - - return count - @classmethod def _find_section( cls, section_lookups: List[Tuple[str, int, int, int]], sym_address: int @@ -266,54 +221,6 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): return sym_table_data - @classmethod - def _enumerate_original_sections( - cls, - context: interfaces.context.ContextInterface, - vmlinux_name: str, - module: extensions.module, - ) -> Optional[Dict[int, str]]: - """ - Enumerates the module's sections as maintained by the kernel after load time - 'Early' sections like .init.text and .init.data are discarded after module - initialization, so they are not expected to be in memory during extraction - """ - if hasattr(module.sect_attrs, "nsections"): - num_sections = module.sect_attrs.nsections - else: - num_sections = cls._get_module_section_count( - context, vmlinux_name, module.sect_attrs.grp - ) - - if num_sections > 1024 or num_sections == 0: - vollog.debug( - f"Invalid number of sections ({num_sections}) for module at offset {module.vol.offset:#x}" - ) - return None - - vmlinux = context.modules[vmlinux_name] - - # This is declared as a zero sized array, so we create ourselves - attribute_type = module.sect_attrs.attrs.vol.subtype - - sect_array = vmlinux.object( - object_type="array", - subtype=attribute_type, - offset=module.sect_attrs.attrs.vol.offset, - count=num_sections, - absolute=True, - ) - - sections: Dict[int, str] = {} - - # for each section, gather its name and address - for index, section in enumerate(sect_array): - name = section.get_name() - - sections[section.address] = name - - return sections - @classmethod def _parse_sections( cls, @@ -330,10 +237,12 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): The data of .strtab is read directly off the module structure and not its section as the section from the original module has no meaning after loading as the kernel does not reference it. """ - original_sections = cls._enumerate_original_sections( - context, vmlinux_name, module - ) - if original_sections is None: + original_sections = {} + for index, section in enumerate(module.get_sections()): + name = section.get_name() + original_sections[section.address] = name + + if not original_sections: return None kernel = context.modules[vmlinux_name] From c223a12be9ceffd676154713001dda8ce5c5a078 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 2 May 2025 14:33:00 +0200 Subject: [PATCH 1284/1352] handle None in _parse_sections caller --- .../framework/symbols/linux/utilities/module_extract.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 64740b682..500e81948 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -616,9 +616,10 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): return None # Gather sections - updated_sections, strtab_index, symtab_index = cls._parse_sections( - context, vmlinux_name, module - ) + parse_sections_result = cls._parse_sections(context, vmlinux_name, module) + if parse_sections_result is None: + return None + updated_sections, strtab_index, symtab_index = parse_sections_result kernel = context.modules[vmlinux_name] From 522c2d435c7a38a5d37b4afd8180a46f96eef779 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 2 May 2025 14:36:20 +0200 Subject: [PATCH 1285/1352] rollback to already patched version --- volatility3/framework/symbols/linux/utilities/module_extract.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 500e81948..e4f5705cf 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -38,7 +38,7 @@ vollog = logging.getLogger(__name__) class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" - _version = (1, 0, 2) + _version = (1, 0, 1) _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) From 910488235478410cd9d8920546f9b91dfc4b2c99 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 5 May 2025 12:02:41 +0200 Subject: [PATCH 1286/1352] add ATTRIBUTE_NAME_MAX_SIZE constant --- volatility3/framework/constants/linux/__init__.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 3f8c52b43..72440e23e 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -432,6 +432,17 @@ VMCOREINFO_MAGIC = b"VMCOREINFO\x00" VMCOREINFO_MAGIC_ALIGNED = VMCOREINFO_MAGIC + b"\x00" OSRELEASE_TAG = b"OSRELEASE=" +ATTRIBUTE_NAME_MAX_SIZE = 255 +""" +In 5.9-rc1+, the Linux kernel limits the READ size of a section bin_attribute name to MODULE_SECT_READ_SIZE: + +- https://elixir.bootlin.com/linux/v6.15-rc4/source/kernel/module/sysfs.c#L106 +- https://github.com/torvalds/linux/commit/11990a5bd7e558e9203c1070fc52fb6f0488e75b + +However, the raw section name loaded from the .ko ELF can in theory be thousands of characters, +and unless we do a NULL terminated search we can't set a perfect value. +""" + @dataclass class TaintFlag: From a5d1641db338c1aeae95ffe618908cf5d06e1fe8 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 5 May 2025 12:03:03 +0200 Subject: [PATCH 1287/1352] use ATTRIBUTE_NAME_MAX_SIZE constant --- .../symbols/linux/extensions/__init__.py | 20 ++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index b02dc3dd2..037ca1f6b 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3172,7 +3172,9 @@ class module_sect_attr(objects.StructType): """ if hasattr(self, "battr"): try: - return utility.pointer_to_string(self.battr.attr.name, count=32) + return utility.pointer_to_string( + self.battr.attr.name, count=linux_constants.ATTRIBUTE_NAME_MAX_SIZE + ) except exceptions.InvalidAddressException: # if battr is present then its name attribute needs to be valid vollog.debug(f"Invalid battr name for section at {self.vol.offset:#x}") @@ -3180,14 +3182,18 @@ class module_sect_attr(objects.StructType): elif self.name.vol.type_name == "array": try: - return utility.array_to_string(self.name, count=32) + return utility.array_to_string( + self.name, count=linux_constants.ATTRIBUTE_NAME_MAX_SIZE + ) except exceptions.InvalidAddressException: # specifically do not return here to give `mattr` a chance vollog.debug(f"Invalid direct name for section at {self.vol.offset:#x}") elif self.name.vol.type_name == "pointer": try: - return utility.pointer_to_string(self.name, count=32) + return utility.pointer_to_string( + self.name, count=linux_constants.ATTRIBUTE_NAME_MAX_SIZE + ) except exceptions.InvalidAddressException: # specifically do not return here to give `mattr` a chance vollog.debug( @@ -3197,7 +3203,9 @@ class module_sect_attr(objects.StructType): # if everything else failed... if hasattr(self, "mattr"): try: - return utility.pointer_to_string(self.mattr.attr.name, count=32) + return utility.pointer_to_string( + self.mattr.attr.name, count=linux_constants.ATTRIBUTE_NAME_MAX_SIZE + ) except exceptions.InvalidAddressException: vollog.debug( f"Unresolvable name for for section at {self.vol.offset:#x}" @@ -3213,7 +3221,9 @@ class bin_attribute(objects.StructType): """ if hasattr(self, "attr"): try: - return utility.pointer_to_string(self.attr.name, count=32) + return utility.pointer_to_string( + self.attr.name, count=linux_constants.ATTRIBUTE_NAME_MAX_SIZE + ) except exceptions.InvalidAddressException: vollog.debug( f"Invalid attr name for bin_attribute at {self.vol.offset:#x}" From 2cda8e3cb39551e7b2c94297a75d88499423ca0e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Tue, 6 May 2025 01:03:35 +0200 Subject: [PATCH 1288/1352] make binary attributes iteration NULL terminated --- .../symbols/linux/extensions/__init__.py | 31 ++++++++++++------- 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 037ca1f6b..22eb46460 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -191,20 +191,27 @@ class module(generic.GenericIntelProcess): else: arr_offset = grp.attrs - symbol_table_name = self.get_symbol_table_name() - arr = self._context.object( - symbol_table_name + constants.BANG + "array", - layer_name=self.vol.layer_name, - offset=arr_offset, - subtype=self._context.symbol_space.get_type( - symbol_table_name + constants.BANG + "pointer" - ), - count=50, - ) + if not arr_offset.is_readable(): + vollog.log( + constants.LOGLEVEL_V, + f"Cannot dereference the pointer to the NULL-terminated list of binary attributes for module at offset {self.vol.offset:#x}", + ) + return 0 + entry = arr_offset.dereference() + symbol_table_name = self.get_symbol_table_name() idx = 0 - while arr[idx] and arr[idx].is_readable(): - idx = idx + 1 + while entry.is_readable(): + idx += 1 + entry = self._context.object( + symbol_table_name + constants.BANG + "pointer", + layer_name=self.vol.layer_name, + offset=entry.vol.offset + + self._context.symbol_space.get_type( + symbol_table_name + constants.BANG + "pointer" + ).size, + ) + return idx @functools.cached_property From 1c11791b7fbb2b1dd8c2589f986f097b1a607da8 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 7 May 2025 16:10:16 +0200 Subject: [PATCH 1289/1352] add dynamically_sized_array_of_pointers() helper --- volatility3/framework/objects/utility.py | 49 ++++++++++++++++++++++++ 1 file changed, 49 insertions(+) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 59ac0ee55..9e9fef33a 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -250,3 +250,52 @@ def array_of_pointers( ).clone() subtype_pointer.update_vol(subtype=subtype) return array.cast("array", count=count, subtype=subtype_pointer) + + +def dynamically_sized_array_of_pointers( + context: interfaces.context.ContextInterface, + layer_name: str, + symbol_table_name: str, + array_offset: int, + stop_value: int = 0, + iterator_guard_value: int = None, + stop_on_invalid_pointers: bool = True, +) -> interfaces.objects.ObjectInterface: + """Iterates over a dynamically sized array of pointers (e.g. NULL-terminated). + + Args: + context: The context on which to operate. + layer_name: The layer on which the array should be constructed. + symbol_table_name: The symbol table to use to construct object types. + array_offset: The array offset within the layer, from which to start iterating. + stop_value: Stop value used to determine when to terminate iteration once it is encountered. Defaults to 0 (NULL-terminated arrays). + iterator_guard_value: Stop iterating when the iterator index is greater than this value. This is an extra-safety against smearing. + stop_on_invalid_pointers: Determines whether to stop iterating or not when an invalid pointer is encountered. This can be useful for arrays + that are known to have smeared entries before the end. + """ + pointer_type = context.symbol_space.get_type( + symbol_table_name + constants.BANG + "pointer" + ) + entry = context.object( + pointer_type, + layer_name=layer_name, + offset=array_offset, + ) + i = 0 + array = [] + # entry and entry.vol.offset aren't the same thing, as + # - entry is naturally represented by the address that the pointer refers to; + # - entry.vol.offset is the offset at which the pointer lives. + while entry != stop_value: + if (not entry.is_readable() and stop_on_invalid_pointers) or ( + iterator_guard_value is not None and i >= iterator_guard_value + ): + break + array.append(entry) + entry = context.object( + pointer_type, + layer_name=layer_name, + offset=entry.vol.offset + pointer_type.size, + ) + i += 1 + return array From 15a8af5c93bbef025fc0c0d3fcb69abc83854f9e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 7 May 2025 16:10:37 +0200 Subject: [PATCH 1290/1352] use dynamically_sized_array_of_pointers in _get_sect_count --- .../symbols/linux/extensions/__init__.py | 26 ++++++++----------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 22eb46460..22d06baea 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -198,21 +198,17 @@ class module(generic.GenericIntelProcess): ) return 0 - entry = arr_offset.dereference() - symbol_table_name = self.get_symbol_table_name() - idx = 0 - while entry.is_readable(): - idx += 1 - entry = self._context.object( - symbol_table_name + constants.BANG + "pointer", - layer_name=self.vol.layer_name, - offset=entry.vol.offset - + self._context.symbol_space.get_type( - symbol_table_name + constants.BANG + "pointer" - ).size, - ) - - return idx + # We chose 1000 as an arbitrary guard value against + # extreme cases of smearing. + # See PR #1773 for more information. + bin_attrs_list = utility.dynamically_sized_array_of_pointers( + context=self._context, + layer_name=self.vol.layer_name, + symbol_table_name=self.get_symbol_table_name(), + array_offset=arr_offset.dereference().vol.offset, + iterator_guard_value=1000, + ) + return len(bin_attrs_list) @functools.cached_property def number_of_sections(self) -> int: From b20da9c7f553d9e2b9580727d37113a57dcd5d09 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 7 May 2025 16:26:47 +0200 Subject: [PATCH 1291/1352] correct type hinting --- volatility3/framework/objects/utility.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 9e9fef33a..afea99b0c 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -4,7 +4,7 @@ import re -from typing import Optional, Union +from typing import List, Optional, Union from volatility3.framework import interfaces, objects, constants, exceptions @@ -260,7 +260,7 @@ def dynamically_sized_array_of_pointers( stop_value: int = 0, iterator_guard_value: int = None, stop_on_invalid_pointers: bool = True, -) -> interfaces.objects.ObjectInterface: +) -> List[interfaces.objects.ObjectInterface]: """Iterates over a dynamically sized array of pointers (e.g. NULL-terminated). Args: @@ -272,6 +272,9 @@ def dynamically_sized_array_of_pointers( iterator_guard_value: Stop iterating when the iterator index is greater than this value. This is an extra-safety against smearing. stop_on_invalid_pointers: Determines whether to stop iterating or not when an invalid pointer is encountered. This can be useful for arrays that are known to have smeared entries before the end. + + Returns: + An array of pointer objects """ pointer_type = context.symbol_space.get_type( symbol_table_name + constants.BANG + "pointer" From 44969090e71f9d63a8d2a23ea94f5a61c8459923 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 8 May 2025 12:41:39 +0200 Subject: [PATCH 1292/1352] lru_cache get_modules_memory_boundaries() --- volatility3/framework/symbols/linux/utilities/modules.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 2b16ec6e0..bb360e0ba 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -1,6 +1,7 @@ import logging import warnings from abc import ABCMeta, abstractmethod +import functools from typing import ( Callable, Dict, @@ -71,7 +72,7 @@ class ModuleGathererInterface( class Modules(interfaces.configuration.VersionableInterface): """Kernel modules related utilities.""" - _version = (3, 0, 1) + _version = (3, 0, 2) _required_framework_version = (2, 0, 0) framework.require_interface_version(*_required_framework_version) @@ -311,6 +312,7 @@ class Modules(interfaces.configuration.VersionableInterface): return run_results @staticmethod + @functools.lru_cache def get_modules_memory_boundaries( context: interfaces.context.ContextInterface, vmlinux_module_name: str, From 6e67674c20c7e1e3084a0106eca842efe6e1101d Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 8 May 2025 12:46:25 +0200 Subject: [PATCH 1293/1352] add section address sanity check --- .../symbols/linux/utilities/module_extract.py | 35 ++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index e4f5705cf..1ff0f35fc 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -10,12 +10,14 @@ from typing import ( Dict, ) +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3 import framework from volatility3.framework import ( interfaces, exceptions, symbols, ) +from volatility3.framework.configuration import requirements from volatility3.framework.constants import linux as linux_constants from volatility3.framework.symbols.linux import extensions @@ -38,11 +40,21 @@ vollog = logging.getLogger(__name__) class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" - _version = (1, 0, 1) + _version = (1, 0, 2) _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.VersionRequirement( + name="linux_utilities_modules", + component=linux_utilities_modules.Modules, + version=(3, 0, 2), + ), + ] + @classmethod def _find_section( cls, section_lookups: List[Tuple[str, int, int, int]], sym_address: int @@ -237,17 +249,32 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): The data of .strtab is read directly off the module structure and not its section as the section from the original module has no meaning after loading as the kernel does not reference it. """ + kernel = context.modules[vmlinux_name] + kernel_layer = context.layers[kernel.layer_name] + modules_addr_min, modules_addr_max = ( + linux_utilities_modules.Modules.get_modules_memory_boundaries( + context, vmlinux_name + ) + ) + modules_addr_min &= kernel_layer.address_mask + modules_addr_max &= kernel_layer.address_mask + original_sections = {} for index, section in enumerate(module.get_sections()): + # Extra sanity check, to prevent OOM on heavily smeared samples at line + # "size = next_address - address" + if ( + not modules_addr_min + <= kernel_layer.address_mask & section.address + < modules_addr_max + ): + continue name = section.get_name() original_sections[section.address] = name if not original_sections: return None - kernel = context.modules[vmlinux_name] - kernel_layer = context.layers[kernel.layer_name] - if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name): sym_type = "Elf64_Sym" elf_hdr_type = "Elf64_Ehdr" From a5cc616d53f2db0d20e1dfff81e9d26ed2672b78 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 8 May 2025 12:49:56 +0200 Subject: [PATCH 1294/1352] leverage the existing Array facility --- volatility3/framework/objects/utility.py | 65 +++++++++++------------- 1 file changed, 31 insertions(+), 34 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index afea99b0c..be57f9ad7 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -3,11 +3,13 @@ # import re - -from typing import List, Optional, Union +import logging +from typing import Optional, Union from volatility3.framework import interfaces, objects, constants, exceptions +vollog = logging.getLogger(__name__) + def rol(value: int, count: int, max_bits: int = 64) -> int: """A rotate-left instruction in Python""" @@ -254,51 +256,46 @@ def array_of_pointers( def dynamically_sized_array_of_pointers( context: interfaces.context.ContextInterface, - layer_name: str, - symbol_table_name: str, - array_offset: int, + array: interfaces.objects.ObjectInterface, + iterator_guard_value: int, + subtype: Union[str, interfaces.objects.Template], stop_value: int = 0, - iterator_guard_value: int = None, stop_on_invalid_pointers: bool = True, -) -> List[interfaces.objects.ObjectInterface]: +) -> interfaces.objects.ObjectInterface: """Iterates over a dynamically sized array of pointers (e.g. NULL-terminated). + Array iteration should always be performed with an arbitrary guard value as maximum size, + to prevent running forever in case something unexpected happens. Args: context: The context on which to operate. - layer_name: The layer on which the array should be constructed. - symbol_table_name: The symbol table to use to construct object types. - array_offset: The array offset within the layer, from which to start iterating. - stop_value: Stop value used to determine when to terminate iteration once it is encountered. Defaults to 0 (NULL-terminated arrays). + array: The object to cast to an array. iterator_guard_value: Stop iterating when the iterator index is greater than this value. This is an extra-safety against smearing. + subtype: The subtype of the array's pointers. + stop_value: Stop value used to determine when to terminate iteration once it is encountered. Defaults to 0 (NULL-terminated arrays). stop_on_invalid_pointers: Determines whether to stop iterating or not when an invalid pointer is encountered. This can be useful for arrays that are known to have smeared entries before the end. Returns: An array of pointer objects """ - pointer_type = context.symbol_space.get_type( - symbol_table_name + constants.BANG + "pointer" - ) - entry = context.object( - pointer_type, - layer_name=layer_name, - offset=array_offset, - ) - i = 0 - array = [] - # entry and entry.vol.offset aren't the same thing, as - # - entry is naturally represented by the address that the pointer refers to; - # - entry.vol.offset is the offset at which the pointer lives. - while entry != stop_value: - if (not entry.is_readable() and stop_on_invalid_pointers) or ( - iterator_guard_value is not None and i >= iterator_guard_value + new_count = 0 + for entry in array_of_pointers( + array=array, count=iterator_guard_value, subtype=subtype, context=context + ): + # "entry" is naturally represented by the address that the pointer refers to + if (entry == stop_value) or ( + not entry.is_readable() and stop_on_invalid_pointers ): break - array.append(entry) - entry = context.object( - pointer_type, - layer_name=layer_name, - offset=entry.vol.offset + pointer_type.size, + new_count += 1 + else: + vollog.log( + constants.LOGLEVEL_V, + f"""Iterator guard value {iterator_guard_value} reached while iterating over array at offset {array.vol.offset:#x}.\ + This means that there is a bug (e.g. smearing) with this array, or that it may contain valid entries past the iterator guard value.""", ) - i += 1 - return array + + # Leverage the "Array" object instead of returning a Python list + return array_of_pointers( + array=array, count=new_count, subtype=subtype, context=context + ) From c8d90cffe43a7440b60322a2b19a16cdd7c5f22c Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 8 May 2025 12:52:18 +0200 Subject: [PATCH 1295/1352] adjust to the new NULL-terminated processing --- .../symbols/linux/extensions/__init__.py | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 22d06baea..953e3cb89 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -187,26 +187,31 @@ class module(generic.GenericIntelProcess): """ if grp.has_member("bin_attrs"): - arr_offset = grp.bin_attrs + arr_offset_ptr = grp.bin_attrs + arr_subtype = "bin_attribute" else: - arr_offset = grp.attrs + arr_offset_ptr = grp.attrs + arr_subtype = "attribute" - if not arr_offset.is_readable(): + if not arr_offset_ptr.is_readable(): vollog.log( constants.LOGLEVEL_V, f"Cannot dereference the pointer to the NULL-terminated list of binary attributes for module at offset {self.vol.offset:#x}", ) return 0 - # We chose 1000 as an arbitrary guard value against - # extreme cases of smearing. + # We chose 100 as an arbitrary guard value to prevent + # looping forever in extreme cases, and because 100 is not expected + # to be a valid number of sections. If that still happens, + # Vol3 module processing will indicate that it is missing information + # with the following message: + # "Unable to reconstruct the ELF for module struct at" # See PR #1773 for more information. bin_attrs_list = utility.dynamically_sized_array_of_pointers( context=self._context, - layer_name=self.vol.layer_name, - symbol_table_name=self.get_symbol_table_name(), - array_offset=arr_offset.dereference().vol.offset, - iterator_guard_value=1000, + array=arr_offset_ptr.dereference(), + iterator_guard_value=100, + subtype=self.get_symbol_table_name() + constants.BANG + arr_subtype, ) return len(bin_attrs_list) From 5d50ad2b2eab7fa54d3be917063ec9e649f25536 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 8 May 2025 12:54:45 +0200 Subject: [PATCH 1296/1352] slight readability adjustment --- .../framework/symbols/linux/utilities/module_extract.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 1ff0f35fc..161f2a167 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -263,9 +263,9 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): for index, section in enumerate(module.get_sections()): # Extra sanity check, to prevent OOM on heavily smeared samples at line # "size = next_address - address" - if ( - not modules_addr_min - <= kernel_layer.address_mask & section.address + if not ( + modules_addr_min + <= section.address & kernel_layer.address_mask < modules_addr_max ): continue From c89c7c3a06349f8e1fb518d9520e3784a7d4096d Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 8 May 2025 14:03:28 +0200 Subject: [PATCH 1297/1352] rollback to 635237b to prevent circular import --- .../symbols/linux/utilities/module_extract.py | 35 +++---------------- 1 file changed, 4 insertions(+), 31 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 161f2a167..e4f5705cf 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -10,14 +10,12 @@ from typing import ( Dict, ) -import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3 import framework from volatility3.framework import ( interfaces, exceptions, symbols, ) -from volatility3.framework.configuration import requirements from volatility3.framework.constants import linux as linux_constants from volatility3.framework.symbols.linux import extensions @@ -40,21 +38,11 @@ vollog = logging.getLogger(__name__) class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" - _version = (1, 0, 2) + _version = (1, 0, 1) _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) - @classmethod - def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: - return [ - requirements.VersionRequirement( - name="linux_utilities_modules", - component=linux_utilities_modules.Modules, - version=(3, 0, 2), - ), - ] - @classmethod def _find_section( cls, section_lookups: List[Tuple[str, int, int, int]], sym_address: int @@ -249,32 +237,17 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): The data of .strtab is read directly off the module structure and not its section as the section from the original module has no meaning after loading as the kernel does not reference it. """ - kernel = context.modules[vmlinux_name] - kernel_layer = context.layers[kernel.layer_name] - modules_addr_min, modules_addr_max = ( - linux_utilities_modules.Modules.get_modules_memory_boundaries( - context, vmlinux_name - ) - ) - modules_addr_min &= kernel_layer.address_mask - modules_addr_max &= kernel_layer.address_mask - original_sections = {} for index, section in enumerate(module.get_sections()): - # Extra sanity check, to prevent OOM on heavily smeared samples at line - # "size = next_address - address" - if not ( - modules_addr_min - <= section.address & kernel_layer.address_mask - < modules_addr_max - ): - continue name = section.get_name() original_sections[section.address] = name if not original_sections: return None + kernel = context.modules[vmlinux_name] + kernel_layer = context.layers[kernel.layer_name] + if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name): sym_type = "Elf64_Sym" elf_hdr_type = "Elf64_Ehdr" From b8e12bec297a4f61b17ff10b0c27224ad45ec37d Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 20 Nov 2025 15:18:53 +0100 Subject: [PATCH 1298/1352] move ModuleExtract class in modules.py --- .../framework/plugins/linux/module_extract.py | 12 +- .../symbols/linux/utilities/module_extract.py | 8 +- .../symbols/linux/utilities/modules.py | 732 +++++++++++++++++- 3 files changed, 742 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/linux/module_extract.py b/volatility3/framework/plugins/linux/module_extract.py index a8864281a..3b6b6f0e5 100644 --- a/volatility3/framework/plugins/linux/module_extract.py +++ b/volatility3/framework/plugins/linux/module_extract.py @@ -4,8 +4,8 @@ import logging from typing import List +import volatility3.framework.symbols.linux.utilities.modules as linux_utilities_modules from volatility3 import framework -import volatility3.framework.symbols.linux.utilities.module_extract as linux_utilities_module_extract from volatility3.framework import interfaces, renderers from volatility3.framework.configuration import requirements from volatility3.framework.renderers import format_hints @@ -17,7 +17,7 @@ vollog = logging.getLogger(__name__) class ModuleExtract(interfaces.plugins.PluginInterface): """Recreates an ELF file from a specific address in the kernel""" - _version = (1, 0, 0) + _version = (1, 0, 1) _required_framework_version = (2, 25, 0) framework.require_interface_version(*_required_framework_version) @@ -37,9 +37,9 @@ class ModuleExtract(interfaces.plugins.PluginInterface): optional=False, ), requirements.VersionRequirement( - name="linux_utilities_module_extract", - version=(1, 0, 0), - component=linux_utilities_module_extract.ModuleExtract, + name="linux_utilities_modules_module_extract", + version=(1, 0, 2), + component=linux_utilities_modules.ModuleExtract, ), ] @@ -58,7 +58,7 @@ class ModuleExtract(interfaces.plugins.PluginInterface): module = kernel.object(object_type="module", offset=base_address, absolute=True) - elf_data = linux_utilities_module_extract.ModuleExtract.extract_module( + elf_data = linux_utilities_modules.ModuleExtract.extract_module( self.context, self.config["kernel"], module ) if not elf_data: diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index e4f5705cf..3cc15085a 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -15,6 +15,7 @@ from volatility3.framework import ( interfaces, exceptions, symbols, + deprecation ) from volatility3.framework.constants import linux as linux_constants from volatility3.framework.symbols.linux import extensions @@ -34,7 +35,12 @@ vollog = logging.getLogger(__name__) # ModuleExtract.extract_module is the entry point and only visible method for plugins - +# See PR #1773 +@deprecation.renamed_class( + deprecated_class_name="ModuleExtract", + removal_date="2026-06-01", + message="volatility3.framework.symbols.linux.utilities.module_extract.ModuleExtract is to be deprecated. Use volatility3.framework.symbols.linux.utilities.modules.ModuleExtract instead.", +) class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index bb360e0ba..42383ecae 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -1,7 +1,8 @@ import logging import warnings -from abc import ABCMeta, abstractmethod import functools +import struct +from abc import ABCMeta, abstractmethod from typing import ( Callable, Dict, @@ -16,7 +17,6 @@ from typing import ( Union, ) -import volatility3.framework.symbols.linux.utilities.module_extract as linux_utilities_module_extract from volatility3 import framework from volatility3.framework import ( constants, @@ -25,12 +25,14 @@ from volatility3.framework import ( interfaces, objects, renderers, + symbols ) from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility from volatility3.framework.renderers import format_hints from volatility3.framework.symbols.linux import extensions from volatility3.framework.symbols.linux.utilities import tainting +from volatility3.framework.constants import linux as linux_constants vollog = logging.getLogger(__name__) @@ -782,6 +784,730 @@ class Modules(interfaces.configuration.VersionableInterface): yield name, value +# This module is responsible for producing an ELF file of a kernel module (LKM) loaded in memory +# This extraction task is quite complicated as the Linux kernel discards the ELF header at load time +# Due to this, to support static analysis, we must create an ELF header and proper file based on the sections +# There are also several other significant complications that we must deal with when trying to extract an LKM +# that can be analyzed with static analysis tools +# First, the .strtab points somewhere random and is kept off the module structure, not with the other sections +# Second, all of the symbols (.symtab) have mangled members that we must patch for anything to make sense +# Third, the section name string table (.shstrtab) is not an allocated section, meaning its not in memory +# Not having the .shstrtab makes analysis impossible-to-difficult for static analysis tools. To work around this, +# we create the .shstrtab based on the sections in memory and then glue it in as the final section + +# ModuleExtract.extract_module is the entry point and only visible method for plugins +class ModuleExtract(interfaces.configuration.VersionableInterface): + """Extracts Linux kernel module structures into an analyzable ELF file""" + + _version = (1, 0, 2) + _required_framework_version = (2, 25, 0) + + framework.require_interface_version(*_required_framework_version) + + @classmethod + def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]: + return [ + requirements.VersionRequirement( + name="linux_utilities_modules_modules", + component=Modules, + version=(3, 0, 2), + ), + ] + + @classmethod + def _find_section( + cls, section_lookups: List[Tuple[str, int, int, int]], sym_address: int + ) -> Optional[Tuple[str, int, int, int]]: + """ + Finds the section containing `sym_address` + """ + for name, index, address, size in section_lookups: + if address <= sym_address < address + size: + return name, index, address, size + + return None + + @classmethod + def _get_st_info_for_sym( + cls, sym: interfaces.objects.ObjectInterface, sym_address: int, sect_name: str + ) -> bytes: + """ + This is a helper function called from `_fix_sym_table` + + Calculates the `st_info` value for the given symbol + + Spec: https://refspecs.linuxbase.org/elf/gabi4+/ch4.symtab.html + """ + if sym.st_name > 0: + # Global symbol + bind = linux_constants.STB_GLOBAL + + if sym_address == 0: + sect_type = linux_constants.STT_NOTYPE + elif sect_name: + # rela = relocations + if sect_name.find(".text") != -1 and sect_name.find(".rela") == -1: + sect_type = linux_constants.STT_FUNC + else: + sect_type = linux_constants.STT_OBJECT + + else: + # outside the module being extracted + sect_type = linux_constants.STT_NOTYPE + + else: + # Local symbol + bind = linux_constants.STB_LOCAL + sect_type = linux_constants.STT_SECTION + + # Build the st_info as ELF32_ST_INFO/ELF64_ST_INFO + bind_bits = (bind << 4) & 0xF0 + type_bits = sect_type & 0xF + + st_info_int = (bind_bits | type_bits) & 0xFF + + return struct.pack("B", st_info_int) + + @classmethod + def _get_fixed_sym_fields( + cls, + st_fmt: str, + sym: interfaces.objects.ObjectInterface, + sections: List[Tuple[str, int, int, int]], + ) -> Tuple[str, int, int, int]: + """ + This is a helper function called from `_fix_sym_table` + + The st_value, st_info, and st_shndx fields of each symbol are changed/mangled while loading + Static analysis tools do not understand these transformed values as they only make sense to the kernel loader + We must de-mangle these to have analysis tools understand symbols (a key aspect) + """ + # Start by trying to map a symbol to its section + sym_address = sym.st_value + sect_info = cls._find_section(sections, sym_address) + + if not sect_info: + # Symbol does not point into the module being extracted + sect_name, sect_index, sect_address = None, None, None + st_value_int = sym_address + else: + # relative address inside the section + sect_name, sect_index, sect_address, _ = sect_info + st_value_int = sym_address - sect_address + + # Get the fixed st_value, st_info, and st_shndx that are broken in the mapped file + + # formatted to be written into the extracted file + st_value = struct.pack(st_fmt, st_value_int) + + # returns formatted to be written into the extracted file + st_info = cls._get_st_info_for_sym(sym, sym_address, sect_name) + + # format to reference its section, if any + if sect_name: + st_shndx = struct.pack(" Optional[bytes]: + """ + This function implements the most painful part of the reconstruction + + The symbols in .symtab are broken/mangled during loading. + We need to normalize these for static analysis tools to understand the references. + Without proper symbols, analysis is pretty pointless and gets nowhere. + + Spec: https://refspecs.linuxbase.org/elf/gabi4+/ch4.symtab.html + """ + kernel = context.modules[vmlinux_name] + + # Gather the section information into a list + section_lookups: List[Tuple[str, int, int, int]] = [] + for index, (address, name) in enumerate(original_sections.items()): + # We are fixing symtab references... + if name == ".symtab": + continue + + size = section_sizes[address] + + # Add 1 to account for leading NULL section + section_lookups.append((name, index + 1, address, size)) + + # Build the array of symbols as they are in memory + sym_type = kernel.get_type(sym_type_name) + + symbols = kernel.object( + object_type="array", + subtype=sym_type, + offset=module.section_symtab, + count=module.num_symtab, + absolute=True, + ) + + # used to hold the new (fixed) symbol table + sym_table_data = b"" + + # build a correct/normalized Elf32_Sym or Elf64_Sym for each symbol + for sym in symbols: + # get the mangled fields' correct values + sect_name, st_value, st_info, st_shndx = cls._get_fixed_sym_fields( + st_fmt, sym, section_lookups + ) + + # these aren't mangled during loading + st_name = struct.pack(" Optional[Tuple[List, int, int]]: + """ + This function first parses the sections as maintained by the kernel + It then orders the sections by load address, and then gathers the data of each section + We also track the file_offset to correctly have alignment in the output file + + .symtab requires special handling as its so broken in memory as described in `_fix_sym_table` + The data of .strtab is read directly off the module structure and not its section + as the section from the original module has no meaning after loading as the kernel does not reference it. + """ + kernel = context.modules[vmlinux_name] + kernel_layer = context.layers[kernel.layer_name] + modules_addr_min, modules_addr_max = ( + Modules.get_modules_memory_boundaries( + context, vmlinux_name + ) + ) + modules_addr_min &= kernel_layer.address_mask + modules_addr_max &= kernel_layer.address_mask + original_sections = {} + for index, section in enumerate(module.get_sections()): + # Extra sanity check, to prevent OOM on heavily smeared samples at line + # "size = next_address - address" + if not ( + modules_addr_min + <= section.address & kernel_layer.address_mask + < modules_addr_max + ): + continue + + name = section.get_name() + original_sections[section.address] = name + + if not original_sections: + return None + + if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name): + sym_type = "Elf64_Sym" + elf_hdr_type = "Elf64_Ehdr" + st_fmt = " Optional[bytes]: + """ + Creates a `bits` bit ELF header for the file based on recovered values + Called last as it needs information computed from the sections + + Spec: https://refspecs.linuxfoundation.org/elf/gabi4+/ch4.eheader.html + """ + if bits == 32: + fmt = " Optional[int]: + """ + This function makes a best effort to map common section names + to their attributes + """ + known_sections = { + ".note.gnu.build-id": linux_constants.SHT_NOTE, + ".text": linux_constants.SHT_PROGBITS, + ".init.text": linux_constants.SHT_PROGBITS, + ".exit.text": linux_constants.SHT_PROGBITS, + ".static_call.text": linux_constants.SHT_PROGBITS, + ".rodata": linux_constants.SHT_PROGBITS, + ".modinfo": linux_constants.SHT_PROGBITS, + "__param": linux_constants.SHT_PROGBITS, + ".data": linux_constants.SHT_PROGBITS, + ".gnu.linkonce.this_module": linux_constants.SHT_PROGBITS, + ".comment": linux_constants.SHT_PROGBITS, + ".shstrtab": linux_constants.SHT_STRTAB, + ".symtab": linux_constants.SHT_SYMTAB, + ".strtab": linux_constants.SHT_STRTAB, + } + + sect_type_val = linux_constants.SHT_PROGBITS + + if section_name.find(".rela.") != -1: + sect_type_val = linux_constants.SHT_RELA + + elif section_name in known_sections: + sect_type_val = known_sections[section_name] + + return sect_type_val + + # all sections from memory are allocated (SHF_ALLOC) + # special check certain other sections to try and ensure extra flags are added where needed + @classmethod + def _calc_sect_flags(cls, name: str) -> int: + """ + Make a best effort to map common section names to their permissions + If we miss a section here, users of common static analysis tools can mark the + sections are writable or executable manually, but that becomes very cumbersome + and breaks initial analysis by the tool + """ + # All sections in memory are allocated (`A` in readelf -S) + flags = linux_constants.SHF_ALLOC + + if name in [".text", ".init.text", ".exit.text", ".static_call.text"]: + flags = flags | linux_constants.SHF_EXECINSTR + + elif name in [ + ".data", + ".init.data", + ".exit.data", + ".bss", + "__tracepoints", + ".data.once", + "_ftrace_events", + ".gnu.linkonce.this_module", + ]: + flags = flags | linux_constants.SHF_WRITE + + return flags + + @classmethod + def _calc_link( + cls, name: str, strtab_index: int, symtab_index: int, sect_type: int + ) -> int: + """ + Calculates the link value for a section + + The most important ones are symtab indexes for relocations + and to point the symbol table to the string tab + + Spec: https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html + """ + # looking for RELA sections + if name.find(".rela.") != -1: + return symtab_index + + # per spec: "The section header index of the associated string table." + elif sect_type == linux_constants.SHT_SYMTAB: + return strtab_index + + return 0 + + @classmethod + def _calc_entsize(cls, name: str, sect_type: int, bits: int) -> int: + """ + Calculates the entsize for relocation sections and the symbol table section + + Spec: https://refspecs.linuxbase.org/elf/gabi4+/ch4.sheader.html + """ + # looking for RELA sections + if name.find(".rela.") != -1: + return 24 + + # per spec: "The section header index of the associated string table." + elif sect_type == linux_constants.SHT_SYMTAB: + if bits == 32: + return 16 + else: + return 24 + + return 0 + + @classmethod + def _make_section_header( + cls, + bits: int, + name_index: int, + name: str, + address: int, + size: int, + file_offset: int, + strtab_index: int, + symtab_index: int, + ) -> Optional[bytes]: + """ + Creates a section header (Elf32_Shdr or Elf64_Shdr) for the given section + """ + if bits == 32: + fmt = " Optional[bytes]: + # Bail early if bad address sent in + try: + hasattr(module.sect_attrs, "nsections") + except exceptions.InvalidAddressException: + vollog.debug(f"module at offset {module.vol.offset:#x} is paged out.") + return None + + # Gather sections + parse_sections_result = cls._parse_sections(context, vmlinux_name, module) + if parse_sections_result is None: + return None + updated_sections, strtab_index, symtab_index = parse_sections_result + + kernel = context.modules[vmlinux_name] + + # Figure out header sizes + if symbols.symbol_table_is_64bit(context, kernel.symbol_table_name): + header_type = "Elf64_Ehdr" + section_type = "Elf64_Shdr" + bits = 64 + else: + header_type = "Elf32_Ehdr" + section_type = "Elf32_Shdr" + bits = 32 + + header_type_size = kernel.get_type(header_type).size + section_type_size = kernel.get_type(section_type).size + + # Per Linux-spec, all LKMs must start with a null section header + # This buffer is used to hold the headers as they are built + sections_headers = b"\x00" * section_type_size + + # Holder of the data of the sections + sections_data = b"" + + # the .shstrtab section is "\x00" + section name for each section + # followed by a terminating null. + # It starts with the null string (\x00) + shstrtab_data = b"\x00" + + # Track where we end the sections and data to glue `.shstrtab` after + last_file_offset = None + last_sect_size = None + + # Start at 1 in the string table + name_index = 1 + + # Create the actual section headers + for index, (name, address, file_offset, section_data) in enumerate( + updated_sections + ): + # Make the section header + header_bytes = cls._make_section_header( + bits, + name_index, + name, + address, + len(section_data), + file_offset, + strtab_index, + symtab_index, + ) + if not header_bytes: + vollog.debug(f"make_section_header failed for section {name}") + return None + + # ndex into the string table + name_index += len(name) + 1 + + # concatenate the header and section bytes + sections_headers += header_bytes + sections_data += section_data + + # track where we are so .shstrtab goes into correct offset + last_file_offset = file_offset + last_sect_size = len(section_data) + + # append each section name to what will become .shstrtab + shstrtab_data += bytes(name, encoding="utf8") + b"\x00" + + # stick our own section reference string at end + # name_index points to the end of the last section string after the loop ends + shstrtab_data += b".shstrtab\x00" + + # create our .shstrtab section so sections have names + sections_headers += cls._make_section_header( + bits, + name_index, + ".shstrtab", + 0, + len(shstrtab_data), + last_file_offset + last_sect_size, + strtab_index, + symtab_index, + ) + + sections_data += shstrtab_data + + num_sections = len(updated_sections) + 1 + + header = cls._make_elf_header( + bits, + header_type_size + len(sections_data), + num_sections, + ) + + if not header: + vollog.error( + f"Hit error creating Elf header for module at {module.vol.offset:#x}" + ) + return None + + # Return our beautiful, hand-crafted, farm raised ELF file + return header + sections_data + sections_headers class ModuleGathererLsmod(ModuleGathererInterface): """ @@ -978,7 +1704,7 @@ class ModuleDisplayPlugin(interfaces.configuration.VersionableInterface): file_name = renderers.NotApplicableValue() if dump and open_implementation: - elf_data = linux_utilities_module_extract.ModuleExtract.extract_module( + elf_data = ModuleExtract.extract_module( context, kernel_module_name, module ) if not elf_data: From e9ce095b2924eb7d143aa7da24b79ed69850097b Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Thu, 20 Nov 2025 15:57:56 +0100 Subject: [PATCH 1299/1352] black formatting --- .../symbols/linux/utilities/module_extract.py | 8 ++------ .../framework/symbols/linux/utilities/modules.py | 11 ++++++----- 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/module_extract.py b/volatility3/framework/symbols/linux/utilities/module_extract.py index 3cc15085a..5ec254368 100644 --- a/volatility3/framework/symbols/linux/utilities/module_extract.py +++ b/volatility3/framework/symbols/linux/utilities/module_extract.py @@ -11,12 +11,7 @@ from typing import ( ) from volatility3 import framework -from volatility3.framework import ( - interfaces, - exceptions, - symbols, - deprecation -) +from volatility3.framework import interfaces, exceptions, symbols, deprecation from volatility3.framework.constants import linux as linux_constants from volatility3.framework.symbols.linux import extensions @@ -35,6 +30,7 @@ vollog = logging.getLogger(__name__) # ModuleExtract.extract_module is the entry point and only visible method for plugins + # See PR #1773 @deprecation.renamed_class( deprecated_class_name="ModuleExtract", diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 42383ecae..adacc54e3 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -25,7 +25,7 @@ from volatility3.framework import ( interfaces, objects, renderers, - symbols + symbols, ) from volatility3.framework.configuration import requirements from volatility3.framework.objects import utility @@ -784,6 +784,7 @@ class Modules(interfaces.configuration.VersionableInterface): yield name, value + # This module is responsible for producing an ELF file of a kernel module (LKM) loaded in memory # This extraction task is quite complicated as the Linux kernel discards the ELF header at load time # Due to this, to support static analysis, we must create an ELF header and proper file based on the sections @@ -795,6 +796,7 @@ class Modules(interfaces.configuration.VersionableInterface): # Not having the .shstrtab makes analysis impossible-to-difficult for static analysis tools. To work around this, # we create the .shstrtab based on the sections in memory and then glue it in as the final section + # ModuleExtract.extract_module is the entry point and only visible method for plugins class ModuleExtract(interfaces.configuration.VersionableInterface): """Extracts Linux kernel module structures into an analyzable ELF file""" @@ -1010,10 +1012,8 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): """ kernel = context.modules[vmlinux_name] kernel_layer = context.layers[kernel.layer_name] - modules_addr_min, modules_addr_max = ( - Modules.get_modules_memory_boundaries( - context, vmlinux_name - ) + modules_addr_min, modules_addr_max = Modules.get_modules_memory_boundaries( + context, vmlinux_name ) modules_addr_min &= kernel_layer.address_mask modules_addr_max &= kernel_layer.address_mask @@ -1509,6 +1509,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): # Return our beautiful, hand-crafted, farm raised ELF file return header + sections_data + sections_headers + class ModuleGathererLsmod(ModuleGathererInterface): """ Gathers modules from the main kernel list From 32f37ee6323ea2f7ee206aafe7d7a0faf60ac36f Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 24 Nov 2025 17:34:31 +0100 Subject: [PATCH 1300/1352] remove hasattr check on bin_attribute --- .../symbols/linux/extensions/__init__.py | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 953e3cb89..68d1aae52 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -3227,18 +3227,13 @@ class bin_attribute(objects.StructType): """ Performs extraction of the bin_attribute name """ - if hasattr(self, "attr"): - try: - return utility.pointer_to_string( - self.attr.name, count=linux_constants.ATTRIBUTE_NAME_MAX_SIZE - ) - except exceptions.InvalidAddressException: - vollog.debug( - f"Invalid attr name for bin_attribute at {self.vol.offset:#x}" - ) - return None - - return None + try: + return utility.pointer_to_string( + self.attr.name, count=linux_constants.ATTRIBUTE_NAME_MAX_SIZE + ) + except exceptions.InvalidAddressException: + vollog.debug(f"Invalid attr name for bin_attribute at {self.vol.offset:#x}") + return None @property def address(self) -> int: From 8b132eafd15f885806028e522887e520d22c60bb Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 24 Nov 2025 17:57:37 +0100 Subject: [PATCH 1301/1352] extend _fix_sym_table's docstring --- volatility3/framework/symbols/linux/utilities/modules.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index adacc54e3..598e79b18 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -925,6 +925,15 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): module: extensions.module, ) -> Optional[bytes]: """ + Args: + context: The context on which to operate. + vmlinux_name: The name of the kernel module. + original_sections: Dict of module section addresses and names. + section_sizes: Dict of module section addresses and sizes. + sym_type_name: ELF symbol type name (should be one of "Elf64_Sym" or "Elf32_Sym"). + st_fmt: "struct"-like unpack format string (should be one of " Date: Mon, 1 Dec 2025 15:54:58 +0100 Subject: [PATCH 1302/1352] remove PTEs "large_page" attribute and re-order large_page check --- volatility3/framework/layers/intel.py | 32 ++++++++++++++------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 848580004..f750f3f2f 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -38,7 +38,7 @@ class Intel(linear.LinearlyMappedLayer): # NOTE: _maxphyaddr is MAXPHYADDR as defined in the Intel specs *NOT* the maximum physical address _maxphyaddr = 32 _maxvirtaddr = _maxphyaddr - _structure = [("page directory", 10, False), ("page table", 10, True)] + _structure = [("page directory", 10, True), ("page table", 10, False)] _direct_metadata = collections.ChainMap( {"architecture": "Intel32"}, {"mapped": True}, @@ -221,18 +221,6 @@ class Intel(linear.LinearlyMappedLayer): entry, "Page Fault at entry " + hex(entry) + " in table " + name, ) - # Check if we're a large page - if large_page and (entry & self._PAGE_PSE): - # Mask off the PAT bit - if entry & self._PAGE_PAT_LARGE: - entry -= self._PAGE_PAT_LARGE - # We're a large page, the rest is finished below - # If we want to implement PSE-36, it would need to be done here - break - # Figure out how much of the offset we should be using - start = position - position -= size - index = self._mask(page_address, start, position + 1) >> (position + 1) # Grab the base address of the table we'll be getting the next entry from base_address = self._mask( @@ -249,6 +237,11 @@ class Intel(linear.LinearlyMappedLayer): "Page Fault at entry " + hex(entry) + " in table " + name, ) + # Figure out how much of the offset we should be using + start = position + position -= size + index = self._mask(page_address, start, position + 1) >> (position + 1) + # Read the data for the next entry entry_data_start = index << self._index_shift entry_data = table[entry_data_start : entry_data_start + self._entry_size] @@ -262,6 +255,15 @@ class Intel(linear.LinearlyMappedLayer): # Read out the new entry from memory (entry,) = struct.unpack(self._entry_format, entry_data) + # Check if we're a large page + if large_page and (entry & self._PAGE_PSE): + # Mask off the PAT bit + if entry & self._PAGE_PAT_LARGE: + entry -= self._PAGE_PAT_LARGE + # We're a large page, the rest is finished below + # If we want to implement PSE-36, it would need to be done here + break + return entry, position @functools.lru_cache(maxsize=1025) @@ -429,7 +431,7 @@ class IntelPAE(Intel): _structure = [ ("page directory pointer", 2, False), ("page directory", 9, True), - ("page table", 9, True), + ("page table", 9, False), ] _direct_metadata = collections.ChainMap({"pae": True}, Intel._direct_metadata) @@ -449,7 +451,7 @@ class Intel32e(Intel): ("page map layer 4", 9, False), ("page directory pointer", 9, True), ("page directory", 9, True), - ("page table", 9, True), + ("page table", 9, False), ] From ae0f0ca440f878d7e7e56c163b6cb61eb58f19e5 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Mon, 1 Dec 2025 15:56:56 +0100 Subject: [PATCH 1303/1352] skip invalid blocks more efficiently --- volatility3/framework/layers/intel.py | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index f750f3f2f..4108d7231 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -269,9 +269,12 @@ class Intel(linear.LinearlyMappedLayer): @functools.lru_cache(maxsize=1025) def _get_valid_table(self, base_address: int) -> Optional[bytes]: """Extracts the table, validates it and returns it if it's valid.""" - table = self._context.layers.read( - self._base_layer, base_address, self.page_size - ) + try: + table = self._context.layers.read( + self._base_layer, base_address, self.page_size + ) + except exceptions.InvalidAddressException: + return None # If the table is entirely duplicates, then mark the whole table as bad if table == table[: self._entry_size] * self._entry_number: @@ -375,12 +378,19 @@ class Intel(linear.LinearlyMappedLayer): while length > 0: try: chunk_offset, page_size, layer_name = self._translate(offset) - chunk_size = min(page_size - (chunk_offset % page_size), length) + # Page align the chunk size value + chunk_size = min(page_size - (offset % page_size), length) if not self._context.layers[layer_name].is_valid( chunk_offset, chunk_size ): - raise exceptions.InvalidAddressException( - layer_name=layer_name, invalid_address=chunk_offset + # Virtual -> physical is contiguous in the chunk_size range. + # If we fail, we can jump directly to the end as we know all bytes in between + # aren't mapped (virtually and) physically anyway. + raise exceptions.PagedInvalidAddressException( + layer_name=layer_name, + invalid_address=chunk_offset, + entry=0, + invalid_bits=int(math.log2(chunk_size)), ) except ( exceptions.PagedInvalidAddressException, From f4e2f1391e25da8d0aa8e69da3bd1257bf2db2e1 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 3 Dec 2025 11:22:27 +0100 Subject: [PATCH 1304/1352] refactor use of "invalid_bits" inside _mapping into a dedicated variable --- volatility3/framework/layers/intel.py | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index 4108d7231..e6a3244cb 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -376,6 +376,7 @@ class Intel(linear.LinearlyMappedLayer): yield offset, length, mapped_offset, length, layer_name return None while length > 0: + skip_mask = None try: chunk_offset, page_size, layer_name = self._translate(offset) # Page align the chunk size value @@ -386,11 +387,9 @@ class Intel(linear.LinearlyMappedLayer): # Virtual -> physical is contiguous in the chunk_size range. # If we fail, we can jump directly to the end as we know all bytes in between # aren't mapped (virtually and) physically anyway. - raise exceptions.PagedInvalidAddressException( - layer_name=layer_name, - invalid_address=chunk_offset, - entry=0, - invalid_bits=int(math.log2(chunk_size)), + skip_mask = chunk_size - 1 + raise exceptions.InvalidAddressException( + layer_name=layer_name, invalid_address=chunk_offset ) except ( exceptions.PagedInvalidAddressException, @@ -398,12 +397,13 @@ class Intel(linear.LinearlyMappedLayer): ) as excp: if not ignore_errors: raise - # We can jump more if we know where the page fault failed - if isinstance(excp, exceptions.PagedInvalidAddressException): - mask = (1 << excp.invalid_bits) - 1 - else: - mask = (1 << self._page_size_in_bits) - 1 - length_diff = mask + 1 - (offset & mask) + if skip_mask is None: + # We can jump more if we know where the page fault occured + if isinstance(excp, exceptions.PagedInvalidAddressException): + skip_mask = (1 << excp.invalid_bits) - 1 + else: + skip_mask = (1 << self._page_size_in_bits) - 1 + length_diff = skip_mask + 1 - (offset & skip_mask) length -= length_diff offset += length_diff else: From 93d6282817045e4f0a0d8667a7cb2d4f52ae0c11 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 3 Dec 2025 11:25:56 +0100 Subject: [PATCH 1305/1352] version bump: 2.27.0 -> 2.27.1 --- volatility3/framework/constants/_version.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/constants/_version.py b/volatility3/framework/constants/_version.py index 7f71c277e..73eb5452e 100644 --- a/volatility3/framework/constants/_version.py +++ b/volatility3/framework/constants/_version.py @@ -1,7 +1,7 @@ # We use the SemVer 2.0.0 versioning scheme VERSION_MAJOR = 2 # Number of releases of the library with a breaking change VERSION_MINOR = 27 # Number of changes that only add to the interface -VERSION_PATCH = 0 # Number of changes that do not change the interface +VERSION_PATCH = 1 # Number of changes that do not change the interface VERSION_SUFFIX = "" PACKAGE_VERSION = ( From 89c5fc325a238e81294d3615c394b813ae2d1d89 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 3 Dec 2025 17:34:25 +0100 Subject: [PATCH 1306/1352] move iterator_guard_value down the parameters list --- volatility3/framework/objects/utility.py | 2 +- volatility3/framework/symbols/linux/extensions/__init__.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index be57f9ad7..05ad76d11 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -257,8 +257,8 @@ def array_of_pointers( def dynamically_sized_array_of_pointers( context: interfaces.context.ContextInterface, array: interfaces.objects.ObjectInterface, - iterator_guard_value: int, subtype: Union[str, interfaces.objects.Template], + iterator_guard_value: int, stop_value: int = 0, stop_on_invalid_pointers: bool = True, ) -> interfaces.objects.ObjectInterface: diff --git a/volatility3/framework/symbols/linux/extensions/__init__.py b/volatility3/framework/symbols/linux/extensions/__init__.py index 68d1aae52..71ce82d82 100644 --- a/volatility3/framework/symbols/linux/extensions/__init__.py +++ b/volatility3/framework/symbols/linux/extensions/__init__.py @@ -210,8 +210,8 @@ class module(generic.GenericIntelProcess): bin_attrs_list = utility.dynamically_sized_array_of_pointers( context=self._context, array=arr_offset_ptr.dereference(), - iterator_guard_value=100, subtype=self.get_symbol_table_name() + constants.BANG + arr_subtype, + iterator_guard_value=100, ) return len(bin_attrs_list) From d7103a22141c2f8d9e40c524cb56b5fefe032868 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 3 Dec 2025 17:41:58 +0100 Subject: [PATCH 1307/1352] ensure that _parse_sections returns a constant number of None on failure --- volatility3/framework/symbols/linux/utilities/modules.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/symbols/linux/utilities/modules.py b/volatility3/framework/symbols/linux/utilities/modules.py index 598e79b18..63b25380a 100644 --- a/volatility3/framework/symbols/linux/utilities/modules.py +++ b/volatility3/framework/symbols/linux/utilities/modules.py @@ -1134,7 +1134,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): vollog.debug( f"Could not construct a symbol table for module at {module.vol.offset}. Cannot recover." ) - return None, None, None + return None symtab_index = len(updated_sections) @@ -1145,7 +1145,7 @@ class ModuleExtract(interfaces.configuration.VersionableInterface): vollog.debug( f"Did not find a .symtab section for module at {module.vol.offset:#x}. Cannot recover." ) - return None, None, None + return None return updated_sections, strtab_index, symtab_index From 0138aec419e5febdc13781b2ea6832bd151c9e1e Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Wed, 3 Dec 2025 17:43:39 +0100 Subject: [PATCH 1308/1352] manually iterate over the pointers to detect OOB locally --- volatility3/framework/objects/utility.py | 27 ++++++++++++++++++------ 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/objects/utility.py b/volatility3/framework/objects/utility.py index 05ad76d11..799639a67 100644 --- a/volatility3/framework/objects/utility.py +++ b/volatility3/framework/objects/utility.py @@ -279,14 +279,27 @@ def dynamically_sized_array_of_pointers( An array of pointer objects """ new_count = 0 - for entry in array_of_pointers( - array=array, count=iterator_guard_value, subtype=subtype, context=context - ): - # "entry" is naturally represented by the address that the pointer refers to - if (entry == stop_value) or ( - not entry.is_readable() and stop_on_invalid_pointers - ): + sym_table_name = array.get_symbol_table_name() + sym_table = context.symbol_space[sym_table_name] + ptr_size = sym_table.get_type("pointer").size + layer_name = array.vol.layer_name + + offset = array.vol.offset + entry = None + while entry != stop_value and new_count < iterator_guard_value: + try: + entry = context.object( + sym_table_name + constants.BANG + "pointer", + offset=offset, + layer_name=layer_name, + ) + except exceptions.InvalidAddressException: break + + if not entry.is_readable() and stop_on_invalid_pointers: + break + + offset += ptr_size new_count += 1 else: vollog.log( From 50f64f66d547fa8379d47ab8972be665347b4a4e Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 16 Dec 2025 10:03:37 +0000 Subject: [PATCH 1309/1352] Document the reason for skipping entirely duplicated page tables --- volatility3/framework/layers/intel.py | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/layers/intel.py b/volatility3/framework/layers/intel.py index e6a3244cb..380d0e49f 100644 --- a/volatility3/framework/layers/intel.py +++ b/volatility3/framework/layers/intel.py @@ -10,7 +10,7 @@ import struct from typing import Any, Dict, Iterable, List, Optional, Tuple from volatility3 import classproperty -from volatility3.framework import exceptions, interfaces, constants +from volatility3.framework import constants, exceptions, interfaces from volatility3.framework.configuration import requirements from volatility3.framework.layers import linear @@ -276,7 +276,31 @@ class Intel(linear.LinearlyMappedLayer): except exceptions.InvalidAddressException: return None + #### # If the table is entirely duplicates, then mark the whole table as bad + # This is because Windows 10 onwards has a tendency to map unused pages as present + # This had the following consequences: + # - Used very litle physical memory + # - Exploded virtual memory + # - Causes *scan plugins to take multiple hours to complete even on small images + + # Previous versions of volatility would ignore a page during a scan when it matched + # the one directly preceding it in physical memory. + # This could trip if only two pages were identical and still required enumerating all + # the invalid pages (which itself was quite time consuming) + + # For this reason, volatility 3 shifted to looking at entire page tables (1,024 pages) + # and if all the pages mapped to the same place the table wouuld be skipped + # This could also be applied to the Directory level as well as the Table level, allowing + # Volatility to skip huge sections of virtual memory very efficiently, without missing + # any pages that were distinct within a particular page table (or directory). + + # In order to work at this level, the logic was moved out of the scanning component and + # directly into the layer logic itself. This does have the side effect of preventing + # entirely duplicated page tables from reporting as present, however, the trade off between + # Windows 10+ reduced scanning times (common amongst scan plugins) versus incorrectly reporting + # entire page tables of identically mapped repeating *valid* data (rare) was accepted in favour + # of the more common occurance. if table == table[: self._entry_size] * self._entry_number: return None return table From 105ee08d918be92e5abf551d4cbe820010e45982 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 28 Dec 2025 14:09:51 +0000 Subject: [PATCH 1310/1352] Avoid trying to lookup child nodes that have been filtered Fixes issue1309. --- volatility3/cli/text_renderer.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index d55201371..d400067af 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -10,8 +10,8 @@ import string import sys from functools import wraps from typing import Any, Callable, Dict, List, Optional, Set, Tuple, TypeVar, Union -from volatility3.cli import text_filter +from volatility3.cli import text_filter from volatility3.framework import exceptions, interfaces, renderers from volatility3.framework.renderers import format_hints @@ -464,9 +464,9 @@ class PrettyTextRenderer(CLIRenderer): accumulator.append((node.path_depth, line)) return accumulator - final_output: List[Tuple[int, Dict[interfaces.renderers.Column, list[str]]]] = ( - [] - ) + final_output: List[ + Tuple[int, Dict[interfaces.renderers.Column, list[str]]] + ] = [] if not grid.populated: grid.populate(visitor, final_output) else: @@ -598,7 +598,8 @@ class JsonRenderer(CLIRenderer): if self.filter and self.filter.filter(line): return accumulator - if node.parent: + # Only add if the parent hasn't been filtered out + if node.parent and node.parent.path in acc_map: acc_map[node.parent.path]["__children"].append(node_dict) else: final_tree.append(node_dict) From 0089aefaf6a4b72729ff79ddaf2d0390ba24ddb7 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Sun, 28 Dec 2025 14:13:44 +0000 Subject: [PATCH 1311/1352] Reformat because ruff and black disagree --- volatility3/cli/text_renderer.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/volatility3/cli/text_renderer.py b/volatility3/cli/text_renderer.py index d400067af..d00c00bf4 100644 --- a/volatility3/cli/text_renderer.py +++ b/volatility3/cli/text_renderer.py @@ -464,9 +464,9 @@ class PrettyTextRenderer(CLIRenderer): accumulator.append((node.path_depth, line)) return accumulator - final_output: List[ - Tuple[int, Dict[interfaces.renderers.Column, list[str]]] - ] = [] + final_output: List[Tuple[int, Dict[interfaces.renderers.Column, list[str]]]] = ( + [] + ) if not grid.populated: grid.populate(visitor, final_output) else: From 5aea7f92e94af4b04e811b73ceadb51cc9a355d3 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 3 Jun 2025 00:00:13 +0300 Subject: [PATCH 1312/1352] process_spoofing plugin --- .../plugins/linux/process_spoofing.py | 253 ++++++++++++++++++ 1 file changed, 253 insertions(+) create mode 100644 volatility3/framework/plugins/linux/process_spoofing.py diff --git a/volatility3/framework/plugins/linux/process_spoofing.py b/volatility3/framework/plugins/linux/process_spoofing.py new file mode 100644 index 000000000..2546a3623 --- /dev/null +++ b/volatility3/framework/plugins/linux/process_spoofing.py @@ -0,0 +1,253 @@ +# This file is Copyright 2025 Volatility Foundation and licensed under the Volatility Software License 1.0 +# which is available at https://www.volatilityfoundation.org/license/vsl-v1.0 +# + +import logging +from pathlib import PurePosixPath +from typing import Optional, Tuple, Iterator + +from volatility3.framework import exceptions, interfaces, renderers +from volatility3.framework.configuration import requirements +from volatility3.framework.interfaces import plugins +from volatility3.framework.objects import utility +from volatility3.framework.symbols import linux +from volatility3.plugins.linux import pslist + +vollog = logging.getLogger(__name__) + + +# https://github.com/SolitudePy/linux-mal +class ProcessSpoofing(plugins.PluginInterface): + """Detects process spoofing by comparing executable path to cmdline & comm fields""" + + _required_framework_version = (2, 0, 0) + _version = (1, 0, 0) + + @classmethod + def get_requirements(cls): + return [ + requirements.ModuleRequirement( + name="kernel", + description="Linux kernel", + architectures=["Intel32", "Intel64"], + ), + requirements.VersionRequirement( + name="pslist", component=pslist.PsList, version=(4, 0, 0) + ), + requirements.VersionRequirement( + name="linuxutils", component=linux.LinuxUtilities, version=(2, 0, 0) + ), + requirements.ListRequirement( + name="pid", + description="Filter on specific process IDs", + element_type=int, + optional=True, + ), + ] + + def _get_executable_path( + self, task: interfaces.objects.ObjectInterface + ) -> Optional[str]: + """ + Extract the executable path from task_struct.mm.exe_file + + Args: + task: task_struct object of the process + + Returns: + Executable path or None if not available + """ + try: + mm = task.mm + if not mm or not mm.is_readable(): + # Kernel threads doesn't have + return None + + exe_file = mm.exe_file + if not exe_file or not exe_file.is_readable(): + return None + + # Use LinuxUtilities.path_for_file to extract the path + exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file) + + return exe_path if exe_path else None + + except (exceptions.InvalidAddressException, AttributeError): + return None + + def _get_cmdline_basename( + self, task: interfaces.objects.ObjectInterface + ) -> Optional[str]: + """ + Extract the command line arguments and return the basename of the first argument + + Args: + task: task_struct object of the process + + Returns: + Basename of the first command line argument or None if not available + """ + try: + mm = task.mm + if not mm or not mm.is_readable(): + return renderers.NotAvailableValue() + + proc_layer_name = task.add_process_layer() + if proc_layer_name is None: + return None + + proc_layer = self.context.layers[proc_layer_name] + + # Read argv from userland + start = task.mm.arg_start + size_to_read = task.mm.arg_end - task.mm.arg_start + + if not (0 < size_to_read <= 4096): + return None + + # Attempt to read command line arguments + try: + argv = proc_layer.read(start, size_to_read) + except exceptions.InvalidAddressException: + return None + + # Parse the arguments - they are null byte terminated + args_str = argv.decode(encoding="utf8", errors="replace") + args_list = args_str.split("\x00") + if args_list and args_list[0]: + basename = PurePosixPath(args_list[0]).name + return basename + else: + return None + + except (exceptions.InvalidAddressException, AttributeError): + return None + + def _get_comm(self, task: interfaces.objects.ObjectInterface) -> Optional[str]: + """ + Extract the comm field from task_struct + + Args: + task: task_struct object of the process + + Returns: + Process name from comm field or None if not available + """ + try: + return utility.array_to_string(task.comm) + except (exceptions.InvalidAddressException, AttributeError): + return None + + def _extract_process_names( + self, task: interfaces.objects.ObjectInterface + ) -> Tuple[Optional[str], Optional[str], Optional[str]]: + """ + Extract all three process name sources for comparison + + Args: + task: task_struct object of the process + + Returns: + Tuple of (exe_path_basename, cmdline_basename, comm) + """ + exe_path = self._get_executable_path(task) + exe_basename = PurePosixPath(exe_path).name + cmdline_basename = self._get_cmdline_basename(task) + comm = self._get_comm(task) + + return exe_basename, cmdline_basename, comm + + def _detect_spoofing( + self, + exe_basename: Optional[str], + cmdline_basename: Optional[str], + comm: Optional[str], + ) -> Optional[list]: + """ + Analyze the three name sources to detect potential spoofing + + Args: + exe_basename: Basename from exe_file path + cmdline_basename: Basename from command line + comm: Name from comm field + + Returns: + notes: List of notes indicating potential spoofing, or None if no issues found + """ + notes = [] + + # Count how many name sources we have + available_sources = sum( + 1 for name in [exe_basename, cmdline_basename, comm] if name + ) + + if available_sources < 2: + return None + + if exe_basename != cmdline_basename: + notes.append( + f"'Potential cmdline spoofing: exe_file={exe_basename};cmdline={cmdline_basename}'" + ) + if exe_basename[:15] != comm: + notes.append( + f"'Potential comm spoofing: exe_file={exe_basename};comm={comm}'" + ) + return notes + + def _generator(self, tasks) -> Iterator[Tuple[int, Tuple]]: + """ + Generate process spoofing detection results + + Args: + tasks: Iterator of task_struct objects + + Yields: + Tuple containing process information and spoofing analysis + """ + for task in tasks: + try: + pid = task.pid + ppid = task.get_parent_pid() + + exe_basename, cmdline_basename, comm = self._extract_process_names(task) + + notes = self._detect_spoofing(exe_basename, cmdline_basename, comm) + + exe_render = exe_basename if exe_basename else "N/A" + cmdline_render = cmdline_basename if cmdline_basename else "N/A" + comm_render = comm if comm else "N/A" + + yield ( + 0, + ( + pid, + ppid, + exe_render, + cmdline_render, + comm_render, + "[" + ", ".join(notes) + "]" if notes else "OK", + ), + ) + + except Exception as e: + vollog.debug(f"Error processing task at {task.vol.offset:#x}: {e}") + continue + + def run(self): + filter_func = pslist.PsList.create_pid_filter(self.config.get("pid", None)) + + return renderers.TreeGrid( + [ + ("PID", int), + ("PPID", int), + ("Exe_Basename", str), + ("Cmdline_Basename", str), + ("Comm", str), + ("Notes", str), + ], + self._generator( + pslist.PsList.list_tasks( + self.context, self.config["kernel"], filter_func=filter_func + ) + ), + ) From cf6fa422b479bdd9bc8e749e5a1d72a9b949d89b Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Tue, 3 Jun 2025 00:10:44 +0300 Subject: [PATCH 1313/1352] cosmetics --- volatility3/framework/plugins/linux/process_spoofing.py | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/volatility3/framework/plugins/linux/process_spoofing.py b/volatility3/framework/plugins/linux/process_spoofing.py index 2546a3623..9d2e55acb 100644 --- a/volatility3/framework/plugins/linux/process_spoofing.py +++ b/volatility3/framework/plugins/linux/process_spoofing.py @@ -60,14 +60,12 @@ class ProcessSpoofing(plugins.PluginInterface): try: mm = task.mm if not mm or not mm.is_readable(): - # Kernel threads doesn't have + # Kernel threads doesn't have mm return None exe_file = mm.exe_file if not exe_file or not exe_file.is_readable(): return None - - # Use LinuxUtilities.path_for_file to extract the path exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file) return exe_path if exe_path else None @@ -97,15 +95,12 @@ class ProcessSpoofing(plugins.PluginInterface): return None proc_layer = self.context.layers[proc_layer_name] - - # Read argv from userland start = task.mm.arg_start size_to_read = task.mm.arg_end - task.mm.arg_start if not (0 < size_to_read <= 4096): return None - # Attempt to read command line arguments try: argv = proc_layer.read(start, size_to_read) except exceptions.InvalidAddressException: @@ -176,7 +171,7 @@ class ProcessSpoofing(plugins.PluginInterface): """ notes = [] - # Count how many name sources we have + # Skip kernel threads available_sources = sum( 1 for name in [exe_basename, cmdline_basename, comm] if name ) From 5c3fca35447247c0d59c814682ae95952fc1067a Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 4 Jun 2025 21:10:11 +0300 Subject: [PATCH 1314/1352] added mechanism for deleted exe --- .../framework/plugins/linux/process_spoofing.py | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/process_spoofing.py b/volatility3/framework/plugins/linux/process_spoofing.py index 9d2e55acb..451889029 100644 --- a/volatility3/framework/plugins/linux/process_spoofing.py +++ b/volatility3/framework/plugins/linux/process_spoofing.py @@ -21,7 +21,8 @@ class ProcessSpoofing(plugins.PluginInterface): """Detects process spoofing by comparing executable path to cmdline & comm fields""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 1, 0) + deleted = " (deleted)" @classmethod def get_requirements(cls): @@ -64,10 +65,17 @@ class ProcessSpoofing(plugins.PluginInterface): return None exe_file = mm.exe_file + if not exe_file or not exe_file.is_readable(): return None + + exe_inode = exe_file.dereference().f_path.dentry.d_inode exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file) + # If the inode link count is 0, the process image has been deleted + if exe_inode.i_nlink == 0: + exe_path += self.deleted + return exe_path if exe_path else None except (exceptions.InvalidAddressException, AttributeError): @@ -176,6 +184,11 @@ class ProcessSpoofing(plugins.PluginInterface): 1 for name in [exe_basename, cmdline_basename, comm] if name ) + is_deleted = exe_basename.endswith(self.deleted) + if is_deleted: + notes.append(f"'Potential Process image deletion: exe_file={exe_basename}'") + exe_basename = exe_basename[: len(self.deleted) * -1] + if available_sources < 2: return None From fd270a208d3ddb9c72cc047dd8b4901bb7f2e1b7 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Sat, 7 Jun 2025 13:49:44 +0300 Subject: [PATCH 1315/1352] categorize as a malware plugin --- .../framework/plugins/linux/{ => malware}/process_spoofing.py | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename volatility3/framework/plugins/linux/{ => malware}/process_spoofing.py (100%) diff --git a/volatility3/framework/plugins/linux/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py similarity index 100% rename from volatility3/framework/plugins/linux/process_spoofing.py rename to volatility3/framework/plugins/linux/malware/process_spoofing.py From 15dc9ec4635170f70edcb8fb96c25251a3040d0c Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 19:05:10 +0300 Subject: [PATCH 1316/1352] Plugins: precise exception handling in process_spoofing --- .../framework/plugins/linux/malware/process_spoofing.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 451889029..b14dd208c 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -237,8 +237,10 @@ class ProcessSpoofing(plugins.PluginInterface): ), ) - except Exception as e: - vollog.debug(f"Error processing task at {task.vol.offset:#x}: {e}") + except (exceptions.InvalidAddressException, AttributeError) as e: + vollog.warning( + f"Unable to process task PID {getattr(task, 'pid', 'unknown')} at {task.vol.offset:#x}: {e}" + ) continue def run(self): From d55cf9a9d0f518331e01d78fff88e2f06d0f9ef9 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 19:07:17 +0300 Subject: [PATCH 1317/1352] Plugins: remove exe_file dereference() --- .../framework/plugins/linux/malware/process_spoofing.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index b14dd208c..f32f80f8a 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -61,7 +61,7 @@ class ProcessSpoofing(plugins.PluginInterface): try: mm = task.mm if not mm or not mm.is_readable(): - # Kernel threads doesn't have mm + # Kernel threads don't have mm struct return None exe_file = mm.exe_file @@ -69,7 +69,7 @@ class ProcessSpoofing(plugins.PluginInterface): if not exe_file or not exe_file.is_readable(): return None - exe_inode = exe_file.dereference().f_path.dentry.d_inode + exe_inode = exe_file.f_path.dentry.d_inode exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file) # If the inode link count is 0, the process image has been deleted From cc6aa2117b8b4700d52a6bdafc23c1f5cd14307b Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 19:14:40 +0300 Subject: [PATCH 1318/1352] Plugins: convert useful methods to classmethods --- .../plugins/linux/malware/process_spoofing.py | 33 ++++++++++++------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index f32f80f8a..7302f2a71 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -46,13 +46,17 @@ class ProcessSpoofing(plugins.PluginInterface): ), ] - def _get_executable_path( - self, task: interfaces.objects.ObjectInterface + @classmethod + def get_executable_path( + cls, + context: interfaces.context.ContextInterface, + task: interfaces.objects.ObjectInterface, ) -> Optional[str]: """ Extract the executable path from task_struct.mm.exe_file Args: + context: The context to operate on task: task_struct object of the process Returns: @@ -70,24 +74,28 @@ class ProcessSpoofing(plugins.PluginInterface): return None exe_inode = exe_file.f_path.dentry.d_inode - exe_path = linux.LinuxUtilities.path_for_file(self.context, task, exe_file) + exe_path = linux.LinuxUtilities.path_for_file(context, task, exe_file) # If the inode link count is 0, the process image has been deleted if exe_inode.i_nlink == 0: - exe_path += self.deleted + exe_path += cls.deleted return exe_path if exe_path else None except (exceptions.InvalidAddressException, AttributeError): return None - def _get_cmdline_basename( - self, task: interfaces.objects.ObjectInterface + @classmethod + def get_cmdline_basename( + cls, + context: interfaces.context.ContextInterface, + task: interfaces.objects.ObjectInterface, ) -> Optional[str]: """ Extract the command line arguments and return the basename of the first argument Args: + context: The context to operate on task: task_struct object of the process Returns: @@ -102,7 +110,7 @@ class ProcessSpoofing(plugins.PluginInterface): if proc_layer_name is None: return None - proc_layer = self.context.layers[proc_layer_name] + proc_layer = context.layers[proc_layer_name] start = task.mm.arg_start size_to_read = task.mm.arg_end - task.mm.arg_start @@ -126,7 +134,8 @@ class ProcessSpoofing(plugins.PluginInterface): except (exceptions.InvalidAddressException, AttributeError): return None - def _get_comm(self, task: interfaces.objects.ObjectInterface) -> Optional[str]: + @classmethod + def get_comm(cls, task: interfaces.objects.ObjectInterface) -> Optional[str]: """ Extract the comm field from task_struct @@ -153,10 +162,10 @@ class ProcessSpoofing(plugins.PluginInterface): Returns: Tuple of (exe_path_basename, cmdline_basename, comm) """ - exe_path = self._get_executable_path(task) - exe_basename = PurePosixPath(exe_path).name - cmdline_basename = self._get_cmdline_basename(task) - comm = self._get_comm(task) + exe_path = self.get_executable_path(self.context, task) + exe_basename = PurePosixPath(exe_path).name if exe_path else None + cmdline_basename = self.get_cmdline_basename(self.context, task) + comm = self.get_comm(task) return exe_basename, cmdline_basename, comm From 939034cd3344b5511ebbde43c1a3c50cdf15eb11 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 19:16:52 +0300 Subject: [PATCH 1319/1352] Plugins: consistent return values in process_spoofing --- volatility3/framework/plugins/linux/malware/process_spoofing.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 7302f2a71..01d4c1e2c 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -104,7 +104,7 @@ class ProcessSpoofing(plugins.PluginInterface): try: mm = task.mm if not mm or not mm.is_readable(): - return renderers.NotAvailableValue() + return None proc_layer_name = task.add_process_layer() if proc_layer_name is None: From 83494796432fe9bd1348e5bfbd6fa3549b9e79ef Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 19:34:58 +0300 Subject: [PATCH 1320/1352] Plugins: process_spoofing log exceptions as debug --- .../plugins/linux/malware/process_spoofing.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 01d4c1e2c..473bd7d07 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -82,7 +82,10 @@ class ProcessSpoofing(plugins.PluginInterface): return exe_path if exe_path else None - except (exceptions.InvalidAddressException, AttributeError): + except (exceptions.InvalidAddressException, AttributeError) as e: + vollog.debug( + f"Unable to read executable path for task at {task.vol.offset:#x}: {e}" + ) return None @classmethod @@ -147,7 +150,8 @@ class ProcessSpoofing(plugins.PluginInterface): """ try: return utility.array_to_string(task.comm) - except (exceptions.InvalidAddressException, AttributeError): + except (exceptions.InvalidAddressException, AttributeError) as e: + vollog.debug(f"Unable to read comm for task at {task.vol.offset:#x}: {e}") return None def _extract_process_names( @@ -193,7 +197,7 @@ class ProcessSpoofing(plugins.PluginInterface): 1 for name in [exe_basename, cmdline_basename, comm] if name ) - is_deleted = exe_basename.endswith(self.deleted) + is_deleted = exe_basename and exe_basename.endswith(self.deleted) if is_deleted: notes.append(f"'Potential Process image deletion: exe_file={exe_basename}'") exe_basename = exe_basename[: len(self.deleted) * -1] From 1a92e749ffae2e6189aec920d4fd9178004ca046 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 19:39:05 +0300 Subject: [PATCH 1321/1352] Plugins: more precise exception handling in process_spoofing --- .../plugins/linux/malware/process_spoofing.py | 57 +++++++++---------- 1 file changed, 28 insertions(+), 29 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 473bd7d07..b3cc37cc7 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -104,37 +104,36 @@ class ProcessSpoofing(plugins.PluginInterface): Returns: Basename of the first command line argument or None if not available """ + mm = task.mm + if not mm or not mm.is_readable(): + return None + + proc_layer_name = task.add_process_layer() + if proc_layer_name is None: + return None + + proc_layer = context.layers[proc_layer_name] + start = task.mm.arg_start + size_to_read = task.mm.arg_end - task.mm.arg_start + + if not (0 < size_to_read <= 4096): + return None + try: - mm = task.mm - if not mm or not mm.is_readable(): - return None + argv = proc_layer.read(start, size_to_read) + except exceptions.InvalidAddressException as e: + vollog.debug( + f"Unable to read cmdline for task at {task.vol.offset:#x}: {e}" + ) + return None - proc_layer_name = task.add_process_layer() - if proc_layer_name is None: - return None - - proc_layer = context.layers[proc_layer_name] - start = task.mm.arg_start - size_to_read = task.mm.arg_end - task.mm.arg_start - - if not (0 < size_to_read <= 4096): - return None - - try: - argv = proc_layer.read(start, size_to_read) - except exceptions.InvalidAddressException: - return None - - # Parse the arguments - they are null byte terminated - args_str = argv.decode(encoding="utf8", errors="replace") - args_list = args_str.split("\x00") - if args_list and args_list[0]: - basename = PurePosixPath(args_list[0]).name - return basename - else: - return None - - except (exceptions.InvalidAddressException, AttributeError): + # Parse the arguments - they are null byte terminated + args_str = argv.decode(encoding="utf8", errors="replace") + args_list = args_str.split("\x00") + if args_list and args_list[0]: + basename = PurePosixPath(args_list[0]).name + return basename + else: return None @classmethod From d11f50906ac92745d268329eb49fb1ba889c7528 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 19:58:17 +0300 Subject: [PATCH 1322/1352] Plugins: swap notes for boolean flags in process_spoofing --- .../plugins/linux/malware/process_spoofing.py | 56 +++++++++++-------- 1 file changed, 32 insertions(+), 24 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index b3cc37cc7..7f2c9af3c 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -177,7 +177,7 @@ class ProcessSpoofing(plugins.PluginInterface): exe_basename: Optional[str], cmdline_basename: Optional[str], comm: Optional[str], - ) -> Optional[list]: + ) -> Tuple[bool, bool, bool]: """ Analyze the three name sources to detect potential spoofing @@ -187,32 +187,34 @@ class ProcessSpoofing(plugins.PluginInterface): comm: Name from comm field Returns: - notes: List of notes indicating potential spoofing, or None if no issues found + Tuple of (is_deleted, cmdline_spoofed, comm_spoofed) boolean flags """ - notes = [] - - # Skip kernel threads - available_sources = sum( - 1 for name in [exe_basename, cmdline_basename, comm] if name - ) - + # Check if process image has been deleted is_deleted = exe_basename and exe_basename.endswith(self.deleted) + + # Get clean basename for comparison (without " (deleted)" suffix) + clean_exe_basename = exe_basename if is_deleted: - notes.append(f"'Potential Process image deletion: exe_file={exe_basename}'") - exe_basename = exe_basename[: len(self.deleted) * -1] + clean_exe_basename = exe_basename[: len(self.deleted) * -1] + # Skip kernel threads - need at least 2 sources for comparison + available_sources = sum( + 1 for name in [clean_exe_basename, cmdline_basename, comm] if name + ) if available_sources < 2: - return None + return False, False, False - if exe_basename != cmdline_basename: - notes.append( - f"'Potential cmdline spoofing: exe_file={exe_basename};cmdline={cmdline_basename}'" - ) - if exe_basename[:15] != comm: - notes.append( - f"'Potential comm spoofing: exe_file={exe_basename};comm={comm}'" - ) - return notes + # Check for cmdline spoofing + cmdline_spoofed = False + if clean_exe_basename and cmdline_basename: + cmdline_spoofed = clean_exe_basename != cmdline_basename + + # Check for comm spoofing (comm is truncated to 15 characters) + comm_spoofed = False + if clean_exe_basename and comm: + comm_spoofed = clean_exe_basename[:15] != comm + + return is_deleted, cmdline_spoofed, comm_spoofed def _generator(self, tasks) -> Iterator[Tuple[int, Tuple]]: """ @@ -231,7 +233,9 @@ class ProcessSpoofing(plugins.PluginInterface): exe_basename, cmdline_basename, comm = self._extract_process_names(task) - notes = self._detect_spoofing(exe_basename, cmdline_basename, comm) + is_deleted, cmdline_spoofed, comm_spoofed = self._detect_spoofing( + exe_basename, cmdline_basename, comm + ) exe_render = exe_basename if exe_basename else "N/A" cmdline_render = cmdline_basename if cmdline_basename else "N/A" @@ -245,7 +249,9 @@ class ProcessSpoofing(plugins.PluginInterface): exe_render, cmdline_render, comm_render, - "[" + ", ".join(notes) + "]" if notes else "OK", + cmdline_spoofed, + comm_spoofed, + is_deleted, ), ) @@ -265,7 +271,9 @@ class ProcessSpoofing(plugins.PluginInterface): ("Exe_Basename", str), ("Cmdline_Basename", str), ("Comm", str), - ("Notes", str), + ("Cmdline_Spoofed", bool), + ("Comm_Spoofed", bool), + ("Deleted", bool), ], self._generator( pslist.PsList.list_tasks( From 5c7cf1115205673692193dc4292306781dad1bfa Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 19:59:42 +0300 Subject: [PATCH 1323/1352] black --- volatility3/framework/plugins/linux/malware/process_spoofing.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 7f2c9af3c..a38367bd1 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -191,7 +191,7 @@ class ProcessSpoofing(plugins.PluginInterface): """ # Check if process image has been deleted is_deleted = exe_basename and exe_basename.endswith(self.deleted) - + # Get clean basename for comparison (without " (deleted)" suffix) clean_exe_basename = exe_basename if is_deleted: From 41f964cfe12d3958c284e00a08860de94cbb6f52 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 20:16:59 +0300 Subject: [PATCH 1324/1352] Plugins: determine process exe deletion structurally --- .../plugins/linux/malware/process_spoofing.py | 109 ++++++++++-------- 1 file changed, 63 insertions(+), 46 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index a38367bd1..1c2b1a478 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -22,7 +22,6 @@ class ProcessSpoofing(plugins.PluginInterface): _required_framework_version = (2, 0, 0) _version = (1, 1, 0) - deleted = " (deleted)" @classmethod def get_requirements(cls): @@ -51,7 +50,7 @@ class ProcessSpoofing(plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, task: interfaces.objects.ObjectInterface, - ) -> Optional[str]: + ) -> Tuple[Optional[str], bool]: """ Extract the executable path from task_struct.mm.exe_file @@ -60,33 +59,54 @@ class ProcessSpoofing(plugins.PluginInterface): task: task_struct object of the process Returns: - Executable path or None if not available + Tuple of (basename, is_deleted) or (None, False) if not available """ + is_deleted = False + try: mm = task.mm - if not mm or not mm.is_readable(): - # Kernel threads don't have mm struct - return None + except (exceptions.InvalidAddressException, AttributeError) as e: + vollog.debug(f"Unable to access mm for task at {task.vol.offset:#x}: {e}") + return None, is_deleted + if not mm or not mm.is_readable(): + # Kernel threads don't have mm struct + return None, is_deleted + + try: exe_file = mm.exe_file - - if not exe_file or not exe_file.is_readable(): - return None - - exe_inode = exe_file.f_path.dentry.d_inode - exe_path = linux.LinuxUtilities.path_for_file(context, task, exe_file) - - # If the inode link count is 0, the process image has been deleted - if exe_inode.i_nlink == 0: - exe_path += cls.deleted - - return exe_path if exe_path else None - except (exceptions.InvalidAddressException, AttributeError) as e: vollog.debug( - f"Unable to read executable path for task at {task.vol.offset:#x}: {e}" + f"Unable to access exe_file for task at {task.vol.offset:#x}: {e}" ) - return None + return None, is_deleted + + if not exe_file or not exe_file.is_readable(): + return None, is_deleted + + try: + exe_inode = exe_file.f_path.dentry.d_inode + exe_path = linux.LinuxUtilities.path_for_file(context, task, exe_file) + except (exceptions.InvalidAddressException, AttributeError) as e: + vollog.debug( + f"Unable to read exe_file path for task at {task.vol.offset:#x}: {e}" + ) + return None, is_deleted + + if not exe_path: + return None, is_deleted + + try: + # Check if the inode link count is 0 (process image has been deleted) + is_deleted = exe_inode.i_nlink == 0 + except (exceptions.InvalidAddressException, AttributeError) as e: + vollog.debug( + f"Unable to check inode link count for task at {task.vol.offset:#x}: {e}" + ) + # Continue without deletion info - we still have the path + + basename = PurePosixPath(exe_path).name + return basename, is_deleted @classmethod def get_cmdline_basename( @@ -155,7 +175,7 @@ class ProcessSpoofing(plugins.PluginInterface): def _extract_process_names( self, task: interfaces.objects.ObjectInterface - ) -> Tuple[Optional[str], Optional[str], Optional[str]]: + ) -> Tuple[Optional[str], Optional[str], Optional[str], bool]: """ Extract all three process name sources for comparison @@ -163,21 +183,20 @@ class ProcessSpoofing(plugins.PluginInterface): task: task_struct object of the process Returns: - Tuple of (exe_path_basename, cmdline_basename, comm) + Tuple of (exe_basename, cmdline_basename, comm, is_deleted) """ - exe_path = self.get_executable_path(self.context, task) - exe_basename = PurePosixPath(exe_path).name if exe_path else None + exe_basename, is_deleted = self.get_executable_path(self.context, task) cmdline_basename = self.get_cmdline_basename(self.context, task) comm = self.get_comm(task) - return exe_basename, cmdline_basename, comm + return exe_basename, cmdline_basename, comm, is_deleted def _detect_spoofing( self, exe_basename: Optional[str], cmdline_basename: Optional[str], comm: Optional[str], - ) -> Tuple[bool, bool, bool]: + ) -> Tuple[bool, bool]: """ Analyze the three name sources to detect potential spoofing @@ -187,34 +206,26 @@ class ProcessSpoofing(plugins.PluginInterface): comm: Name from comm field Returns: - Tuple of (is_deleted, cmdline_spoofed, comm_spoofed) boolean flags + Tuple of (cmdline_spoofed, comm_spoofed) boolean flags """ - # Check if process image has been deleted - is_deleted = exe_basename and exe_basename.endswith(self.deleted) - - # Get clean basename for comparison (without " (deleted)" suffix) - clean_exe_basename = exe_basename - if is_deleted: - clean_exe_basename = exe_basename[: len(self.deleted) * -1] - # Skip kernel threads - need at least 2 sources for comparison available_sources = sum( - 1 for name in [clean_exe_basename, cmdline_basename, comm] if name + 1 for name in [exe_basename, cmdline_basename, comm] if name ) if available_sources < 2: - return False, False, False + return False, False # Check for cmdline spoofing cmdline_spoofed = False - if clean_exe_basename and cmdline_basename: - cmdline_spoofed = clean_exe_basename != cmdline_basename + if exe_basename and cmdline_basename: + cmdline_spoofed = exe_basename != cmdline_basename # Check for comm spoofing (comm is truncated to 15 characters) comm_spoofed = False - if clean_exe_basename and comm: - comm_spoofed = clean_exe_basename[:15] != comm + if exe_basename and comm: + comm_spoofed = exe_basename[:15] != comm - return is_deleted, cmdline_spoofed, comm_spoofed + return cmdline_spoofed, comm_spoofed def _generator(self, tasks) -> Iterator[Tuple[int, Tuple]]: """ @@ -231,13 +242,19 @@ class ProcessSpoofing(plugins.PluginInterface): pid = task.pid ppid = task.get_parent_pid() - exe_basename, cmdline_basename, comm = self._extract_process_names(task) + exe_basename, cmdline_basename, comm, is_deleted = ( + self._extract_process_names(task) + ) - is_deleted, cmdline_spoofed, comm_spoofed = self._detect_spoofing( + cmdline_spoofed, comm_spoofed = self._detect_spoofing( exe_basename, cmdline_basename, comm ) + # Prepare display values exe_render = exe_basename if exe_basename else "N/A" + if is_deleted and exe_basename: + exe_render += " (deleted)" + cmdline_render = cmdline_basename if cmdline_basename else "N/A" comm_render = comm if comm else "N/A" @@ -273,7 +290,7 @@ class ProcessSpoofing(plugins.PluginInterface): ("Comm", str), ("Cmdline_Spoofed", bool), ("Comm_Spoofed", bool), - ("Deleted", bool), + ("Exe_Deleted", bool), ], self._generator( pslist.PsList.list_tasks( From d384f62721aa578dfb6833768db2c043a6701447 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 25 Jun 2025 20:19:23 +0300 Subject: [PATCH 1325/1352] Plugins: make get_executable_path more accurate in process_spoofing --- .../framework/plugins/linux/malware/process_spoofing.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 1c2b1a478..b9126c723 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -59,7 +59,7 @@ class ProcessSpoofing(plugins.PluginInterface): task: task_struct object of the process Returns: - Tuple of (basename, is_deleted) or (None, False) if not available + Tuple of (full_path, is_deleted) or (None, False) if not available """ is_deleted = False @@ -105,8 +105,7 @@ class ProcessSpoofing(plugins.PluginInterface): ) # Continue without deletion info - we still have the path - basename = PurePosixPath(exe_path).name - return basename, is_deleted + return exe_path, is_deleted @classmethod def get_cmdline_basename( @@ -185,7 +184,8 @@ class ProcessSpoofing(plugins.PluginInterface): Returns: Tuple of (exe_basename, cmdline_basename, comm, is_deleted) """ - exe_basename, is_deleted = self.get_executable_path(self.context, task) + exe_path, is_deleted = self.get_executable_path(self.context, task) + exe_basename = PurePosixPath(exe_path).name if exe_path else None cmdline_basename = self.get_cmdline_basename(self.context, task) comm = self.get_comm(task) From 9686b5ae8bc8b76ac9f0f81e90e5b951dfe994a3 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 1 Oct 2025 11:09:56 +0300 Subject: [PATCH 1326/1352] Plugins: utilize linuxutilities.path_for_file (deleted) logic solely --- .../plugins/linux/malware/process_spoofing.py | 38 ++++++------------- 1 file changed, 11 insertions(+), 27 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index b9126c723..35cbd79d4 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -71,7 +71,7 @@ class ProcessSpoofing(plugins.PluginInterface): if not mm or not mm.is_readable(): # Kernel threads don't have mm struct - return None, is_deleted + return None try: exe_file = mm.exe_file @@ -79,33 +79,20 @@ class ProcessSpoofing(plugins.PluginInterface): vollog.debug( f"Unable to access exe_file for task at {task.vol.offset:#x}: {e}" ) - return None, is_deleted + return None if not exe_file or not exe_file.is_readable(): - return None, is_deleted + return None try: - exe_inode = exe_file.f_path.dentry.d_inode exe_path = linux.LinuxUtilities.path_for_file(context, task, exe_file) except (exceptions.InvalidAddressException, AttributeError) as e: vollog.debug( f"Unable to read exe_file path for task at {task.vol.offset:#x}: {e}" ) - return None, is_deleted + return None - if not exe_path: - return None, is_deleted - - try: - # Check if the inode link count is 0 (process image has been deleted) - is_deleted = exe_inode.i_nlink == 0 - except (exceptions.InvalidAddressException, AttributeError) as e: - vollog.debug( - f"Unable to check inode link count for task at {task.vol.offset:#x}: {e}" - ) - # Continue without deletion info - we still have the path - - return exe_path, is_deleted + return exe_path @classmethod def get_cmdline_basename( @@ -184,12 +171,12 @@ class ProcessSpoofing(plugins.PluginInterface): Returns: Tuple of (exe_basename, cmdline_basename, comm, is_deleted) """ - exe_path, is_deleted = self.get_executable_path(self.context, task) + exe_path = self.get_executable_path(self.context, task) exe_basename = PurePosixPath(exe_path).name if exe_path else None cmdline_basename = self.get_cmdline_basename(self.context, task) comm = self.get_comm(task) - return exe_basename, cmdline_basename, comm, is_deleted + return exe_path, exe_basename, cmdline_basename, comm def _detect_spoofing( self, @@ -242,7 +229,7 @@ class ProcessSpoofing(plugins.PluginInterface): pid = task.pid ppid = task.get_parent_pid() - exe_basename, cmdline_basename, comm, is_deleted = ( + exe_path, exe_basename, cmdline_basename, comm = ( self._extract_process_names(task) ) @@ -250,10 +237,7 @@ class ProcessSpoofing(plugins.PluginInterface): exe_basename, cmdline_basename, comm ) - # Prepare display values - exe_render = exe_basename if exe_basename else "N/A" - if is_deleted and exe_basename: - exe_render += " (deleted)" + is_deleted = exe_path.endswith(" (deleted)") if exe_path else False cmdline_render = cmdline_basename if cmdline_basename else "N/A" comm_render = comm if comm else "N/A" @@ -263,7 +247,7 @@ class ProcessSpoofing(plugins.PluginInterface): ( pid, ppid, - exe_render, + exe_path, cmdline_render, comm_render, cmdline_spoofed, @@ -285,7 +269,7 @@ class ProcessSpoofing(plugins.PluginInterface): [ ("PID", int), ("PPID", int), - ("Exe_Basename", str), + ("Exe_Path", str), ("Cmdline_Basename", str), ("Comm", str), ("Cmdline_Spoofed", bool), From 1359a11f24cbb6bf5d09a31924d52cb2c920caa6 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 1 Oct 2025 11:13:57 +0300 Subject: [PATCH 1327/1352] Plugins: truncate deleted to check spoofing in process_spoofing --- .../framework/plugins/linux/malware/process_spoofing.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 35cbd79d4..a0cee5e4b 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -169,10 +169,12 @@ class ProcessSpoofing(plugins.PluginInterface): task: task_struct object of the process Returns: - Tuple of (exe_basename, cmdline_basename, comm, is_deleted) + Tuple of (exe_path, exe_basename, cmdline_basename, comm) """ exe_path = self.get_executable_path(self.context, task) exe_basename = PurePosixPath(exe_path).name if exe_path else None + if exe_basename.endswith(" (deleted)"): + exe_basename = exe_basename[:-len(" (deleted)")] cmdline_basename = self.get_cmdline_basename(self.context, task) comm = self.get_comm(task) @@ -210,6 +212,7 @@ class ProcessSpoofing(plugins.PluginInterface): # Check for comm spoofing (comm is truncated to 15 characters) comm_spoofed = False if exe_basename and comm: + print(exe_basename, comm) comm_spoofed = exe_basename[:15] != comm return cmdline_spoofed, comm_spoofed From cbe5b46b8e542c4407af8389355f8c01dc15430f Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 1 Oct 2025 11:21:19 +0300 Subject: [PATCH 1328/1352] Plugins: process_spoofing change extract_process_names to classmethod --- .../plugins/linux/malware/process_spoofing.py | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index a0cee5e4b..fafca4da1 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -50,7 +50,7 @@ class ProcessSpoofing(plugins.PluginInterface): cls, context: interfaces.context.ContextInterface, task: interfaces.objects.ObjectInterface, - ) -> Tuple[Optional[str], bool]: + ) -> Optional[str]: """ Extract the executable path from task_struct.mm.exe_file @@ -59,15 +59,14 @@ class ProcessSpoofing(plugins.PluginInterface): task: task_struct object of the process Returns: - Tuple of (full_path, is_deleted) or (None, False) if not available + Returns executable path or None if not available """ - is_deleted = False try: mm = task.mm except (exceptions.InvalidAddressException, AttributeError) as e: vollog.debug(f"Unable to access mm for task at {task.vol.offset:#x}: {e}") - return None, is_deleted + return None if not mm or not mm.is_readable(): # Kernel threads don't have mm struct @@ -159,24 +158,24 @@ class ProcessSpoofing(plugins.PluginInterface): vollog.debug(f"Unable to read comm for task at {task.vol.offset:#x}: {e}") return None - def _extract_process_names( - self, task: interfaces.objects.ObjectInterface - ) -> Tuple[Optional[str], Optional[str], Optional[str], bool]: + @classmethod + def extract_process_names( + cls, + context: interfaces.context.ContextInterface, + task: interfaces.objects.ObjectInterface, + ) -> Tuple[Optional[str], Optional[str], Optional[str], Optional[str], bool]: """ - Extract all three process name sources for comparison - - Args: - task: task_struct object of the process - + Extract all process name sources for comparison + Returns: Tuple of (exe_path, exe_basename, cmdline_basename, comm) """ - exe_path = self.get_executable_path(self.context, task) + exe_path = cls.get_executable_path(context, task) exe_basename = PurePosixPath(exe_path).name if exe_path else None - if exe_basename.endswith(" (deleted)"): + if exe_basename and exe_basename.endswith(" (deleted)"): exe_basename = exe_basename[:-len(" (deleted)")] - cmdline_basename = self.get_cmdline_basename(self.context, task) - comm = self.get_comm(task) + cmdline_basename = cls.get_cmdline_basename(context, task) + comm = cls.get_comm(task) return exe_path, exe_basename, cmdline_basename, comm @@ -212,7 +211,6 @@ class ProcessSpoofing(plugins.PluginInterface): # Check for comm spoofing (comm is truncated to 15 characters) comm_spoofed = False if exe_basename and comm: - print(exe_basename, comm) comm_spoofed = exe_basename[:15] != comm return cmdline_spoofed, comm_spoofed @@ -233,7 +231,7 @@ class ProcessSpoofing(plugins.PluginInterface): ppid = task.get_parent_pid() exe_path, exe_basename, cmdline_basename, comm = ( - self._extract_process_names(task) + self.extract_process_names(self.context, task) ) cmdline_spoofed, comm_spoofed = self._detect_spoofing( From c3ddc094cbcccda4fd70fdbd4375e2249d470b73 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 1 Oct 2025 11:27:46 +0300 Subject: [PATCH 1329/1352] Plugins: process spoofing handle none values and set more classmethods --- .../framework/plugins/linux/malware/process_spoofing.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index fafca4da1..428a79bc7 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -240,6 +240,8 @@ class ProcessSpoofing(plugins.PluginInterface): is_deleted = exe_path.endswith(" (deleted)") if exe_path else False + # Convert None values to strings for TreeGrid compatibility + exe_path_render = exe_path if exe_path else "N/A" cmdline_render = cmdline_basename if cmdline_basename else "N/A" comm_render = comm if comm else "N/A" @@ -248,7 +250,7 @@ class ProcessSpoofing(plugins.PluginInterface): ( pid, ppid, - exe_path, + exe_path_render, cmdline_render, comm_render, cmdline_spoofed, From 4cb326fb6ed8cefb79fb80b20014936757c52c32 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 1 Oct 2025 11:28:44 +0300 Subject: [PATCH 1330/1352] black and ruff --- .../framework/plugins/linux/malware/process_spoofing.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 428a79bc7..1048378b9 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -166,14 +166,14 @@ class ProcessSpoofing(plugins.PluginInterface): ) -> Tuple[Optional[str], Optional[str], Optional[str], Optional[str], bool]: """ Extract all process name sources for comparison - + Returns: Tuple of (exe_path, exe_basename, cmdline_basename, comm) """ exe_path = cls.get_executable_path(context, task) exe_basename = PurePosixPath(exe_path).name if exe_path else None if exe_basename and exe_basename.endswith(" (deleted)"): - exe_basename = exe_basename[:-len(" (deleted)")] + exe_basename = exe_basename[: -len(" (deleted)")] cmdline_basename = cls.get_cmdline_basename(context, task) comm = cls.get_comm(task) From 9c5950e5957f7e6980cc41708830aa74bdb47980 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 1 Oct 2025 11:29:15 +0300 Subject: [PATCH 1331/1352] Plugins: process_spoofing bump required_framework_version --- volatility3/framework/plugins/linux/malware/process_spoofing.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 1048378b9..941f1495e 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -20,7 +20,7 @@ vollog = logging.getLogger(__name__) class ProcessSpoofing(plugins.PluginInterface): """Detects process spoofing by comparing executable path to cmdline & comm fields""" - _required_framework_version = (2, 0, 0) + _required_framework_version = (2, 27, 0) _version = (1, 1, 0) @classmethod From d13de25b46c05abf19c2770d2cd6bcc13985ecdc Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 31 Dec 2025 00:26:09 +0200 Subject: [PATCH 1332/1352] Constants: add MAX_ARG_STRLEN linux constant --- volatility3/framework/constants/linux/__init__.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/volatility3/framework/constants/linux/__init__.py b/volatility3/framework/constants/linux/__init__.py index 72440e23e..793ef11e8 100644 --- a/volatility3/framework/constants/linux/__init__.py +++ b/volatility3/framework/constants/linux/__init__.py @@ -9,6 +9,10 @@ Linux-specific values that aren't found in debug symbols import enum from dataclasses import dataclass +# Exec argument limits +# Ref: include/uapi/linux/binfmts.h (linux.git commit f6031913338f1dad5bd8cb7286ff4e53644b6940) +MAX_ARG_STRLEN = 32 * 4096 + KERNEL_NAME = "__kernel__" """The value hard coded from the Linux Kernel (hence not extracted from the layer itself)""" From a2e033dfc8773a5583136752d06fdbe49db3304f Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:18:48 +0000 Subject: [PATCH 1333/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 4f16920cf..1709dfbfc 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -339,7 +339,7 @@ class Sockscan(plugins.PluginInterface): ) return None - def _generator(self, symbol_table_name: str): + def _generator(self, kernel_module_name: str): """Scans for sockets. Each row represents a kernel socket. Args: From 5205d2cee0212b0662007152d363393dbf0ed424 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:19:08 +0000 Subject: [PATCH 1334/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 1709dfbfc..b15d7027b 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -343,7 +343,7 @@ class Sockscan(plugins.PluginInterface): """Scans for sockets. Each row represents a kernel socket. Args: - symbol_table_name: The name of the kernel module on which to operate + kernel_module_name: The name of the kernel module on which to operate Yields: addr: Physical offset From c7510f7e00c388c0c316d281ae78b0d4b03b0aff Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:19:37 +0000 Subject: [PATCH 1335/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index b15d7027b..02e673d84 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -358,7 +358,7 @@ class Sockscan(plugins.PluginInterface): """ # get vmlinux module from context in order to build objects and read symbols - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] # get the memory layer that is to be scanned. memory_layer_name = self._find_memory_layer_name(symbol_table_name) From be11441ef0bd528f8dafc70f174682078cd4ef2d Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:19:50 +0000 Subject: [PATCH 1336/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 02e673d84..d30d819aa 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -361,7 +361,7 @@ class Sockscan(plugins.PluginInterface): vmlinux = self.context.modules[kernel_module_name] # get the memory layer that is to be scanned. - memory_layer_name = self._find_memory_layer_name(symbol_table_name) + memory_layer_name = self._find_memory_layer_name(kernel_module_name) memory_layer = self.context.layers[memory_layer_name] # use the init process to build a sock handler From 7ba46943bbd1faa130f7ac3730f5c5b440e64c1d Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:19:59 +0000 Subject: [PATCH 1337/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index d30d819aa..c6aaedf12 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -411,7 +411,7 @@ class Sockscan(plugins.PluginInterface): # if match is from file_ops_needles attempt to walk from file object to the sock if match in file_ops_needles: psock = self._walk_file_ops_needles( - symbol_table_name, memory_layer_name, needle_addr, f_op_offset + kernel_module_name, memory_layer_name, needle_addr, f_op_offset ) if psock is not None and sock_physical_addr not in seen_sock_physical_addr: From 3872133f5d99cfca014ca4314b4311a922f0708f Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:20:09 +0000 Subject: [PATCH 1338/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index c6aaedf12..caeb3fbf2 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -379,7 +379,7 @@ class Sockscan(plugins.PluginInterface): # Method 2 - find sockets by socket destructor directly inside sock objects socket_destructor_needles, sk_destruct_offset = self._find_sk_destruct_needles( - symbol_table_name + kernel_module_name ) # TODO Method 3 - find sock by sk_error_report symbols From 4fbd54361a43c1bced645adfbcf5dd187d7d28ca Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:20:20 +0000 Subject: [PATCH 1339/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index caeb3fbf2..3cf7277b8 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -375,7 +375,7 @@ class Sockscan(plugins.PluginInterface): progress_callback = self._progress_callback # Method 1 - find sockets by file operations, then follow pointers to sockets - file_ops_needles, f_op_offset = self._find_file_ops_needles(symbol_table_name) + file_ops_needles, f_op_offset = self._find_file_ops_needles(kernel_module_name) # Method 2 - find sockets by socket destructor directly inside sock objects socket_destructor_needles, sk_destruct_offset = self._find_sk_destruct_needles( From 35d24d8d1794c5f0f5e322c6104afe6dd51cbd9f Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:20:30 +0000 Subject: [PATCH 1340/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 3cf7277b8..7a230df78 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -193,7 +193,7 @@ class Sockscan(plugins.PluginInterface): def _walk_file_ops_needles( self, symbol_table_name, memory_layer_name, needle_addr, f_op_offset ): - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] try: # create file in the memory_layer, the native layer matches the # kernel so that pointers can be followed From 13aa0dd2dc2aa80b80928933481c8f1a68570852 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:20:44 +0000 Subject: [PATCH 1341/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 7a230df78..cd2998ce4 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -368,7 +368,7 @@ class Sockscan(plugins.PluginInterface): # TODO: look into options so that sockstat.SockHandlers so that process_sock can # be used without a task object. init_task = vmlinux.object_from_symbol(symbol_name="init_task") - sock_handler = sockstat.SockHandlers(self.context, symbol_table_name, init_task) + sock_handler = sockstat.SockHandlers(self.context, kernel_module_name, init_task) # get progress_callback in order to use this in the scanners. # TODO: perhaps add more detail to progress, showing method in progress and number of hits found From da6a1e54443206fac42e7624a9c3180ed04f7406 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:20:57 +0000 Subject: [PATCH 1342/1352] Update volatility3/framework/plugins/linux/sockscan.py Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index cd2998ce4..38abcbf0a 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -57,7 +57,7 @@ class Sockscan(plugins.PluginInterface): ] def _canonicalize_symbol_addrs( - self, symbol_table_name: str, symbol_names: List[str] + self, kernel_module_name: str, symbol_names: List[str] ) -> Set[bytes]: """Takes a list of symbol names and converts the address of each to the bytes as they would appear in memory so that they can be scanned for. From 4369935be47669f17758015d5b0127be981582d4 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:21:19 +0000 Subject: [PATCH 1343/1352] Apply suggestion from @ikelos Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 38abcbf0a..3091fba4d 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -65,7 +65,7 @@ class Sockscan(plugins.PluginInterface): Symbols that cannot be found are ignored and not included in the results. Args: - symbol_table_name: The name of the kernel module on which to operate + kernel_module_name: The name of the kernel module on which to operate symbol_names: A list of symbol names to be looked up Returns: From 55c0b9b0a84d60e21973f6aa3977ae4c0f7e4e8e Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:21:32 +0000 Subject: [PATCH 1344/1352] Apply suggestion from @ikelos Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 3091fba4d..fc65976de 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -72,7 +72,7 @@ class Sockscan(plugins.PluginInterface): A set of bytes which are the packed addresses. """ # get vmlinux module from context in order to build objects and read symbols - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] # get kernel layer from context so that it's dependencies can be found, and therefore scanned. # kernel layer will be virtual and built ontop of a physical layer. From c47ab6ba1176ca5da3cf285d952f8df6dd3fd5a9 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:21:47 +0000 Subject: [PATCH 1345/1352] Apply suggestion from @ikelos Co-authored-by: ikelos --- volatility3/framework/plugins/linux/sockscan.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index fc65976de..d99157b3b 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -112,7 +112,7 @@ class Sockscan(plugins.PluginInterface): return packed_needles - def _find_memory_layer_name(self, symbol_table_name: str): + def _find_memory_layer_name(self, kernel_module_name: str): """Find the memory layer below the kernel. Only returns a single layer, and will warn the user if multiple layers are found. From f11347739b065d54a4c72daf32ce31d0c783f501 Mon Sep 17 00:00:00 2001 From: Eve <120014766+eve-mem@users.noreply.github.com> Date: Wed, 31 Dec 2025 12:22:48 +0000 Subject: [PATCH 1346/1352] Apply suggestions from code review Co-authored-by: ikelos --- .../framework/plugins/linux/sockscan.py | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index d99157b3b..116dfa4ae 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -117,14 +117,14 @@ class Sockscan(plugins.PluginInterface): and will warn the user if multiple layers are found. Args: - symbol_table_name: The name of the kernel module on which to operate. + kernel_module_name: The name of the kernel module on which to operate. Returns: memory_layer_name: The name of the layer below the kernel to be scanned. """ # get vmlinux module from context in order to build objects and read symbols - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] # get kernel layer from context so that it's dependencies can be found, and therefore scanned. # kernel layer will be virtual and built ontop of a physical layer. @@ -150,16 +150,16 @@ class Sockscan(plugins.PluginInterface): return memory_layer_name - def _find_file_ops_needles(self, symbol_table_name: str): + def _find_file_ops_needles(self, kernel_module_name: str): # get vmlinux module from context in order to read symbols - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] file_ops_symbol_names = [ "socket_file_ops", "sockfs_dentry_operations", ] file_ops_needles = self._canonicalize_symbol_addrs( - symbol_table_name, file_ops_symbol_names + kernel_module_name, file_ops_symbol_names ) # get file struct to find the offset to the f_op pointer # this is so that the file object can be created at the correct offset, @@ -168,9 +168,9 @@ class Sockscan(plugins.PluginInterface): return (file_ops_needles, f_op_offset) - def _find_sk_destruct_needles(self, symbol_table_name: str): + def _find_sk_destruct_needles(self, kernel_module_name: str): # get vmlinux module from context in order to read symbols - vmlinux = self.context.modules[symbol_table_name] + vmlinux = self.context.modules[kernel_module_name] socket_destructor_symbol_names = [ "sock_def_destruct", @@ -180,7 +180,7 @@ class Sockscan(plugins.PluginInterface): "inet_sock_destruct", ] socket_destructor_needles = self._canonicalize_symbol_addrs( - symbol_table_name, socket_destructor_symbol_names + kernel_module_name, socket_destructor_symbol_names ) # get sock struct to find the offset to the sk_destruct pointer # this is so that the sock object can be created at the correct offset, @@ -191,7 +191,7 @@ class Sockscan(plugins.PluginInterface): return (socket_destructor_needles, sk_destruct_offset) def _walk_file_ops_needles( - self, symbol_table_name, memory_layer_name, needle_addr, f_op_offset + self, kernel_module_name, memory_layer_name, needle_addr, f_op_offset ): vmlinux = self.context.modules[kernel_module_name] try: From 6aa552cd03d14837b593c34bf9a4b99a4f800bae Mon Sep 17 00:00:00 2001 From: eve Date: Wed, 31 Dec 2025 12:25:22 +0000 Subject: [PATCH 1347/1352] Fix black formatting in sockscan --- volatility3/framework/plugins/linux/sockscan.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 116dfa4ae..984c503b8 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -368,7 +368,9 @@ class Sockscan(plugins.PluginInterface): # TODO: look into options so that sockstat.SockHandlers so that process_sock can # be used without a task object. init_task = vmlinux.object_from_symbol(symbol_name="init_task") - sock_handler = sockstat.SockHandlers(self.context, kernel_module_name, init_task) + sock_handler = sockstat.SockHandlers( + self.context, kernel_module_name, init_task + ) # get progress_callback in order to use this in the scanners. # TODO: perhaps add more detail to progress, showing method in progress and number of hits found From 66ec4f43723af757630f3ca3293cf47825f7ad7f Mon Sep 17 00:00:00 2001 From: eve Date: Wed, 31 Dec 2025 12:49:45 +0000 Subject: [PATCH 1348/1352] Linux: update sockstat docstring for _walk_file_ops_needles. Rename physical_memory_layer_name for clarity --- .../framework/plugins/linux/sockscan.py | 26 ++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 984c503b8..0056a1925 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -191,8 +191,28 @@ class Sockscan(plugins.PluginInterface): return (socket_destructor_needles, sk_destruct_offset) def _walk_file_ops_needles( - self, kernel_module_name, memory_layer_name, needle_addr, f_op_offset + self, + kernel_module_name: str, + physical_memory_layer_name: str, + needle_addr: int, + f_op_offset: int, ): + """ + This method attempts to walk from the f_op member of files to the + corresponding socket. If sucessful the socket object is created on the + memory layer and returned. + + Args: + kernel_module_name (str): The name of the kernel module from which, + to retrieve the file operations. + physical_memory_layer_name (str): The name of the physical memory layer that was scanned + needle_addr: The address of the needle that was found during the scanning + f_op_offset: The offset to the f_op member of the file type + + Returns: + psock: The sock object that was built on the memory layer + """ + vmlinux = self.context.modules[kernel_module_name] try: # create file in the memory_layer, the native layer matches the @@ -201,7 +221,7 @@ class Sockscan(plugins.PluginInterface): pfile = self.context.object( vmlinux.symbol_table_name + constants.BANG + "file", offset=sock_physical_addr, - layer_name=memory_layer_name, + layer_name=physical_memory_layer_name, native_layer_name=vmlinux.layer_name, ) dentry = pfile.get_dentry() @@ -248,7 +268,7 @@ class Sockscan(plugins.PluginInterface): psock = self.context.object( vmlinux.symbol_table_name + constants.BANG + "sock", offset=physical_sock_offset, - layer_name=memory_layer_name, + layer_name=physical_memory_layer_name, native_layer_name=vmlinux.layer_name, ) From 94f989be7ab0fe7704ca69d134b29f27d8a3a84b Mon Sep 17 00:00:00 2001 From: eve Date: Wed, 31 Dec 2025 12:54:41 +0000 Subject: [PATCH 1349/1352] Linux: update sockscan to add docstring to _find_file_ops_needles --- volatility3/framework/plugins/linux/sockscan.py | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/volatility3/framework/plugins/linux/sockscan.py b/volatility3/framework/plugins/linux/sockscan.py index 0056a1925..9288d85f0 100644 --- a/volatility3/framework/plugins/linux/sockscan.py +++ b/volatility3/framework/plugins/linux/sockscan.py @@ -151,6 +151,16 @@ class Sockscan(plugins.PluginInterface): return memory_layer_name def _find_file_ops_needles(self, kernel_module_name: str): + """Retrieves socket file symbols and the offset to the 'f_op' pointer. + + Args: + kernel_module_name (str): The name of the kernel module to search. + + Returns: + Tuple[List[int], int]: A list of file symbol addresses and, + the offset to the 'f_op' pointer. + """ + # get vmlinux module from context in order to read symbols vmlinux = self.context.modules[kernel_module_name] From 2478c1398eb5b0afebc78d237a710d6d2aa760f1 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 31 Dec 2025 20:06:50 +0200 Subject: [PATCH 1350/1352] Plugins: get first argument using utility.address_to_string in process_spoofing --- .../plugins/linux/malware/process_spoofing.py | 26 ++++++++++++------- 1 file changed, 16 insertions(+), 10 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 941f1495e..64f3274e9 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -7,6 +7,7 @@ from pathlib import PurePosixPath from typing import Optional, Tuple, Iterator from volatility3.framework import exceptions, interfaces, renderers +from volatility3.framework.constants import linux as linux_constants from volatility3.framework.configuration import requirements from volatility3.framework.interfaces import plugins from volatility3.framework.objects import utility @@ -117,30 +118,35 @@ class ProcessSpoofing(plugins.PluginInterface): if proc_layer_name is None: return None - proc_layer = context.layers[proc_layer_name] start = task.mm.arg_start size_to_read = task.mm.arg_end - task.mm.arg_start - if not (0 < size_to_read <= 4096): + if size_to_read <= 0: return None + read_length = min(size_to_read, linux_constants.MAX_ARG_STRLEN) + try: - argv = proc_layer.read(start, size_to_read) + cmdline = utility.address_to_string( + context=context, + layer_name=proc_layer_name, + address=start, + count=read_length, + errors="replace", + encoding="utf-8" + ) except exceptions.InvalidAddressException as e: vollog.debug( f"Unable to read cmdline for task at {task.vol.offset:#x}: {e}" ) return None - # Parse the arguments - they are null byte terminated - args_str = argv.decode(encoding="utf8", errors="replace") - args_list = args_str.split("\x00") - if args_list and args_list[0]: - basename = PurePosixPath(args_list[0]).name - return basename - else: + if not cmdline: return None + basename = PurePosixPath(cmdline).name + return basename if basename else None + @classmethod def get_comm(cls, task: interfaces.objects.ObjectInterface) -> Optional[str]: """ From 088a64379cddf40f6d7f8c4465724233338ba111 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 31 Dec 2025 20:13:01 +0200 Subject: [PATCH 1351/1352] black --- volatility3/framework/plugins/linux/malware/process_spoofing.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 64f3274e9..0d64861b2 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -133,7 +133,7 @@ class ProcessSpoofing(plugins.PluginInterface): address=start, count=read_length, errors="replace", - encoding="utf-8" + encoding="utf-8", ) except exceptions.InvalidAddressException as e: vollog.debug( From e8087dd68d77391ca6a201abb9a64a558e104a13 Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 31 Dec 2025 20:23:05 +0200 Subject: [PATCH 1352/1352] Plugins: process_spoofing put reference in docstring --- .../plugins/linux/malware/process_spoofing.py | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/volatility3/framework/plugins/linux/malware/process_spoofing.py b/volatility3/framework/plugins/linux/malware/process_spoofing.py index 0d64861b2..493a1de9a 100644 --- a/volatility3/framework/plugins/linux/malware/process_spoofing.py +++ b/volatility3/framework/plugins/linux/malware/process_spoofing.py @@ -17,9 +17,11 @@ from volatility3.plugins.linux import pslist vollog = logging.getLogger(__name__) -# https://github.com/SolitudePy/linux-mal class ProcessSpoofing(plugins.PluginInterface): - """Detects process spoofing by comparing executable path to cmdline & comm fields""" + """Detects process spoofing by comparing executable path to cmdline & comm fields. + + Examples of such behavior can be found here: https://github.com/SolitudePy/linux-mal + """ _required_framework_version = (2, 27, 0) _version = (1, 1, 0) @@ -101,7 +103,12 @@ class ProcessSpoofing(plugins.PluginInterface): task: interfaces.objects.ObjectInterface, ) -> Optional[str]: """ - Extract the command line arguments and return the basename of the first argument + Extract the command line arguments and return the basename of the first argument. + + Notes: + The read length is capped at ``MAX_ARG_STRLEN`` (32 * 4096) per the + kernel limit defined in ``include/uapi/linux/binfmts.h`` (see + linux.git commit f6031913338f1dad5bd8cb7286ff4e53644b6940). Args: context: The context to operate on